Privacy policy

Privacy Policy

Version of 28/10/2025

Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), Donati S.p.A. describes the methods of processing the personal data of users who browse and use the website www.donati.eu . This privacy notice applies to processing activities related to the simple navigation of the website and the use of its functionalities, as further specified in the following sections.
This privacy notice does not concern third-party websites, pages, or online services that may be reached through hyperlinks, plugins, or widgets on the website. Such external resources are independent of the data controller; users are therefore invited to read their respective privacy notices.

1. Data Controller and Contact Details

The Data Controller is Donati S.p.A., tax code and VAT no. 03484480177, with registered office at Via Paderno 15/F – 25050 Rodengo-Saiano (BS) – Italy. For any request regarding the processing of personal data and for the exercise of the rights provided for in Articles 15–22 of the GDPR, users may write to the e-mail address privacy.gruppodonati@donatiholding.it or to the certified e-mail (PEC) address donatispa@legalmail.it.

2. Categories of Data Processed

a) Browsing data.

The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category of data includes, by way of example, IP addresses or domain names of the devices used, URI addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server response, and other parameters related to the user’s operating system and computer environment.
Such data are used solely for the purpose of obtaining anonymous statistical information on the use of the website and to verify its proper functioning, as well as for system security and maintenance purposes.

b) Data voluntarily provided by the user.

The website includes the “Contact us” and “Curriculum” sections, which allow the user to open their e-mail program to send a message to the Data Controller’s address. In such cases, the personal data (e.g., name, surname, e-mail address, telephone number, content of the message, and attachments such as a curriculum vitae) are acquired as a result of the voluntary submission by the user.
Only common personal data are collected. Users are invited not to send, in their communications, personal data of third parties or special categories of data (e.g., data relating to health, religious beliefs, or political opinions) that are not strictly necessary.

c) Cookies.

The website uses technical cookies and, subject to consent, analytical and profiling cookies, including those from third parties, in order to ensure the proper functioning of the pages and improve the browsing experience.
For detailed information on the types of cookies used, their purposes, and how to manage preferences, please refer to the Cookie Policy available in the dedicated section of the website.

3. Purpose and Legal Basis of Processing

a) Website navigation.

The legal basis for processing browsing data is the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) GDPR, aimed at ensuring the correct functioning, security, and integrity of the website, as well as producing anonymous statistics on the use of online services.

b) Management of communications received via e-mail.

Data voluntarily provided by users by sending e-mails to the contact addresses indicated on the website are processed exclusively to respond to requests, provide information on the Data Controller’s products or services, or manage spontaneous applications. The legal basis for processing is the performance of pre-contractual measures adopted at the request of the data subject, pursuant to Article 6(1)(b) GDPR.

c) Newsletter subscription.

Data provided for subscribing to the newsletter service are processed to send periodic informational or promotional communications relating to the products and initiatives of Donati S.p.A.
The legal basis for processing is the explicit consent of the data subject, pursuant to Article 6(1)(a) GDPR. The user may withdraw consent at any time via the unsubscribe link in each communication received or by writing to privacy.gruppodonati@donatiholding.it or to donatispa@legalmail.it (PEC).

4. Consequences of Failure to Provide Personal Data

Providing browsing data and technical cookies is necessary to ensure the technical functioning of the website and the availability of its services; failure to provide such data will make it impossible to access or properly navigate the website. The provision of cookies other than technical ones is based on the user’s consent and may be revoked or modified through the cookie management section of the website.
Providing data for newsletter subscription is optional: lack of consent will result in the impossibility of receiving informational and promotional communications from the Data Controller, without affecting the user’s ability to browse or access other website services.

5. Methods of Data Processing

Personal data are processed by authorized personnel of Donati S.p.A. using manual and electronic tools, according to logics strictly related to the purposes indicated and in compliance with the principles of lawfulness, fairness, transparency, relevance, and proportionality.
Processing is carried out by adopting appropriate technical and organizational measures to ensure data security and confidentiality, prevent loss, unlawful or improper use, and unauthorized access, in accordance with Article 32 GDPR.
The Data Controller does not perform processing activities involving automated decision-making or profiling, except as may be indicated in the Cookie Policy with regard to third-party profiling cookies.

6. Period of Personal Data Retention

Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected and in any case within the limits set by applicable law, taking into account the principles of proportionality and minimization established by Article 5(1)(e) GDPR.
Specifically:

  • browsing data are kept for the period necessary for technical management and website security operations;
  • data voluntarily provided via e-mail are stored for the time necessary to respond to the request and manage any further related communications;
  • curricula vitae received spontaneously by e-mail will be retained for a maximum period of 12 months from receipt. If the candidate’s profile is considered of particular interest, Donati S.p.A. may request the candidate’s consent, before the expiration of that period, to retain the curriculum for an additional maximum period of 24 months, exclusively for future collaboration opportunities;
  • data collected for newsletter subscription are retained until consent is withdrawn or, in any case, for a maximum period of 24 months from the last meaningful interaction with the communications sent. This period is automatically renewed in the presence of conclusive behavior by the data subject, such as opening messages, clicking on content, or other interactions with received e-mails.

After the above periods, the data will be deleted, unless further retention is necessary to fulfill legal obligations or protect rights in court.

7. Communication and Disclosure of Data

Personal data may be communicated, within the limits strictly relevant to the purposes indicated above, to individuals within the company who are expressly authorized to process data pursuant to Article 29 GDPR and who are properly trained in confidentiality and data protection.
They may also be communicated to external entities providing the Data Controller with technical or professional services necessary for the operation of the website and for delivering the services requested by users (e.g., hosting and IT maintenance companies, e-mail or newsletter service providers, consultants). These entities act as Data Processors pursuant to Article 28 GDPR and are bound by specific contractual agreements ensuring the protection of personal data.
Data will not be disclosed or communicated to third parties for purposes other than those indicated in this notice, except in cases of legal obligations or orders from public authorities.

8. Data Storage Location

Personal data are stored at the Data Controller’s registered office and, where necessary, at external entities expressly designated as data processors, located within the European Union.
Certain services related to website management or newsletter delivery (e.g., hosting, IT maintenance, or communication platforms) may involve the transfer of personal data to countries outside the European Economic Area.
In such cases, the transfer will take place in full compliance with Articles 44 et seq. of the GDPR.

9. Data Subject Rights

Pursuant to Articles 15–22 GDPR, the data subject has the right to:

  • obtain confirmation of the existence of personal data concerning them and access such data (right of access);
  • request the rectification or updating of inaccurate data and the completion of incomplete data (right to rectification);
  • obtain the erasure of personal data in the cases provided by law (right to erasure);
  • obtain restriction of processing in the circumstances set out in Article 18 GDPR (right to restriction);
  • receive personal data in a structured, commonly used, and machine-readable format and transmit them to another data controller (right to data portability);
  • object at any time, on grounds relating to their particular situation, to the processing of personal data carried out on the basis of the Data Controller’s legitimate interest (right to object);
  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (right to withdraw consent);
  • lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or appeal to the competent judicial authorities if they believe their rights have been violated.


10. Exercise of Rights

To exercise the above rights, the data subject may send a written request to Donati S.p.A. by e-mail to privacy.gruppodonati@donatiholding.it, or by certified e-mail (PEC) to donatispa@legalmail.it.
Alternatively, a registered letter with return receipt may be sent to the following address:
Donati S.p.A. – Via Paderno 15/F, 25050 Rodengo-Saiano (BS) – Italy.