Privacy Policy

Version: 1 - Policy date: 27/07/2026

Privacy Policy pursuant to Article 13 of EU Regulation No. 2016/679 (GDPR)

GIARA SRL, with registered office at Via San Lino No. 47 – 25071 – AGNOSINE (BS); Tax Code and VAT No. 02052970981, data controller pursuant to European Regulation No. 679/2016 (hereinafter, the "Data Controller"), as Data Controller, informs you pursuant to Article 13 of EU Regulation No. 2016/679 (hereinafter, the "GDPR") that your data will be processed in the following manner and for the following purposes:

1. Object of processing

The Data Controller processes the personal, identifying, and non-sensitive data (specifically, name, surname, tax code, VAT number, email address, telephone number – hereinafter, "personal data" or "data") you provide:

• when entering into contracts for the Data Controller's goods/services;
• to send us requests using the forms on the website www.giara.it;
• to send you our newsletters with your consent.

NOTE: Privacy of minors
Our services are not intended for use by minors under the age of 18. We do not knowingly collect the user's date of birth or identifying information from minors under the age of 18. If you become aware that a child has provided us with Personal Data, please contact us to remove that information from our servers.

2. Purposes of Processing

Your personal data is processed:

• A) without your express consent (Article 6, letter b, e, of the GDPR), for the following Service Purposes:
  • conclude contracts for the Data Controller's services;
  • fulfill pre-contractual, contractual, and tax obligations arising from existing relationships with you;
  • fulfill obligations established by law, regulation, EU legislation, or an order from the Authority (such as for Anti-Money Laundering);
  • contact you following your request by completing the form on the website www.giara.it;
  • exercise the Data Controller's rights, such as the right to defense in court.

• B) Only with your specific and separate consent (Article 7 GDPR), for the following Marketing Purposes:
  • Sending commercial information or newsletters and/or advertising material by post, telephone, and also through automated systems (SMS, MMS, fax, and email) regarding the latest training initiatives, recreational activities, and opportunities offered by the Data Controller, and surveying customer satisfaction with the quality of services.

3. Processing Methods

Your personal data is processed using the operations indicated in Article 4(2) GDPR, specifically: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Your personal data is subject to both paper and electronic and/or automated processing. The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and, in any case, for no longer than 10 years from the termination of the relationship for Service Purposes and for no longer than 2 years from the date of data collection for Marketing Purposes.

4. Access to Data

Your data may be made accessible for the purposes referred to in Article 13 of the GDPR. 2.A) and 2.B) of this privacy policy:

• to employees and collaborators of the Data Controller or of the Group companies to which the Data Controller belongs, in their capacity as authorized and/or internal data processors and/or system administrators;
• to companies within the Group to which the Data Controller belongs (for example, for support activities in the production of goods/provision of services, for logistics management activities, for the storage of personal data, etc.);
• to third-party companies or other entities (for example, website management and maintenance providers, suppliers, credit institutions, professional firms, etc.) that perform outsourced activities on behalf of the Data Controller, in their capacity as external data processors.

5. Data Disclosure

Without the need for your express consent (Article 6, letters b) and c) of the GDPR), the Data Controller may disclose your data for the purposes referred to in Article 2.A) to supervisory bodies, judicial authorities, and all other entities to whom disclosure is required by law for the fulfillment of the aforementioned purposes. These entities will process the data in their capacity as independent data controllers. Your data will not be disclosed.

6. Data Transfer

Personal data will be managed and stored on a PC at the company's headquarters. The data will not be transferred outside the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to relocate any servers used in Italy and/or the European Union and/or non-EU countries. In this case, the Data Controller hereby ensures that the transfer of data outside the EU will be in compliance with applicable legal provisions, stipulating, if necessary, agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission.

7. Nature of the Data Provision and Consequences of Refusal to Respond

The provision of data for the purposes referred to in Article 2.A) is mandatory. Without it, we will not be able to guarantee your registration on the site or the Services referred to in Article 2.A). Providing data for the purposes referred to in Article 2.B) is optional. You can therefore decide not to provide any data or to subsequently object to the processing of data already provided. In this case, you will not be able to receive newsletters, commercial communications, and advertising material relating to the Services offered by the Data Controller. In any case, you will continue to be entitled to the Services referred to in Article 2.A).

8. Rights of the Data Subject

As a data subject, you have the rights set forth in Article 15 of the GDPR, specifically the right to:

• i. obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and communication of such data in an intelligible form;
• ii. obtain information on: a) the source of the personal data; b) the purposes and methods of the processing; c) the logic applied in the event of processing carried out with the aid of electronic means; d) the identification details of the data controller, data processors, and the designated representative pursuant to Art. 3, paragraph 1, GDPR; e) the entities or categories of entities to whom the personal data may be communicated or who may become aware of it in their capacity as designated representative(s) in the State's territory, data processor(s), or persons in charge of processing;
• iii. obtain: a) the updating, rectification, or, where interested therein, integration of the data; b) the erasure, anonymization, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed; c) certification to the effect that the operations referred to in letters a) and b) have been notified, including their content, to those to whom the data was communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected;
• iv. Object, in whole or in part: a) for legitimate reasons, to the processing of your personal data, even if pertinent to the purpose of collection; b) to the processing of your personal data for the purpose of sending advertising or direct sales materials or for conducting market research or commercial communications, through the use of automated calling systems without human intervention, via email and/or through traditional marketing methods such as telephone and/or postal mail. Please note that the data subject's right to object, set out in point b) above, for direct marketing purposes via automated means extends to traditional methods, and that the data subject may exercise the right to object even partially. Therefore, the data subject may decide to receive communications only via traditional means, only automated communications, or neither type of communication. Where applicable, the data subject also has the rights set forth in Articles 16-21 GDPR (Right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.

9. How to exercise your rights

You may exercise your rights at any time by sending:

• a registered letter with return receipt to GIARA SRL, with registered office at Via San Lino no. 47 – 25071 – AGNOSINE (BS); Tax Code and VAT No. 02052970981
• an email to: info@giara.info

10. Owner, data controller, and data processors

The data controller is GIARA SRL, with registered office at Via San Lino 47 – 25071 – AGNOSINE (BS); Tax Code and VAT number 02052970981.