Pursuant to Article 13 of Regulation (EU) 2016/679
This privacy notice is provided by IDEALLUX SRL in its capacity as Data Controller, with regard to the personal data processed through the website www.grupporaina.com (hereinafter, the “Site”).
Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), the Data Controller provides users of the Site with information on how personal data are collected, used, stored and protected in connection with browsing, sending requests through the forms available on the Site, subscribing to the newsletter and using the services available online.
Personal data are processed in compliance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, integrity and confidentiality, as well as the accountability principle referred to in Article 5 of the GDPR.
DATA CONTROLLER
The Data Controller is IDEALLUX SRL, with registered office at CORSO NOVARA 121 – 27029 VIGEVANO (PV), Tax Code and VAT No. 1242280186.
The Data Controller can be contacted at the following details:
- Tel. 0381/969814
- E-mail: ideallux@pec.it
TYPES OF PERSONAL DATA PROCESSED
- Browsing data
The IT systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
These include, by way of example:
- IP addresses;
- URI addresses of the requested resources;
- date and time of the request;
- method used to submit the request to the server;
- numeric code indicating the response status;
- parameters relating to the user’s operating system and IT environment.
These data are processed to ensure the proper operation of the Site, the security of IT systems and the prevention of unlawful use.
- Data voluntarily provided by the user through forms and communications
The optional and voluntary sending of communications through the e-mail addresses indicated on the Site or through the available forms (contact, quotation request, download of information material, newsletter subscription) entails the acquisition of the personal data provided by the user.
By way of example, the following data may be processed:
- first and last name;
- e-mail address;
- telephone number;
- company;
- VAT number;
- content of the message or request;
- any additional data voluntarily entered by the user.
Providing the data marked as mandatory in the forms is necessary in order to process the request; failure to provide such data may make it impossible to provide the requested response.
- Data processed for newsletter and informational communication purposes
If the user subscribes to the newsletter, the Data Controller processes the user’s identification and contact data (e.g. name, e-mail address) in order to send informational communications, updates and promotional content relating to the activities and services offered.
- Data collected through tracking tools
The Site uses traffic analysis and monitoring tools (e.g. Google Analytics) and advertising conversion tracking tools (e.g. Google Ads), which may involve the collection of data relating to the user’s interaction with the Site, in accordance with the preferences expressed through the cookie banner.
Detailed information is provided in the Cookie Policy.
PURPOSES AND LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA
Personal data collected through the Site are processed for the following purposes:
- a) Management of requests submitted through the Site
Data voluntarily provided by the user through contact forms, quotation requests, downloads of information material or e-mail communications are processed in order to:
- respond to requests received;
- provide the requested information;
- manage any pre-contractual activities.
Legal basis:
Article 6(1)(b) GDPR – performance of pre-contractual measures taken at the request of the data subject.
- b) Newsletter subscription and management
Personal data provided for newsletter subscription are processed for the purpose of sending informational communications, updates and promotional content relating to the services and activities of the Data Controller.
Legal basis:
Article 6(1)(a) GDPR – consent of the data subject.
Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- c) Compliance with legal obligations
Data may be processed to comply with obligations laid down by applicable legislation (e.g. administrative, tax or accounting obligations), where the request leads to the establishment of a contractual relationship.
Legal basis:
Article 6(1)(c) GDPR – compliance with a legal obligation to which the Data Controller is subject.
- d) Protection of the Data Controller’s rights
Data may be processed to establish, exercise or defend a right of the Data Controller in judicial or out-of-court proceedings.
Legal basis:
Article 6(1)(f) GDPR – legitimate interest of the Data Controller in protecting its rights.
- e) Statistical analysis and monitoring of Site traffic
The Site uses analysis tools (e.g. Google Analytics) to collect information on page usage, traffic and how users interact with the Site, in order to improve the Site’s content and performance.
Such processing takes place exclusively after consent has been given through the cookie banner.
Legal basis:
Article 6(1)(a) GDPR – consent of the data subject.
- f) Advertising conversion tracking
The Site uses conversion tracking tools (e.g. Google Ads conversion tracking) to assess the effectiveness of online advertising campaigns.
These tools are activated only after consent has been given through the cookie banner.
Legal basis:
Article 6(1)(a) GDPR – consent of the data subject.
PROVISION OF PERSONAL DATA AND PROCESSING METHODS
Providing personal data through the forms available on the Site is optional. However, failure to provide data marked as mandatory may make it impossible to provide the requested response, process a quotation request or allow the download of the materials made available.
Providing data for newsletter subscription and marketing purposes is optional and subject to the data subject’s consent; failure to provide such data does not affect the possibility of browsing the Site or submitting contact requests.
Browsing data are automatically acquired by the IT systems used to operate the Site, and their processing is necessary to ensure proper technical operation, security and protection of the IT infrastructure.
Personal data are processed using IT and telematic tools, in compliance with the principles of lawfulness, fairness, transparency and data minimisation. No automated decision-making or profiling processes pursuant to Article 22 of the GDPR are carried out.
Data are processed by internal personnel expressly authorised and instructed pursuant to Article 29 of Regulation (EU) 2016/679 and may be processed by third parties providing services instrumental to the operation of the Site and management of communications, appointed, where required, as Processors pursuant to Article 28 of the GDPR.
The Data Controller adopts appropriate technical and organisational measures pursuant to Article 32 of the GDPR in order to ensure a level of security appropriate to the risk, taking into account the nature of the data processed and the characteristics of the IT system used.
