PRIVACY POLICY - INFORMATION ON THE PROCESSING OF PERSONAL DATA
of users interacting with the website of Made in Steel S.r.l.

Pursuant to Regulation (EU) 2016/679 (hereinafter referred to as ‘Regulation’) and Legislative Decree no. 196/2003 (hereinafter referred to collectively as ‘Applicable Legislation’), this document describes the general terms and conditions for the processing of personal data of users and/or of any personal data of third parties provided by users (even in the case of an individual acting as a sole proprietor, small entrepreneur or professional) including their employees, agents, representatives or collaborators (collectively ‘Personal Data’) interacting with the website of Made in Steel S.r.l., accessible by electronic means at the following address: www.madeinsteel.it (hereinafter ‘Site’).

This information does not concern other sites, pages or online services that can be reached through hypertext links that may be published on the Site and/or refer to resources outside the domain indicated above.

By accessing the Site and browsing its web pages, the User declares that he/she accepts being subject to the applicable regulations in force in Italy.

Personal Data will be processed in compliance with the principles of lawfulness, correctness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. Specific security measures are taken to prevent the loss of personal data, unlawful or incorrect use and unauthorised access.

DATA CONTROLLER
The data controller is Made in Steel S.r.l.; Tax Code and VAT No.: 03608030171, with registered office in via Don Milani n.5 - Flero (Brescia) Italy phone +39 030 2548 520; e-mail: info@madeinsteel.it (hereinafter ‘’Data Controller‘’).

DATA PROTECTION OFFICER
The data subject may lodge complaints and/or exercise his/her rights (as explained in more detail below in the paragraph ‘Data Subject Rights’) by contacting the Data Protection Officer, Mr. Alessandro Donati, email address alessandro.donati@studiogoriominervini.it, registered email alessandro.donati@brescia.pecavvocati.it, phone +3903047502 (hereinafter ‘DPO’).

CATEGORIES OF PERSONAL DATA PROCESSED, PURPOSES AND BASIS OF PROCESSING

Browsing data
The computer systems and software procedures used to operate this Site acquire, during their normal operation, some Personal Data the transmission of which is implicit in the use of Internet communication protocols.
This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with other data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment.

This data, necessary for the use of web services, is also processed on the basis of the Data Controller's legitimate interest pursuant to Article 6(1)(f) of the Regulation, in order to:

  • obtain statistical information on the use of the services (most visited pages, number of visitors per time slot or per day, geographical areas of origin, etc.);
  • check the correct functioning of the services offered.

Browsing data are not stored for longer than seven days and are deleted immediately after their aggregation (except in the event of the need to ascertain crimes by the judicial authorities).

Cookies and other tracking systems
Technical cookies are used on our Site solely to ensure its proper functioning and to enable navigation; these do not require the user's consent. Analytics and profiling cookies, if present, are used only with the user's prior consent pursuant to Article 6(1)(a) of the Regulation, as required by applicable law. The duration of cookies and the possibility of access to information by third parties are detailed in our separate cookie policy. Users may withdraw their consent at any time and can deactivate cookies through their browser settings or the cookie management tool provided. For further information, please refer to our cookie policy at click here (http:/www.madeinsteel.it/en/cookie-policy).

Data voluntarily provided by the user
Apart from what is specified for browsing data, the user is free to provide Personal Data to request information and/or documents and/or other communications, including through forms available on the Site or on external platforms connected thereto (such as the Mailup/Emailsp platform). By way of example, Personal Data may be collected through: (i) forms for the subscription to the Data Controller's mailing list for updates, news and events relating to the Made in Steel trade fair event, which may include: name, surname and e-mail address; and (ii) forms for the submission of indications of interest for exhibition at the Made in Steel trade fair event, which may include: name, surname, company name, country, telephone number, e-mail address and stand/booth preferences.

