Privacy policy

Information notice pursuant to Articles 13-14 of EU Regulation 2016/679 (GDPR)

1. Data Controller

The Data Controller for personal data collected through the website www.serbatoiinox.net is:

Enrico Roverselli
Via Pisani Dossi, 46 – 20134 Milan (MI)
Tel.: +39 347 36 52 740
E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
(hereinafter "the Controller")

2. Types of data processed and purposes

a) Browsing data

The computer systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes IP addresses, browser type, operating system, domain name of the website from which access was made, pages visited, time of visit, and time spent on each page.

Such data are used solely to obtain anonymous statistical information on the use of the site and to monitor its correct functioning, and are deleted immediately after processing.

b) Data voluntarily provided by the user (contact form)

By filling in the contact form on the website, the user voluntarily provides personal data (first name, last name, e-mail address, phone number, company, message). Such data are processed for the following purposes:

To respond to requests for information, quotes or assistance submitted by the user (legal basis: performance of pre-contractual measures at the request of the data subject, Art. 6(1)(b) GDPR).
To contact the user by phone, e-mail or WhatsApp at the contact details provided, if expressly requested (legal basis: consent of the data subject, Art. 6(1)(a) GDPR).

c) Data processed by Cloudflare Turnstile (anti-spam protection for the contact form)

The contact form is protected by Cloudflare Turnstile, a privacy-friendly CAPTCHA service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile is designed to distinguish human users from automated bots without relying on tracking cookies or the collection of biometric data.

During the loading and verification of the form, the user's browser transmits certain technical information to Cloudflare, including IP address, browser and operating system type, HTTP headers, and anonymous behavioural signals (e.g. cursor movements, typing patterns). This data is processed by Cloudflare to assess the likelihood that the interaction originates from a human being.

Legal basis: legitimate interest of the Controller pursuant to Art. 6(1)(f) GDPR, consisting in protecting the website from abuse, spam and automated attacks.

Data is processed by Cloudflare acting as a Data Processor pursuant to Art. 28 GDPR. Cloudflare, Inc. participates in the EU-US Data Privacy Framework, which ensures an adequate level of protection for personal data transferred to the United States pursuant to Art. 45 GDPR.

For further information on data processing by Cloudflare: https://www.cloudflare.com/privacypolicy/

3. Legal basis for processing

The processing of personal data takes place in compliance with the following legal bases:

Performance of pre-contractual or contractual measures (Art. 6(1)(b) GDPR): for the management of contact requests.
Consent of the data subject (Art. 6(1)(a) GDPR): for the sending of commercial communications, where applicable, and for the use of non-technical cookies (see Cookie Policy).
Legitimate interest of the Controller (Art. 6(1)(f) GDPR): for IT security purposes and anonymous statistical traffic analysis, and protection of the contact form via Cloudflare Turnstile.

4. Processing methods and retention

Personal data are processed using IT and paper-based tools, adopting adequate technical and organisational security measures to prevent unauthorised access, loss, destruction or unlawful disclosure.

Data collected through the contact form are retained for the time strictly necessary to fulfil the request and, in the absence of a subsequent contractual relationship, for a maximum period of 24 months, unless legal obligations require different retention periods.

5. Disclosure and dissemination of data

Personal data are not transferred, sold or disclosed to third parties, except:

Parties providing services instrumental to the Controller's activities (e.g. e-mail providers, hosting services, Cloudflare for anti-spam protection), acting as Data Processors pursuant to Art. 28 GDPR.
Competent authorities, in cases provided for by law.

6. Transfer of data to third countries

This website uses Cloudflare Turnstile, a service provided by Cloudflare, Inc. (USA). The transfer of data to the United States takes place in compliance with the guarantees provided by the EU-US Data Privacy Framework, adopted by the European Commission by adequacy decision of 10 July 2023 (Art. 45 GDPR). All other personal data collected through this website are processed within the European Union.

7. Rights of data subjects

Data subjects may exercise the following rights at any time, free of charge:

Access: obtain confirmation of the existence of data concerning them and receive a copy (Art. 15 GDPR).
Rectification: request the correction of inaccurate or incomplete data (Art. 16 GDPR).
Erasure ("right to be forgotten"): request the deletion of personal data, in the cases provided for by law (Art. 17 GDPR).
Restriction: request the restriction of processing (Art. 18 GDPR).
Portability: receive personal data in a structured and commonly used format (Art. 20 GDPR).
Objection: object to processing based on legitimate interest (Art. 21 GDPR).
Withdrawal of consent: withdraw previously given consent, without prejudice to the lawfulness of processing carried out prior to withdrawal (Art. 7(3) GDPR).

8. Cookies

This website uses cookies and similar technologies. For detailed information on the types of cookies used, their purposes and how to manage or disable them, please refer to the Cookie Policy available at: www.serbatoiinox.net/en/cookie-policy.

9. Changes to this Privacy Policy

The Controller reserves the right to amend or update this Privacy Policy at any time, in accordance with applicable law. Changes will be published on this page with the date of the update indicated.

Last updated: 23 June 2026