Information notice pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) for users of the website www.vegagroup.it.

Last updated: 12 November 2026

1. Data controller

The data controller is VEGA S.r.l., VAT no. 00814680153.

Registered office: Via Visconti di Modrone 7 – 20122 Milan;

Contact for privacy matters: comm@vegagroup.it and marketing@vegagroup.it. Telephone: +39 02 99046212 ext. 3.

2. What data we process and why

For each purpose we state the data, the legal basis (that is, the reason that makes the processing lawful) and the retention period.

a) Requests from the contact and support forms

• Data: name, telephone, email, company, country, text of the message.
• Purpose: to reply to the request and provide the support requested.
• Legal basis: pre-contractual measures or performance of a contract (Art. 6(1)(b) GDPR).
• Retention: the time needed to handle the request, 24 months at most.
• Providing the data is optional, but without the data marked as required in the form we cannot reply.

b) Applications from the « Work with us » page

• Data: name, telephone, email, cover text, attached CV and the data it contains.
• Purpose: to assess the application.
• Legal basis: pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
• Retention: 24 months from submission.
• Please do not include unnecessary data in your CV, such as data on health, opinions or beliefs.

c) Customers and suppliers

• Data: identification, contact and administrative data needed for the relationship.
• Purpose: to supply or receive products and services, to give information on the work carried out, and for administrative and accounting management.
• Legal basis: contract (Art. 6(1)(b)) and legal accounting and tax obligations (Art. 6(1)(c)).
• Retention: 10 years from the end of the relationship for accounting and administrative data.
• Providing the data is necessary to perform the contract and to continue the relationship.

d) Newsletter

• Data: email address and any other data requested in the form.
• Purpose: to send Vega information and commercial communications.
• Legal basis: consent (Art. 6(1)(a)), given through an option separate from the others. You may withdraw it at any time using the unsubscribe link in every message.
• Retention: until consent is withdrawn and in any case for no more than 2 years from the last activity.

Measurement of opens and clicks (optional)

Only if you allow it using the dedicated box, separate from the subscription box, our emails contain a tracking pixel (an invisible image) and tracked links, provided by Brevo. They tell us whether and when a message is opened and which links are clicked.

• Data: date and time of opens and clicks, links clicked, IP address, device type, email client and operating system.
• Purpose: to understand which content is of most interest and to improve our communications.
• Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003)).
• Consent is optional. If you do not give it, you still receive the newsletter, but without pixels and without tracked links.
• You may withdraw it at any time using the link at the bottom of every email, without unsubscribing from the newsletter.
• Retention: 24 months from collection.

e) Website usage statistics

Google Analytics 4 (Google Ireland Ltd)

• It is activated only if you give consent through the cookie banner. Legal basis: consent (Art. 6(1)(a)).
• According to Google, Analytics 4 does not record or store the IP address.
• Retention: 14 months at most.

Matomo

• Software that measures which pages of the website are visited, installed on a server of Tagliabuecom S.r.l. in France, which manages the website on behalf of Vega.
• Measurement takes place without cookies and without persistent identifiers: it counts visits but does not build a profile of the people making them. The IP address is masked before it is recorded: the last two groups of digits are set to zero.
• Data: page visited, referring site, device and browser type, language and time.
• Requests to the statistics server pass through the network of Cloudflare, Inc., which sees the IP address before masking.
• Legal basis: Vega’s legitimate interest in knowing how the website is used (Art. 6(1)(f)).
• Retention: detailed data for 180 days; after that only aggregated statistics remain.
• If you prefer that your visits are not counted, you can opt out at any time using this box:
  Ne pas enregistrer mes visites dans les statistiques de ce site.

  . Your choice is remembered by a technical cookie on vegagroup.it, only in this browser and only if you opt out.

f) Website security and form protection

• The newsletter subscription form, present on every page, is protected by a system that tells people apart from automated programs (Cloudflare Turnstile), which processes the IP address and technical data of the device and browser.
• Data: technical browsing and connection data, such as the IP address and server logs.
• Purpose: website security, prevention of abuse and automated submissions.
• Legal basis: Vega’s legitimate interest in the security of its systems (Art. 6(1)(f)).
• Retention: server logs are kept for about 5 days. They may remain in backup copies until those copies expire (section 6).

