Privacy policy
Last updated: 31 October 2026
This policy explains how Maffioletti S.r.l. processes the personal data of people who visit www.maffioletti.it and use its services, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Personal Data Protection Code).
1. Data controller
The data controller is Maffioletti S.r.l., Via dell'Artigianato 9, 24046 Osio Sotto (BG), Italy, VAT no. IT02664950165.
For any question about how we process your data, or to exercise your rights, you can write to info@maffioletti.it or call +39 035 505115.
2. What data we collect
- Browsing data. The systems that host the website automatically record some technical data, such as IP address, date and time of access, pages requested, browser and operating system. This data is needed to run the website and keep it secure.
- Contact form requests. Type of request, product or code, first name, surname, company, job title, email, telephone, message and how you heard about us. Together with the request we record the page you came from and any parameters in the address, such as the advertising campaign.
- Enclosure configurator requests. Your contact details (name, company, email, telephone) and the technical details of the project: enclosure characteristics, components, marking and notes.
- Newsletter. Your email address and the dates of subscription and confirmation.
- Customer area. The email address you sign in with; your first name, surname, company and, if you provide them, your role and phone number; the date you accepted this policy and your choice about product news; your saved configurations, the quote requests you send and their PDF reports. When you sign in, we link to your account any requests you had already sent from the configurator with the same email address.
Please do not include special categories of data in your messages, such as health information: we do not need them to reply.
3. Why we process your data and on what legal basis
- Replying to your requests for information, quotations and offers, including those sent from the configurator, and managing any resulting business relationship. Legal basis: steps taken prior to entering into a contract, or performance of a contract (Art. 6(1)(b) GDPR).
- Managing your customer area account: signing in with a code or link sent by email, saved configurations, sent requests and reports. Legal basis: steps taken prior to entering into a contract, or performance of a contract (Art. 6(1)(b) GDPR).
- Sending you our newsletter with news about products, services and events. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time using the link in every email or by writing to us.
- Sending you product news, if you chose this in your customer area profile. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unticking the box in your profile or by writing to us.
- Running the website, keeping it secure and blocking automated submissions or misuse. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR).
- Meeting legal obligations, such as tax and accounting requirements, and defending our rights in the event of a dispute. Legal basis: legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).
We do not take decisions based solely on automated processing that produce legal effects concerning you.
4. Providing your data
The fields marked as required in the forms are needed to reply to your request: without them we cannot follow it up. To use the customer area we need your email address, first name, surname, company and your acknowledgement of this policy; role and phone number are optional. Subscribing to the newsletter and receiving product news are optional.
5. How we process your data and who may receive it
Your data is processed electronically, with appropriate security measures, and only by authorised Maffioletti staff (sales, technical and administration).
The suppliers who help us provide our services may receive the data as processors (Art. 28 GDPR):
- Webflow, Inc. (United States), which hosts the website and collects form submissions;
- Microsoft Ireland Operations Ltd, for company email and the secure publication of our internal services;
- Supabase Pte. Ltd. (Singapore), which runs sign-in and stores customer area data on servers in the European Union;
- any IT service providers responsible for maintaining our systems.
The newsletter and the automated handling of configurator requests run on servers managed by Maffioletti. Data may also be disclosed to advisers, banks, couriers and public authorities where needed to manage the relationship or where required by law. We do not sell or pass on your data to third parties for marketing purposes.
6. Transfers outside the European Union
Some suppliers, such as Webflow, Google and Cloudflare, are based in the United States. In these cases data is transferred on the basis of the European Commission adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or, alternatively, the standard contractual clauses approved by the Commission. Customer area data is stored in the European Union, but Supabase may access it from Singapore and the United States for technical support and operational services: these transfers are based on the standard contractual clauses.
7. How long we keep your data
- Requests that do not lead to a business relationship: 24 months from the last contact.
- Data relating to offers, orders and contracts: for the duration of the relationship and then for 10 years, as required by Italian civil and tax law.
- Newsletter: until you unsubscribe or withdraw your consent.
- Customer area: for as long as the account remains active; you can ask us to delete it at any time. Requests that lead to offers or orders follow the periods above.
- Browsing data: for as long as strictly necessary for website security, unless requested by the judicial authorities.
8. Cookies and third-party content
The website uses technical cookies that it needs to work, which do not require consent. These include the ‘mf_consent’ cookie, which remembers the choices you make in the cookie banner for 6 months. Only if you consent to the ‘Statistics’ category do we use Google Analytics 4 by Google Ireland Limited, which sets the ‘_ga’ and ‘_ga_3LW44CH6R1’ cookies (lasting up to 2 years) to collect aggregated data on how the website is used, such as pages visited, where visits come from and device type. Google may also process this data in the United States under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time: when you do, the Google Analytics cookies are deleted. We do not use profiling or advertising cookies.
The Contact page can show a Google Maps map. When the map loads, Google receives your IP address and may use its own cookies, as described in its privacy policy. The website’s typefaces come from the same servers that host the website and are not downloaded from Google.
The website is protected by Cloudflare Turnstile, the anti-spam system Webflow uses to block automated form submissions. The check loads on every page of the website, and Cloudflare, Inc. (United States) receives technical data about your device and browser, such as your IP address. This processing is based on our legitimate interest in keeping the website secure.
To make sign-in to the customer area work, the website’s pages load the Supabase software library from the jsDelivr service (cdn.jsdelivr.net), which is based in Poland and relies on third-party network providers to deliver its files. When your browser downloads the library, jsDelivr receives your IP address, your country and the time of access, which it says it uses only in aggregated form for statistics and does not keep long term. This processing is based on our legitimate interest in making the website work.
The Google Maps map loads only if you consent to the ‘Maps and external content’ category, from the cookie bar or with the ‘Show the map’ button on the Contact page. You can change or withdraw your choices at any time from the Cookie preferences link at the bottom of every page. You can also delete or block cookies in your browser settings.
9. Your rights
At any time you can ask to:
- access your data and receive a copy (Art. 15 GDPR);
- have it corrected or completed (Art. 16 GDPR);
- have it erased (Art. 17 GDPR);
- restrict its processing (Art. 18 GDPR);
- receive it in a structured format and transmit it to another controller (Art. 20 GDPR);
- object to processing based on legitimate interest (Art. 21 GDPR);
- withdraw your consent, without affecting processing already carried out (Art. 7 GDPR).
To exercise these rights, write to info@maffioletti.it: we will reply within one month. If you believe that the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali.
10. Changes to this policy
We may update this policy, for example when we add new services to the website. The date of the last update is shown at the top of the page.
