Privacy statement

PRIVACY POLICY

Pursuant to Regulation (EU) 2016/679 (hereinafter “Regulation” or “GDPR”), this page describes the methods of processing personal data of users who consult the website of LC S.P.A. (hereinafter “Data Controller”) accessible electronically at the address https://www.lacerbara.com/.

This information does not concern other websites, pages or online services that may be accessed through hyperlinks published on the website but referring to resources external to the Data Controller’s domain.

DATA CONTROLLER

The Data Controller is LC S.P.A., with registered office in Via del Piano s.c. - 61030 Isola del Piano (PU), Tax Code/VAT No. 01087790414. You can contact us through the following details:

- E-mail info@lacerbara.com;

- Tel. 0721 720542.

PLACE OF PROCESSING

The data are processed at the offices of the Data Controller and at any other location where the parties involved in the processing are located, including the offices of any external Data Processors. Further information may be requested directly from the Data Controller.

LEGAL BASIS OF PROCESSING

The personal data indicated on this page are processed by the Data Controller for:

- processing the personal data of data subjects following the explicit consent provided by them (Art. 6, paragraph 1, letter a) of the GDPR);

- the performance of a contract and/or the execution of pre-contractual measures (Art. 6, paragraph 1, letter b) of the GDPR);

- compliance with a legal obligation to which the Data Controller is subject (Art. 6, paragraph 1, letter c) of the GDPR);

- pursuing the legitimate interest of the Data Controller or third parties (Art. 6, paragraph 1, letter f) of the GDPR).

It is always possible to request the Data Controller to clarify the specific legal basis for each processing activity.

PURPOSES OF PROCESSING

The data provided by you will be processed for the purpose of allowing access to the services offered by the company website https://www.lacerbara.com/. By way of example but not limited to:

- managing requests for information, assistance, consultancy and commercial contacts;

- preparing quotations and managing the pre-contractual phase;

- sending informational, promotional, commercial communications and updates regarding the activities of the Data Controller (newsletter) subject to the consent of the data subject;

- directly accessing the social media channels of the Data Controller, through the appropriate icon.

TYPES OF DATA PROCESSED AND PURPOSES OF PROCESSING

Website browsing data

The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes:

- IP addresses or domain names of computers and terminals used by users;

- URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response;

- the numerical code indicating the status of the response provided by the server (successful completion, error, etc.);

- other parameters relating to the user’s operating system and IT environment.

Such data, necessary for the use of web services, are processed in order to:

- allow the correct functioning of the website;

- obtain statistical information on the use of services (most visited pages, number of visitors by time slot or daily basis, geographical areas of origin, etc.);

- guarantee the security of IT infrastructures;

- carry out maintenance activities and prevent unauthorized access;

- monitor the correct functioning of the services offered.

The data may be used to ascertain responsibility in the event of hypothetical cyber crimes.

Data provided by the user

This category includes the processing of personal data involving the optional, explicit and voluntary sending of messages to the contact addresses of the Data Controller. By way of example but not limited to:

- Contact form: consisting of sender’s contact details (e-mail address, any telephone number), identification data included in communications (name and surname, etc.), as well as other data contained in the message. The data will be processed to manage requests for information, assistance, consultancy and commercial contacts;

- Newsletter service: consisting of sender’s contact details (e-mail address). The data will be processed to send informational, promotional, commercial communications and updates regarding the activities of the Data Controller, subject to the consent of the data subject;

- Google Maps: consisting of browsing data (IP address, technical browsing data, any data collected by the service provider). The data will be processed to allow the display of the company’s location and facilitate navigation towards it;

- Links to social networks: consisting of technical browsing data and any data independently collected by social media platforms. The data will be processed to allow the user to access the social profiles of the Data Controller.

Cookies and other tracking systems

For all information relating to the use of Cookies and tracking tools in general, please refer to the dedicated Cookie Policy section.

PROCESSING METHODS

Based on Article 5 of the European Regulation “Principles relating to processing of personal data”, data are processed in a lawful, fair and transparent manner in relation to the data subject (“lawfulness, fairness and transparency”); collected for specified, explicit and legitimate purposes (“purpose limitation”); adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); accurate and, where necessary, kept up to date (“accuracy”) and processed in such a way as to ensure appropriate security, including protection, through appropriate technical and organisational measures, against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”).