3. Cookies and similar tools

The website uses a consent management system (Complianz). From the banner you can accept, reject or choose categories of cookies, and change your mind at any time. The YouTube videos on some pages load according to the choices made in the banner. The list of cookies, their purposes and their duration are further down this page. Tracking pixels in emails do not depend on the cookie banner: consent is given and withdrawn as described in section 2.d.

4. Who may receive the data

The data are processed by authorised Vega staff. They may also be received by parties acting on Vega’s behalf as data processors (Art. 28 GDPR):

• Tagliabuecom S.r.l., website hosting and maintenance, Matomo statistics server;
• OVH SAS, France, which provides Tagliabuecom with the server infrastructure, in France. Data processing agreement: https://contract.eu.ovhapis.com/1.0/pdf/OVH_Data_Protection_Agreement-it.pdf
• Microsoft Ireland Operations Ltd, for Vega’s company email, where form notifications arrive. Agreement: https://www.microsoft.com/licensing/docs/view/microsoft-products-and-services-data-protection-addendum-dpa Privacy notice: https://www.microsoft.com/privacy/privacystatement
• Mailgun Technologies, Inc. (Sinch group), for sending form notifications, from servers in the European Union. Agreement: https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/ Privacy notice: https://www.mailgun.com/legal/privacy-policy/
• Brevo SAS (formerly Sendinblue), France, for sending the newsletter and, if you consent, for measuring opens and clicks; the subscription form is loaded from its servers on every page. Agreement: https://www.brevo.com/legal/termsofuse/#appendix-3-data-processing-agreement-dpa Privacy notice: https://www.brevo.com/legal/privacypolicy/
• Google Ireland Ltd, for Google Analytics 4. Agreement: https://business.safety.google/adsprocessorterms/ Privacy notice: https://policies.google.com/privacy
• Cloudflare, Inc., for the protection of the newsletter form and for the transit of Matomo statistics. Agreement: https://www.cloudflare.com/cloudflare-customer-dpa/ Privacy notice: https://www.cloudflare.com/privacypolicy/ Turnstile: https://www.cloudflare.com/turnstile-privacy-policy/

The data may also be received, as independent controllers or processors, by professional firms and companies that process data for accounting, tax and consulting purposes closely connected with the company’s business. The data are not disseminated.

5. Transfers outside the European Economic Area

Some providers (Google, Microsoft, Mailgun and Cloudflare) may also process data outside the European Union, in particular in the United States. In these cases the transfer takes place on the basis of the EU-US Data Privacy Framework, if the provider participates in it, or of the standard contractual clauses approved by the European Commission, as indicated in the agreements in section 4. You may ask us for a copy of the safeguards adopted by writing to the contacts in section 1.

6. How long we keep the data

• Accounting and administrative data: 10 years.
• Requests from forms: the time needed to handle the request, 24 months at most.
• Applications: 24 months
• Newsletter: until consent is withdrawn and in any case for no more than 2 years from the last activity.
• Data on email opens and clicks: 24 months.
• Google Analytics 4: 14 months at most.
• Matomo: 180 days for detailed data, then only aggregated statistics.
• Server logs: about 5 days.
• Server backup copies: the data held on the website and the logs may remain in them until the copy expires, about 4 months at most.

Once the periods have expired, the data are deleted or anonymised, unless the law requires otherwise.

7. Your rights

You may exercise at any time the rights provided for in Articles 15 to 22 GDPR:

• access to your data and information on its processing (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• objection to processing based on legitimate interest and to direct marketing (Art. 21);
• not to be subject to decisions based solely on automated processing (Art. 22). Vega does not use decision-making processes of this kind.

Where processing is based on consent, you may withdraw it at any time, without affecting processing already carried out. To exercise your rights, write to the contacts in section 1.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

8. Changes

We may update this notice. The date at the top shows the latest version.

Cookies