PRIVACY POLICY
Pursuant to Article 13 of EU Regulation no. 679 of 27 April 2016 (hereinafter the “GDPR”), Con.Se. S.r.l. (hereinafter
the “Company”) provides the following information regarding the processing of Personal Data (hereinafter the
“Data”) of users of the Website: www.gpa-group.it (hereinafter the “Site”).
A. DATA CONTROLLER AND DATA PROTECTION OFFICER
The Data Controller of the Data of the users of the Site is Con.Se. S.r.l., with registered office in Via Molino Rosso 9/C –
40026 Imola (BO).
The Company can be contacted at the following addresses:
• by e-mail, to the address: privacy@conse.it
• by mail, to the address: Via Molino Rosso 9/C – 40026 Imola (BO)
Con.Se. S.r.l. has appointed SGS Italia S.p.A. as Data Protection Officer, who can be contacted at the following e-mail
address: dpoitaly@sgs.com or ssc@sgsitalia.postecert.it and at the following physical address: Via Caldera 21 – 20153
Milan (MI) Italy.
B. DATA SUBJECT TO PROCESSING
The Data processed may consist of Identification Data, contact Data, Location Data, an online identifier or one or more
elements suitable for making the data subject identified or identifiable, depending on the type of services requested.
B.1 Data processed during navigation
Browsing the Site involves receiving cookies, short strings of text that the websites visited send to the user’s browser,
where they are stored and then retransmitted to the same websites during subsequent visits.
While browsing a site, the user may also receive cookies on his computer from sites or web servers other than the one
he is visiting (so-called “third-party” cookies). It is possible to distinguish:
a) technical cookies, which allow activities related to the operation of the Site to be carried out;
b) profiling cookies, used to analyse user behaviour and possibly send advertising messages in line with the
preferences expressed by the user while browsing.
While technical cookies cannot be refused by the user of the Site, as they are strictly functional to the Site itself, the
user can freely choose whether to accept or refuse the use of profiling cookies.
More specifically, the website uses the cookies listed in the Cookie policy.
B.2 Additional data provided voluntarily by the user
The optional, explicit and voluntary submission of your Personal Data by filling in:
• the Spontaneous Application section;
• of the Contact Us Form;
• the request for activation of the newsletter service;
• of additional Forms;
involves the subsequent acquisition of the same, for the purposes explained below.
C. LEGAL BASIS, NATURE AND PURPOSE OF THE PROCESSING
Your Personal Data will be processed for the following purposes:
• allow navigation of the Site and its smooth functionality. The legal basis for the processing is the provision to
users of the services connected to the Website (art. 6.1.b GDPR) and the legitimate interest of the Data
Controller in having a functional website (art. 6.1.f GDPR);
• respond to user requests and allow the provision of the services made available to the Company. The legal
basis for the processing is given by the need to execute a contract to which the data subject is party or precontractual measures adopted at the request of the same (art. 6.1.b GDPR); with regard to the sending of
newsletters containing information, promotional and commercial offers on activities of the Data Controller
and other Group Companies, the legal basis for the processing is given by consent (art. 6.1.a GDPR);
• to comply with any obligations provided for by applicable laws, regulations or EU legislation, or to satisfy
CONSE_Privacy Policy Web Site User_EN_rev01_17032026.docx Approved by the Quality and Compliance Department
Public document Pag. 2 di 2
requests from the authorities. The legal basis for the processing is the obligation for the Data Controller to
comply with mandatory legislation (art. 6.1.c GDPR);
• analyse user behaviour and possibly send advertising messages in line with the preferences expressed by the
user while browsing. The legal basis for the processing in this case is the consent of the data subject (Art. 6.1.c
GDPR).
The provision of Data is optional, but (except in cases of processing based on consent) failure to provide it may make
it impossible to respond to any requests or activate any services. Any consent given may be revoked at any time.
D. DATA RECIPIENTS
The Data may be communicated:
a) to Group companies, in compliance with current legislation and subject to the signing of specific agreements;
b) to third parties who need to carry out specific activities in relation to the Data, in accordance with the
purposes of the processing, or to subjects providing services to the Data Controller;
c) to authorities, bodies and/or subjects to whom they must be communicated, pursuant to binding legal or
contractual provisions.
E. DATA TRANSFER
With regard to any transfer of Data to countries outside the European Economic Area, the processing will take place in
one of the ways permitted by current law. More information can be obtained from the Company on request at the
contacts indicated above.
F. DATA RETENTION
The Data will be stored for the time strictly necessary to achieve the purposes of the processing, applying the principles
of minimization and proportionality. Indicatively:
1) with regard to processing based on consent, until the revocation of the same by the data subject;
2) with regard to the processing carried out for the provision of services, the Company will retain the Data for
the period of time provided for and permitted by Italian law to protect its interests (Article 2946 of the Italian
Civil Code and subsequent amendments);
3) with regard to Data processed to comply with legal obligations, they will be stored for the time required by
the specific obligation or applicable law;
4) as for the duration of the Data processed through cookies, these are reported in the Cookie policy.
For Data whose processing is based on the consent of the data subject, it is specified that the same will be stored until
the consent is revoked.
More information regarding the Data retention period and the criteria used to determine this period can be requested
by sending a written request to the Company at the addresses indicated above.
G. RIGHTS OF THE DATA SUBJECTS
Pursuant to art. 15 et seq. GDPR, the data subject has the right to ask the Company for access to his or her Data, to
update, rectify or supplement it, to delete the same or to object to their processing, to request the limitation of
processing in the cases provided for by art. 18 GDPR, as well as to obtain the Data concerning him/her in a structured,
commonly used and machine-readable format, in the cases provided for by art. 20 GDPR. If the data subject has
provided his/her consent to the processing, he/she may revoke it at any time.
Requests must be sent in writing to the Company at the addresses indicated above.
In any case, the data subject always has the right to lodge a complaint with the competent supervisory authority, i.e.
the Guarantor for the Protection of Personal Data, pursuant to art. 77 GDPR, if you believe that the processing of your
Data is contrary to the legislation in force.
This Privacy Policy was updated in Imola on 17/03/2026