RETENTION PERIODS AND DELETION OF PROCESSED DATA
Personal data are retained for no longer than is necessary to achieve the purposes for which they were collected, in compliance with the storage limitation principle referred to in Article 5(1)(e) of the GDPR.
In particular:
- a) Browsing data
They are retained for the time strictly necessary to ensure the security and proper operation of the Site, without prejudice to any need by judicial authorities to investigate criminal offences.
- b) Data collected through contact forms, quotation requests and material downloads
They are retained for the time necessary to manage the request and, in any event, for no longer than 12 months from receipt, unless the interaction results in the establishment of a contractual relationship or there are requirements to protect the Data Controller’s rights.
- c) Data processed for newsletter purposes
They are retained until the data subject withdraws consent or requests deletion, without prejudice to the need to retain evidence of the consent given for evidentiary purposes and to protect the Data Controller’s rights.
- d) Data processed through analysis and monitoring tools (e.g. Google Analytics, Google Ads)
They are retained for the period provided for by the settings of the tools used and as specified in the Cookie Policy.
In the event of a dispute, the data will be retained for the entire duration of the dispute and until expiry of the time limits for bringing any appeal or challenge.
Once the applicable retention period has expired, the data will be deleted or anonymised, compatibly with technical backup and archiving procedures.
SCOPE OF DISCLOSURE AND SHARING OF PERSONAL DATA
Personal data processed through the Site may be accessed by internal personnel expressly authorised and instructed pursuant to Article 29 of Regulation (EU) 2016/679, within the scope of their respective duties.
The data may also be processed by third parties that provide services instrumental to the operation of the Site and management of communications, including, by way of example:
- hosting and infrastructure service providers (e.g. hosting service provider);
- website maintenance and management service providers;
- traffic analysis and performance monitoring service providers (e.g. Google Analytics);
- advertising and conversion tracking service providers (e.g. Google Ads);
- e-mail marketing and newsletter management service providers (e.g. Mailchimp).
Depending on the circumstances, such parties operate as Processors pursuant to Article 28 of the GDPR or as independent Data Controllers, in accordance with their respective terms of service and privacy roles.
Personal data are not disseminated.
Transfer of data to non-EU countries
The use of certain digital services (e.g. analytics tools, advertising tools and e-mail marketing platforms) may involve the transfer of personal data to countries outside the European Economic Area, including the United States.
Such transfers take place in compliance with Articles 44 et seq. of the GDPR and on the basis of the safeguards provided for by applicable law, such as participation in the EU-U.S. Data Privacy Framework or the use of Standard Contractual Clauses approved by the European Commission.
Further information may be requested from the Data Controller using the contact details provided in this privacy notice.
RIGHTS OF THE DATA SUBJECT
The data subject may exercise at any time the rights provided for in Articles 15-22 of Regulation (EU) 2016/679, including:
- the right to obtain confirmation as to whether or not personal data concerning them are being processed and to access such data (Article 15 GDPR);
- the right to rectification of inaccurate data or completion of incomplete data (Article 16 GDPR);
- the right to erasure of data in the cases provided for by Article 17 GDPR;
- the right to restriction of processing (Article 18 GDPR);
- the right to data portability, where applicable (Article 20 GDPR);
- the right to object to processing based on the legitimate interest of the Data Controller (Article 21 GDPR).
Where processing is based on consent (e.g. newsletter subscription or use of non-technical cookies), the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be submitted to the Data Controller by writing to the following e-mail address: ideallux@pec.it
The Data Controller will respond within one month of receipt of the request, subject to extension in the cases provided for by Article 12 of the GDPR.
This is without prejudice to the right to lodge a complaint with the Italian Data Protection Authority pursuant to Article 77 of the GDPR or to bring proceedings before the competent courts.
Complaint forms are available on the Authority’s institutional website at:
https://www.garanteprivacy.it
COOKIES
The Site uses cookies and tracking tools, i.e. small text files or similar technologies that are stored on the user’s device while browsing.
The cookies used can be divided into:
- Technical cookies, necessary for the proper operation of the Site and to ensure security and provision of the requested services;
- Analytics cookies, used to collect statistical information on the use of the Site (e.g. Google Analytics);
- Marketing and conversion tracking cookies, used to measure the effectiveness of online advertising campaigns (e.g. Google Ads);
- Third-party cookies and content, such as embedded videos (e.g. YouTube) or any social sharing features.
Non-technical cookies are activated exclusively after the user has given consent through the dedicated cookie banner, which allows users to accept, reject or customise their preferences.
Consent may be withdrawn at any time using the functions made available through the banner or through browser settings.
Users may also configure their browser to reject or limit the use of cookies; however, doing so may affect the proper use of certain Site functions.
Detailed information on the types of cookies actually used, their duration, the third-party providers involved and the methods for managing consent is provided in the specific Cookie Policy available on the Site.
CHANGES TO THE PRIVACY POLICY
The Data Controller reserves the right to update or amend this privacy notice at any time, including in consideration of legislative changes, developments in interpretation or updates relating to the services and tools used through the Site.
Any changes will be published on this page and will take effect from the date of publication.
Where changes concern processing based on the data subject’s consent or significantly affect rights and the methods of processing personal data, the Data Controller may provide specific notice to data subjects by suitable means to ensure that they are made aware of the changes.
Users are invited to consult this page periodically to view the most up-to-date version of the privacy notice.
Cilavegna, 03/03/2026
