Privacy and cookie policy
Last updated:
This notice explains how personal data is processed on rosacometta.com, in its Italian, English and Arabic versions, in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003). It applies to this website only.
Data controller
The data controller is ESB S.r.l., Via Aldo Moro, 28, 24050 Zanica (BG), Italy — VAT no. 03965340163.
For any question about your data or to exercise your rights: info@rosacometta.com · +39 035 526944 · or by post to the address above.
What data we process and why
When you write to us with the form on the Contacts page
Data: name, email address and message (required); phone, company and country (optional). The form also records the language and the address of the page it was sent from, the model whose sheet you were viewing if you came from one, and the date and time.
Purpose: to answer your request (technical information, advice, quotation) and to follow up on the resulting exchanges.
Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering the requests we receive and managing business contacts (Art. 6(1)(f)). The box in the form only confirms that you have read this notice: it is not consent.
Is it mandatory? Without the required fields we cannot answer you. The optional fields help us give you a useful answer straight away.
When you ask to be contacted
The “Would you like to be contacted?” form at the bottom of the pages collects only your email address, with the language and the page you send it from, so that we can contact you about our products as you asked. Legal basis and retention are the same as for the Contacts page form.
No marketing. Data sent through the forms is not used for newsletters or marketing communications. If we wanted to send you any, we would ask for your separate consent.
To protect the forms from spam
Before sending, your browser performs a short calculation in the background, with no cookies and no external services. To limit abuse, the server counts submissions from the same connection using a pseudonymised fingerprint of the IP address: it is calculated with a secret key and changes every day, the address itself is never recorded and the counters are deleted automatically within 24 hours.
Legal basis: legitimate interest in ensuring the security of the website and of our email (Art. 6(1)(f) GDPR).
When you contact us on WhatsApp
The WhatsApp button is a simple link: no WhatsApp content is loaded on the website. If you use it, WhatsApp opens and you send us your phone number, your profile name and the messages you choose to write. We use them only to answer you (legal basis: Art. 6(1)(b) and (f) GDPR). The service is provided by WhatsApp Ireland Ltd., which processes data according to its own privacy policy.
Visit statistics
To understand which pages are useful and improve the website we use Plausible Analytics. It does not use cookies, stores nothing on your device and does not keep IP addresses: visits are counted with an anonymous identifier that changes every day and cannot be traced back to you.
Data: page visited, referring site, country (derived from the IP address, which is then discarded), device type, browser and operating system, and actions on the site such as downloading a document, changing language or sending a form — never its content.
Legal basis: legitimate interest in measuring and improving the website (Art. 6(1)(f) GDPR). The data is aggregated and does not identify you.
Technical data
To display the pages and protect the service, the hosting provider automatically records technical data such as the IP address, the date and time of the request, the page requested and the browser. It is used only for the security and proper functioning of the website and is kept for the limited time needed for these purposes.
Legal basis: legitimate interest in the security and operation of the website (Art. 6(1)(f) GDPR).
Cookies
This website does not use cookies and stores no information on your device. This is why no consent banner is shown.
The only check performed on your device comes from the statistics script, which looks for its own exclusion setting, used by the site administrators so that their own visits are not counted.
Fonts, images, videos and documents are served by our own server: no content is loaded from social networks, maps or advertising services. The links to Facebook, LinkedIn, WhatsApp and Google Maps are plain links; when you follow them, those websites’ policies apply.
Recipients of the data
- Staff authorised to handle requests.
- Providers processing data on our behalf, bound by a data processing agreement:
- Hostinger International Ltd. (Cyprus) — website hosting and sending of the form emails;
- Plausible Insights OÜ (Estonia) — visit statistics;
- the provider of our business email, where requests are received.
- Public authorities, when required by law.
Your data is not sold or passed on to third parties for their own marketing.
Transfers outside the European Union
The providers listed are established in the European Union. Some of them, or their sub-processors, may process data outside the European Economic Area, for example for technical support or for the network that serves the pages from a location near you. In that case the transfer takes place only with the safeguards provided by the GDPR: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for certified companies) or standard contractual clauses approved by the Commission. You can obtain information about these safeguards by writing to info@rosacometta.com.
Retention period
| Data | Retention |
|---|---|
| Requests sent through the forms | The time needed to handle the request and the following exchanges, then at most 24 months from the last contact. If a contract is concluded, the terms of that relationship apply, up to 10 years where accounting and tax rules require it. |
| Backup copy of a request that could not be sent by email | Deleted automatically after 30 days. |
| Anti-spam fingerprints | Deleted within 24 hours. |
| Form activity log (date, outcome, language — no personal data) | 12 months. |
| Visit statistics | Aggregated and anonymous. |
Your rights
You can ask us at any time to:
- access your data and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data;
- restrict processing;
- receive your data in a structured, commonly used format (portability).
Right to object. When we process your data on the basis of legitimate interest, you can object at any time on grounds relating to your particular situation. We will stop processing, unless there are compelling legitimate grounds or the data is needed for the establishment, exercise or defence of legal claims.
Write to info@rosacometta.com. We reply within one month; for complex requests this may be extended by up to two months, and we will tell you why. Exercising your rights is free of charge.
You also have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it — or with the supervisory authority of the country where you live or work.
Automated decisions
No decision concerning you is taken by automated means and no profiling is carried out.
Changes
This notice may be updated if the website or the law changes. The date of the last update is shown at the top of the page.