Information - Contact
INFORMATION ON THE PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE “CONTACT” FORM
This notice, provided pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR"), supplements the website browsing policy and explains specifically how the Controller will process the data entered in this form. Please also read the browsing privacy notice at Privacy policy - IRINOX Professional
Identity and contact details of the Data Controller
Irinox S.p.A. (hereinafter also "Irinox" or the "Controller"), with registered office at via Caduti nei Lager, 1 – 31015 Conegliano (TV), Italy, can be contacted by email at irinox@irinox.com, by certified email (PEC) at irinoxspa@legalmail.it or by telephone on +39 0438 2020.
Contact details of the Data Protection Officer
The Data Protection Officer (DPO) can be contacted at: dpo@irinox.com
Purposes and legal bases
A. Responding to requests: personal data are processed in order to respond to requests submitted through this form, for example to provide information on products or services (including sending brochures, catalogues or other company information material requested) or to prepare a quotation.
B. Marketing: contact details (e.g. first name, surname, email address, telephone number) will be processed in order to send, by automated means (email, newsletter, SMS) and traditional means (postal mail, operator-assisted telephone calls), advertising, informational and promotional material relating to the Controller’s products, services, offers, events and initiatives, as well as to carry out market research, satisfaction surveys and statistical analyses aimed at improving the quality of the services offered.
C. Measuring interactions with promotional emails (tracking pixels): emails sent for the «Marketing» purpose may contain tracking tools (tracking pixels and tracked links) that detect, for each individual recipient, whether the message has been opened and which links have been clicked, in order to measure the effectiveness of communications and make them more relevant (see the dedicated section below).
D. Defence purposes: the Controller may need to process personal data in order to manage out-of-court or judicial claims and disputes.
A. Legal basis (common data): performance of pre-contractual measures taken at the request of the data subject; legitimate interest of the Controller in responding to the requests received. Legal basis (special categories of data): not applicable.
B. Legal basis (common data): consent (Article 6(1)(a) GDPR and Article 130 of Italian Legislative Decree 196/2003). Legal basis (special categories of data): not applicable.
C. Legal basis (common data): consent (Article 122 of Italian Legislative Decree 196/2003), included in the consent given for the «Marketing» purpose and also revocable separately. Legal basis (special categories of data): not applicable.
D. Legal basis (common data): legitimate interest of the Controller in establishing, exercising or defending a right. Legal basis (special categories of data): establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR).
Measuring interactions with promotional emails (tracking pixels)
Promotional communications sent by email (including newsletters) may contain a tiny invisible image (a so-called tracking pixel) and tracked links that allow the Controller to detect, for each individual recipient, whether the message has been opened, the date and time of opening, the links clicked, the type of device and email client used, and the IP address ("interaction data").
In accordance with Article 122 of Italian Legislative Decree 196/2003 and with the Guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali) on the use of tracking pixels in email communications (decision no. 284 of 17 April 2026), individual tracking takes place only with the consent of the data subject, which is included in the consent given for the «Marketing» purpose. Consent may be withdrawn at any time:
– in full, by ceasing to receive promotional communications;
– in part only, solely with regard to tracking: in this case communications will continue to be sent, but the individual recipient’s interactions will no longer be recorded.
Consent can be withdrawn via the link at the bottom of each message or by writing to privacy@irinox.com.
Without consent to tracking, the Controller may only produce aggregated and anonymous statistics (e.g. the overall open rate of a campaign) that cannot be attributed to the individual recipient, and use the tools strictly necessary to ensure the security of the sending service. Service emails (e.g. confirmations of registration, of an order or of receipt of a request) do not contain individual tracking tools.
Interaction data are associated with non-intelligible, non-sequential identifiers and are not used for decisions based solely on automated processing within the meaning of Article 22 GDPR. Interaction data are not used for profiling purposes.
Retention period
A. Retention period: for information requests: 24 months from the last interaction with the user. For quotation requests: a period equal to twice the validity of the offer.
B. Retention period: 24 months from the last interaction with the user, unless consent is withdrawn earlier.
C. Retention period: 12 months from collection, after which the data are anonymised.
D. Retention period: 10 years from the final settlement of the dispute.
Once the stated periods have expired, the data will be deleted or anonymised; for technical and organisational reasons, deletion may take place within the following 30 days.
Whether provision of data is mandatory and consequences of refusal
A. Nature: necessary. Consequences of refusal: it will not be possible to receive the information or quotation requested.
B. Nature: optional. Consequences of refusal: it will not be possible to receive commercial communications from the Controller; no consequences for the other purposes.
C. Nature: optional. Consequences of refusal: consent is included in the consent given for the «Marketing» purpose; if consent is withdrawn for tracking only, communications will continue to be sent without recording the individual recipient’s interactions.
D. Nature: necessary. Consequences of refusal: it will not be possible to handle the dispute.
Disclosure of data
Data are processed by internal staff authorised for specific tasks and are disclosed to third parties according to the following rules:
A. Categories of external recipients: companies belonging to the same business group, agents, distributors and dealers, external consultants, companies providing hosting/management services for technology platforms.
B. Categories of external recipients: companies belonging to the same business group, external consultants, companies providing hosting/management services for technology platforms and for sending communications (e.g. email marketing platform).
C. Categories of external recipients: provider of the email sending platform, appointed as data processor.
D. Categories of external recipients: law firms; debt collection or debt assignment companies; judicial authorities.
Recipients who process data on behalf of the Controller are appointed as data processors pursuant to Article 28 GDPR; an up-to-date list is available on request. Since data are also processed using IT tools, they may also be visible to parties providing support/maintenance for those systems. Data are not disseminated.
Transfer of data to a third country or an international organisation
The Controller does not transfer personal data outside the European Economic Area.
Rights of data subjects
The person to whom the personal data relate has the following rights:
Access: to find out whether personal data concerning them are being processed and, if so, to obtain access to them and request a copy.
Rectification: to request that their personal data be updated, corrected (if inaccurate) and completed (if incomplete).
Erasure: to obtain the erasure of their personal data where certain conditions apply (for further information, please contact the Controller).
Restriction: to request that data be marked so as to restrict their future processing, where certain conditions apply (for further information, please contact the Controller).
Objection: to object to the processing of personal data on grounds relating to their particular situation, where processing is based on legitimate interest; they may also object at any time to the processing of personal data for direct marketing purposes, including related profiling.
Portability: to receive the personal data provided to the Controller in a structured, commonly used and machine-readable format and to request that they be transmitted to another controller, where processing is based on consent or on a contract and is carried out by automated means.
Withdrawal of consent: to withdraw consent for the purposes for which it was requested, in whole or in part, without affecting the lawfulness of processing carried out up to that point.
The rights that can actually be exercised in relation to the processing activities carried out are:
A. Rights that can be exercised: access, rectification, erasure, restriction, objection, portability.
B. Rights that can be exercised: access, rectification, erasure, restriction, objection, portability, withdrawal of consent.
C. Rights that can be exercised: access, rectification, erasure, restriction, objection, portability, withdrawal of consent.
D. Rights that can be exercised: access, rectification, erasure, restriction, objection.
To exercise the above rights, you can use the form available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 and send it to: privacy@irinox.com. Data subjects may request further details on the above information from the same address (e.g. the legitimate interest balancing test or the list of data processors).
You may lodge a complaint with a supervisory authority: for Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
STATEMENTS:
◯ I have read and understood the information on the processing of personal data (mandatory)
Purpose «Marketing» (including the measurement of email interactions through tracking pixels, which can also be withdrawn separately): ◯ I consent ◯ I do not consent
Last updated: October 2026.