There is no automated decision-making process within this processing activity, including profiling referred to in Article 22, paragraphs 1 and 4 of Regulation (EU) 2016/679.

Specific security measures in line with the provisions of Article 32 of the European Regulation are adopted to prevent data loss, unlawful or incorrect use and unauthorised access.

The Data Controller carries out processing based on the principle of Privacy by Design, which requires that the protection of the rights and freedoms of data subjects with regard to the processing of personal data involves the implementation of appropriate technical and organisational measures both at the time of design and during the execution of the processing itself, in order to ensure compliance with current legislation.

Based on the principle of Privacy by Default, the Data Controller also adopts appropriate technical and organisational measures to ensure that, by default, only data necessary for each specific purpose are processed.

ACCESSIBILITY OF DATA

Within the structure of the Data Controller, your data are accessible exclusively to authorised subjects who have been adequately instructed pursuant to Article 29 GDPR.

In addition to the Data Controller, in some cases other subjects involved in the company organisation may have access to the data, such as, for example, administrative, commercial, marketing and legal personnel, system administrators, etc., or external subjects appointed, where necessary, as Data Processors.

The updated list of Data Processors may always be requested from the Data Controller.

RECIPIENTS OR CATEGORIES OF RECIPIENTS

The data are made accessible to external subjects whose collaboration the company uses and to whom it has assigned the role of “Data Processor” for the processing activities that are necessary (by way of example but not limited to: subjects providing services for the management of the information system; professionals, firms or companies within the scope of assistance and consultancy relationships; competent authorities for the fulfilment of legal obligations).

The identity of the third parties receiving the data may be requested at any time from the Data Controller (and/or from the Data Processor, where appointed).

The data will not be disclosed.

TRANSFER OF DATA OUTSIDE THE EU

No transfers to non-EU countries are foreseen.

In the event of such transfer, the transfer of personal data to countries that do not belong to the European Union will be carried out only and exclusively in full compliance with the provisions established in Chapter V of the GDPR (“Transfers of personal data to third countries or international organisations”).

STORAGE

All the aforementioned data will be stored for the purposes referred to in this information notice, for the time strictly necessary to respond to the requests of the data subjects or, in cases where this is provided for, within the mandatory time limits established by law.

In the case of reports and complaints, the data will be stored for the period necessary to carry out internal investigations and complete the assessment phase, at the end of which the report will be made anonymous or encrypted.

It is always possible to request the Data Controller to clarify the applicable storage period for each individual case.

RIGHTS OF THE DATA SUBJECT

Pursuant to Chapter III of European Regulation 2016/679, you may exercise the following rights:

a) the right to obtain from the Data Controller confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to obtain access to your personal data (Art. 15);

b) right to rectification (Art. 16);

c) right to erasure (Art. 17);

d) right to restriction of processing (Art. 18);

e) right to data portability (Art. 20);

f) right to object (Art. 21);

g) right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects your person (Art. 22);

h) right to withdraw your consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal (Art. 7, paragraph 3);

i) right to lodge a complaint with the supervisory authority (Art. 77);

j) right to an effective judicial remedy against the supervisory authority (Art. 78) or against the Data Controller or Data Processor (Art. 79).

You may at any time request further information from the Data Controller at the following e-mail address info@lacerbara.com or by registered letter with return receipt addressed to the Data Controller indicated above, specifying the subject of the request, the right you intend to exercise and attaching a copy of an identity document certifying the legitimacy of the request.

If the Data Controller intends to further process personal data for a purpose other than that for which they were collected, before such further processing it will provide the Data Subject with information regarding this different purpose and any further information necessary to ensure fair and transparent processing.

The Data Controller reserves the right to modify and/or update this information notice on the basis of legislative and regulatory developments that may occur concerning the Applicable Legislation, following any interventions by the competent Data Protection Authority.

COMPLAINT

If you believe that the processing of your personal data has been carried out unlawfully, you may lodge a complaint with one of the competent supervisory authorities responsible for compliance with personal data protection regulations.

In Italy, a complaint may be submitted to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

Further information on the methods for submitting a complaint is available on the website of the Garante, at the address http://www.garanteprivacy.it.

LC S.P.A.

Isola del Piano (PU)

Updated July 2026