The Personal Data voluntarily provided by the user through contact with the Data Controller, data that do not fall within the special categories of personal data as listed in Article 9 of the Regulation, are processed under the conditions of lawfulness provided for by Article 6 of the Regulation. In particular, the legal bases applicable to each purpose of processing are as follows: (i) performance of a contract or pre-contractual measures at the request of the data subject, pursuant to Article 6(1)(b) of the Regulation, for the management of the contractual relationship and the processing of requests submitted by the user; (ii) compliance with legal obligations to which the Data Controller is subject, pursuant to Article 6(1)(c) of the Regulation, for the fulfilment of obligations arising from applicable laws and regulations; (iii) the Data Controller's legitimate interest, pursuant to Article 6(1)(f) of the Regulation, for the purposes of soft spam by e-mail relating to products or services similar to those already provided, as well as for the creation of statistics; and (iv) the data subject's consent, pursuant to Article 6(1)(a) of the Regulation, for the sending of promotional material, communications regarding future initiatives, conventions and meetings, and any other marketing activity not covered by the legitimate interest referred to above. Where Personal Data are processed on the basis of the Data Controller's legitimate interest for soft spam purposes, the data subject has the right to object at any time to such processing pursuant to Article 21(2) of the Regulation, and upon receipt of such objection the Data Controller shall cease processing the data for that purpose.

The processing of the Personal Data provided to the Data Controller will include: management, organisation, use, storage, creation of the database, processing, destruction and modification of the processed data following notification by the data subject, consultation, communication, creation of statistics, sending of promotional material as well as use to promote conventions and meetings, management of indications of interest for exhibition at the Made in Steel trade fair event, and deletion. Personal Data may be processed within the European Union and, where necessary, in non-EU countries that have been the subject of an adequacy decision by the European Commission pursuant to Article 45 of the Regulation or, in the absence thereof, on the basis of appropriate safeguards pursuant to Article 46 of the Regulation, including standard contractual clauses adopted by the European Commission. A copy of the appropriate safeguards may be obtained by contacting the Data Controller at the addresses indicated above.

Please also note that the processing of Personal Data related to the web services provided by this Site physically "hosted" by Amazon Web Services is carried out at the Data Controller's premises.

The optional, explicit and voluntary transmission of messages to the contact addresses, as well as the filling in and forwarding of the forms on the Site or on external platforms connected thereto, will entail the acquisition of the Personal Data necessary to reply to and process the requests made and the processing of such Personal Data for the purposes indicated above.

PROCESSING AND STORAGE METHODS
The Data Controller does not carry out any processing based on automated decision-making processes.
Personal Data shall be processed by IT and/or paper means and shall be stored for a period of time not exceeding that necessary to achieve the purposes for which they were collected and subsequently processed. In particular, Personal Data collected for contractual purposes will be kept for the time necessary for the fulfilment of all the obligations provided for in the contract as well as for the legal obligations established by the laws in force, including subordinate ones, and in any case within the term of 10 years starting from the termination of the contract or, if later, from a binding decision issued by an administrative or judicial authority. In any case, this is without prejudice to any obligations to store for longer periods of time if prescribed by law in relation to particular categories of data, or if this is necessary to protect the rights of our company in the event of any disputes arising in connection with the provision of the service.

The Personal Data collected to evaluate the closing of the contract will be deleted within 12 months if the contract is not finalised.

Where necessary, it is specified that any Personal Data processed for which the legal basis is the data subject's consent shall be retained until consent is revoked, and in any case for no longer than 24 months from the date of collection or the last renewal of consent. Upon expiry of the 24-month period, unless renewed by the data subject, the Data Controller will delete the data within 30 days. In the event of revocation of consent prior to the expiry of the 24-month period, the Data Controller will delete the data within 30 days from receipt of revocation of consent.

The communication of the Data Controller's activities and news related to the Made in Steel trade fair event, as well as the collection and management of indications of interest for exhibition at the event, is reserved for specific categories of registered users.

In order to provide and manage this service, including the collection of indications of interest for exhibition through dedicated forms, the Data Controller uses the services and tools provided by Mailup S.p.A. (operating also through the Emailsp platform), acting as data processor pursuant to Article 28 of the Regulation. The legal basis for the processing of Personal Data for the purpose of sending newsletters and communications relating to the Made in Steel trade fair event is the data subject's consent pursuant to Article 6(1)(a) of the Regulation, or, where applicable, the Data Controller's legitimate interest pursuant to Article 6(1)(f) of the Regulation in the case of soft spam. The legal basis for the processing of Personal Data collected through forms for the submission of indications of interest for exhibition is the performance of pre-contractual measures at the request of the data subject, pursuant to Article 6(1)(b) of the Regulation. For further information on the processing of personal data by Mailup S.p.A., the Data Controller recommends visiting the following link : https://www.mailup.it/gdpr-mailup/. Failure to provide Personal Data will not entail any consequences for the user except, in the case of failure to provide necessary data, the impossibility of allowing the user to use the services requested, from which it is possible to unsubscribe using the unsubscribe button at the bottom of each communication.

