PRIVACY AND DATA PROTECTION NOTICE

Data Controller

Data Controller: Seneca S.r.l., with registered office at Via Austria No. 26, 35127 Padua (PD), VAT No./Tax ID 02536650282.

Contact information to exercise your privacy rights: privacy@senecaforniture.it.

The Data Controller has not appointed a Data Protection Officer (DPO), as the legal requirements set forth in Article 37 of the GDPR do not apply. For any request regarding the processing of personal data, the data subject may still contact the Data Controller at the address indicated above.

Types of Data Collected

When browsing and using the website www.senecaforniture.it (hereinafter the “Website”), the following categories of personal data may be collected:

• Browsing data: IP address, browser type, operating system, pages visited, date and time of access, collected automatically during browsing;

• Data provided voluntarily via contact forms and information requests (first name, last name, email, phone number, company, message content);

• Data for newsletter subscription (first name, email address);

• Data for requests for quotes or commercial offers (personal information, company information, details of the request);

• Data contained in resumes for unsolicited applications or responses to job postings (personal information, professional experience, educational qualifications, contact information);

• Cookies and similar identifiers, as described in the Cookie Policy.

Unless otherwise specifically indicated, the Website does not collect special categories of personal data as defined in Article 9 of the GDPR (e.g., data related to health, racial or ethnic origin, or religious beliefs).

Purposes of Processing and Legal Basis

Providing data for browsing and security purposes is required; failure to do so will make it impossible to browse the Site.

Providing data for other purposes is optional: failure to do so will only make it impossible to obtain what you have requested (e.g., a response, a quote, newsletter subscription, job application).

Methods of Processing

Personal data is processed using computerized and telecommunications tools, with logic strictly related to the purposes indicated above and, in any case, in a manner that ensures its security and confidentiality, through the adoption of appropriate technical and organizational measures pursuant to Art. 32 of the GDPR.

Data Retention Period

Browsing data: retained for the time strictly necessary for security purposes, not exceeding 6 months, unless required for the investigation of criminal offenses.

Data collected via contact forms and requests for information/quotes: retained for the duration of the relationship and, thereafter, for the time necessary to protect the Data Controller’s rights, but in any case no longer than 10 years for administrative and accounting purposes.

Data for newsletters/marketing: retained until the data subject revokes consent.

Resumes: retained for 12 months from receipt, unless the data subject explicitly consents to longer retention for future recruitment purposes; after this period, the data is deleted or anonymized.

Cookies: in accordance with the durations specified in the Website’s Cookie Policy, managed via Cookiebot.

Disclosure and Categories of Data Recipients

Personal data may be disclosed, for the purposes indicated above, to the following parties, who are appointed, where necessary, as data processors pursuant to Article 28 of the GDPR:

• Internal staff of the Data Controller authorized to process data by virtue of their duties;

• Providers of website hosting and maintenance services;

• Google Ireland Limited, for Google Analytics services and, where applicable, Google Ads (browsing statistics and advertising campaigns);

• Cybot A/S (Cookiebot), for managing the platform for collecting and recording cookie consent;

• Newsletter and email marketing service providers;

• Consultants and independent professionals, to the extent necessary to carry out tasks assigned by the Data Controller;

• Public authorities, when required by law;

The data is not disclosed to unspecified parties.

Data Transfer to Countries Outside the EU

Some of the providers listed above (in particular Google, in connection with its Analytics/Ads services, and Cybot A/S for Cookiebot) may also process data outside the European Economic Area, specifically in the United States.

In such cases, the transfer is based on standard contractual clauses approved by the European Commission pursuant to Article 46 of the GDPR, or on other appropriate safeguards provided for by applicable law.

Further details are available in the privacy policies of the individual providers.

Rights of the Data Subject

As a data subject, you may exercise at any time the rights provided for in Articles 15–22 of the GDPR, and in particular the right to:

• obtain confirmation of whether your personal data is being processed and access your personal data (right of access);

• obtain the rectification of inaccurate data or the completion of incomplete data;

• obtain the erasure of your data, in the cases provided for by law (right to be forgotten);

• obtain the restriction of processing;

• receive the data you have provided to the Data Controller in a structured, commonly used, and machine-readable format, or request that it be transmitted to another data controller (right to data portability);

• object to the processing at any time, particularly for direct marketing purposes;

• withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to withdrawal;

• file a complaint with the Italian Data Protection Authority (www.gpdp.it) if you believe that the processing violates the GDPR.

These rights may be exercised by sending a request to the Data Controller at privacy@senecaforniture.it.

Minors

This website is not intended for individuals under the age of 16. The Data Controller does not knowingly collect personal data from minors without the consent of their parents or legal guardians.

Should it come to light that data relating to minors has been collected without the necessary consent, such data will be deleted.

Cookies

The Website uses technical, analytical, and profiling/marketing cookies. Consent management for non-technical cookies is handled through the Cookiebot platform, which allows users to accept, reject, or customize their preferences upon their first visit and at any time thereafter via the dedicated banner.

Changes to This Policy

The Data Controller reserves the right to modify or simply update, in whole or in part, this policy, including as a result of regulatory changes.

Any changes will be announced by publication on the Website and are effective as of the time of publication.