Privacy Policy

Last updated: 03/09/2026

1. Data Controller

This Privacy Policy describes how SAPAF S.r.l. (the “Controller”) collects, uses and processes the personal information of users who visit the website sapaf54.it (the “Site”) or communicate with SAPAF through the services made available on the Site.

The Data Controller is:

SAPAF S.r.l.
Via del Padule, 76
50018 Scandicci (FI) – Italy
VAT No.: 00408470482
Tel: +39 055 721023
Email: sapaf@sapaf54.it

For the purposes of this Policy, “user” means any person who accesses, browses or uses the services made available through the Site.

2. Types of Data Collected

The Site may collect personal data voluntarily provided by the user through the forms available on the pages, as well as technical data automatically generated while browsing.

Data provided through the contact form

When the user uses the contact form available on the Site, data such as the following may be collected:

• first and last name;

• email address;

• telephone number;

• reason for contacting us;

• content of the message;

• any additional information voluntarily provided by the user.

This data is used exclusively to manage and respond to requests submitted by the user and for any subsequent communications related to the request.

Providing the data indicated as mandatory is necessary to allow SAPAF to respond to the user’s request.

Browsing data

The IT systems and software procedures used to operate the Site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.

This category includes, by way of example:

• IP addresses or domain names of the devices used by users;

• URI (Uniform Resource Identifier) addresses of the requested resources;

• date and time of the request;

• method used to submit the request to the server;

• size of the file received in response;

• numeric code indicating the status of the response provided by the server;

• information relating to the browser, device and operating system used;

• other parameters relating to the user’s IT environment.

This data is mainly used to ensure the proper functioning of the Site, guarantee system security and obtain statistical information on the use of the pages.

3. Cookies and Analytics Tools

The Site uses cookies and similar technologies to ensure its proper functioning and, subject to the user’s consent where required, to carry out statistical analysis regarding the use of the Site.

Technical cookies

Technical cookies are necessary for the proper functioning of the Site and for providing the services requested by the user.

They may be used, for example, to:

• ensure the correct loading of pages;

• store certain user preferences;

• ensure the security of the Site;

• manage cookie preferences;

• ensure the proper functioning of the Site’s technical features.

The user’s prior consent is not required for the use of strictly necessary cookies.

Google Analytics 4

The Site uses Google Analytics 4 (GA4), an analytics service provided by Google, for the purpose of understanding, in statistical form, how users interact with the Site.

Google Analytics may collect information relating, for example, to:

• pages visited;

• duration and manner of visits;

• traffic source;

• type of device;

• browser and operating system;

• interactions carried out within the Site;

• technical information relating to the connection.

The use of analytics tools takes place in accordance with applicable legislation and, where required, only after the user has given consent through the cookie preference management system.

The user may modify or withdraw the preferences expressed at any time through the tools made available by the Site.

For more detailed information on the cookies used, their purposes and retention periods, please refer to the Site’s Cookie Policy.

4. Purposes and Legal Basis of Processing

Personal data collected through the Site is processed for the following purposes:

Operation and security of the Site

Technical and browsing data necessary for the operation and security of the Site is processed on the basis of the legitimate interest of the Controller, pursuant to Article 6(1)(f) of Regulation (EU) 2016/679.

Management of contact requests

Data voluntarily provided through the contact form is processed in order to respond to the user’s requests.

The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject or, depending on the nature of the request, the legitimate interest of the Controller in responding to communications received, pursuant to Article 6 of the GDPR.

Statistical analysis

The use of cookies or other analytics tools that are not strictly necessary takes place, where required by law, on the basis of the user’s consent, pursuant to Article 6(1)(a) of the GDPR.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before such withdrawal.

5. Processing Methods and Security

Personal data is processed using IT and electronic tools in accordance with the principles of lawfulness, fairness, transparency, data minimisation and purpose limitation.

SAPAF adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, disclosure, alteration, destruction or unlawful use.

Access to data is permitted exclusively to authorised persons and suppliers who need to process it in order to perform the services entrusted to them.

6. Hosting and Place of Processing

The Site is hosted using services provided by:

Server Plan S.r.l. Società Unipersonale
Via G. Leopardi, 22
03043 Cassino (FR) – Italy

Server Plan provides the hosting and infrastructure services necessary for the operation of the Site and may process technical data as part of the provision of such services, in accordance with applicable personal data protection legislation.

Data may also be processed through infrastructures and services made available by third-party providers used for the operation, security and analysis of the Site.

7. Data Recipients and Third-Party Services

Personal data may be processed, within the limits of their respective responsibilities, by:

• personnel and collaborators authorised by SAPAF;

• IT service and Site maintenance providers;

• hosting providers;

• analytics and traffic measurement service providers, including Google;

• consultants or professionals where necessary;

• public authorities where required by law.

Providers that process personal data on behalf of SAPAF are, where applicable, appointed as Data Processors pursuant to Article 28 of the GDPR.

Personal data is not publicly disclosed.

Transfer of data outside the European Economic Area

The use of certain technology providers, including services belonging to international groups, may involve the processing or transfer of personal data outside the European Economic Area.

In such circumstances, processing takes place in accordance with Articles 44 et seq. of the GDPR and on the basis of the mechanisms provided for under applicable legislation, such as adequacy decisions, Standard Contractual Clauses or other safeguards recognised under European law.

8. Data Retention Period

Personal data is retained for no longer than is necessary to achieve the purposes for which it was collected.

In particular:

• technical and security data is retained for the period necessary for the proper operation and protection of the Site;

• data submitted through the contact form is retained for the period necessary to manage the request and any subsequent communications, without prejudice to further legal obligations or requirements arising from contractual relationships;

• data collected through analytics tools is retained according to the retention settings configured within the relevant services and in accordance with the preferences expressed by the user.

Once the relevant retention periods have expired, the data is deleted or anonymised, unless further retention is required to comply with legal obligations or protect the rights of the Controller.

9. Rights of the Data Subject

The user may exercise, where applicable, the rights recognised under Articles 15-22 of Regulation (EU) 2016/679.

In particular, the user may:

• obtain confirmation as to whether or not personal data concerning them is being processed;

• obtain access to their personal data;

• obtain information regarding the source, purposes and methods of processing;

• request the rectification or updating of inaccurate data;

• request the erasure of data in the cases provided for by law;

• request restriction of processing;

• object to processing where applicable;

• request data portability, where applicable;

• withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

Requests concerning the exercise of these rights may be sent to:

sapaf@sapaf54.it

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), in accordance with the procedures established by the Authority.

10. Links to External Websites

The Site may contain links to websites or services managed by third parties.

Access to such websites is subject to their respective privacy policies and the terms established by the relevant data controllers.

SAPAF is not responsible for the personal data processing activities independently carried out by external websites.

11. Changes to this Privacy Policy

SAPAF reserves the right to amend or update this Privacy Policy, including as a result of regulatory changes, updates to the services used or changes in the way personal data is processed.

Any changes will be published on this page.

Users are therefore advised to consult this Privacy Policy periodically to check for any updates.