RECIPIENTS OF DATA
The Personal Data collected will be processed by persons authorised to process the data and, in particular, by the Data Controller's internal staff and/or collaborators, duly trained and authorised to process the data in accordance with the specific instructions given by the Data Controller in compliance with the current legislation and with regard to the purposes and methods of processing.

In addition, Personal Data may be communicated to the following categories of recipients, which the Data Controller uses to perform activities necessary to achieve the purposes set out above:

  • data processors, including Mailup S.p.A., and possible sub-processors in compliance with the provisions of Article 28 of Regulation No. 679/2016;
  • companies and/or third parties who carry out technical coordination, assistance and maintenance of IT systems on behalf of the Data Controller;
  • companies and/or third parties (including legal, tax and accounting professionals) providing advisory, assistance or consultancy services to the Data Controller.

The updated list of Data Processors and Authorised Persons is kept at the Data Controller's registered office.

In any case, Personal Data shall not be subject to dissemination.

RIGHTS OF THE DATA SUBJECT
The data subject has the following rights:

  • to access, i.e. to obtain confirmation as to whether or not Personal Data relating to him or her are being processed and, if so, to obtain access to such data, including a copy thereof;
  • rectification, i.e. obtaining without undue delay the rectification of inaccurate Personal Data concerning him/her and/or the integration of incomplete Personal Data;
  • erasure (right to be forgotten), i.e. to obtain without undue delay the deletion of Personal Data concerning him/her;
  • restriction of processing, i.e. to obtain the restriction of processing, in the cases referred to in Article 18 of the Regulation;
  • data portability, i.e. the right to receive from the Data Controller, in a structured, commonly used and machine-readable format, Personal Data concerning him/her and the right to have them transmitted to another controller without hindrance, where the processing is based on consent and is carried out by automated means, as well as to have them transmitted directly to another controller where technically feasible;
  • objection, i.e. the right to object at any time, on grounds relating to his or her particular situation, to the processing of Personal Data concerning him or her based on the lawfulness of the legitimate interest or the performance of a task carried out in the public interest or in the exercise of official authority, including profiling, unless there are legitimate grounds for the Data Controller to continue the processing which prevail over the interests, rights and freedoms of the data subject or for the establishment, assertion or defence of legal claims. Furthermore, the right to object at any time to the processing if Personal Data are processed for direct marketing purposes, including profiling, insofar as it is related to such direct marketing;
  • withdrawal of consent at any time. Withdrawal of consent does not affect the lawfulness of the processing based on consent before the withdrawal;
  • complain, i.e. to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it). Data subjects located in other EU/EEA Member States may lodge a complaint with the supervisory authority of their country of habitual residence, place of work or place of the alleged infringement, in accordance with Article 77 of the Regulation.

COPYRIGHT
The information and materials published on the Site are created and provided free of charge. Made in Steel accepts no liability for any errors or inaccuracies; however, we reserve the right to modify, add, remove any or all of the content as well as to suspend, interrupt or limit access to the Site or the content at any time, at our sole discretion and without prior notice. The Site and all its contents, including partial content, documents, databases that can be found and used therein and the related consultation systems, are protected by current copyright laws, are the exclusive property of Made in Steel and represent the company's assets protected by law. As a result of the above it is therefore recalled that the Site navigator has no right to appropriate, reproduce, modify, translate, distribute, republish in any form, even partially, or otherwise use the contents of the Site except for strictly personal purposes. The Made in Steel trademark, documentation, images, fonts, graphics, Made in Steel software and all other trademarks and/or distinctive signs on the Site are the property of Made in Steel or are granted for use by Made in Steel and may not be used by the user without written permission.

LAST DATE OF REVISION: April 2026