Privacy policy

Why this information?

In compliance with the provisions of EU Reg. 2016/679 (European Regulation for the Protection of Personal Data- GDPR) we provide you with the due information regarding the processing of personal data. The ‘information is provided pursuant to Art. 13 of the GDPR and Art. 130 Privacy Code. The information is not to be considered valid for other websites that may be consulted through links on the domain websites of the owner, who is not to be considered in any way responsible for the websites of third parties. This is a disclosure that is also inspired by the provisions of Directive 2002/58/EC, as updated by Directive 2009/136/EC, on Cookies, the Cookies and Other Tracking Tools Guidelines of the Italian Data Protection Authority and EDPB Guidelines 05/2020 on Consent under the GDPR, adopted on 04.05.2020. TREATABLE PERSONAL DATA: Personal data “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, by reference in particular to an identifier such as a name, an identification number, location data, an online identifier, or to one or more characteristic elements of his or her physical, physiological, genetic, mental, economic, cultural or social identity; (C26, C27, C30 GDPR).

• Contractor/user data
• Navigation data The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment.
• Data communicated by the interested party the optional, explicit and voluntary sending of messages to the contact addresses indicated on this site and/or the filling in of data collection forms involves the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data entered.
• Specific disclosures specific disclosures may be presented on the pages of the site in relation to particular services or processing of the data provided.

COOKIES

WHAT ARE COOKIES? WHAT ARE COOKIES USED FOR? For more information about the cookies used by this website see the cookies policy in the footer.

1. WHO IS THE DATA CONTROLLER? HOW TO CONTACT HIM? The Data Controller is CINIUS S.r.l., with registered office in Via Edoardo Collamarini 25, Bologna(BO), in the person of its pro-tempore Legal Representative, who can be contacted for any information by e-mail privacy@cinius.com

2. HAS THE DATA PROTECTION OFFICER BEEN APPOINTED? WHAT ARE HIS OR HER CONTACT DETAILS? Cinius S.r.l. has appointed its own Data Protection Officer (DPO/DPO- Data Protection Officer) in accordance with Articles 37, 38 and 39 of the GDPR. The DPO can be reached at the Owner’s office listed above and via e-mail privacy@cinius.com

3. PURPOSE OF PROCESSING, LEGAL BASIS, DATA RETENTION PERIOD, AND NATURE OF PROVISION OF DATA

3.1 Purposes of NAVIGATION ON THIS WEBSITE The data required to use the web services are processed in order to: – obtain statistical information on the use of the services (most visited pages, number of visitors per time slot or daily, geographical areas of origin, etc.); – check the correct functioning of the services offered. The data will be used to ascertain responsibility in case of hypothetical computer crimes against the site. Legal basis: The processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail, taking into account the reasonable expectations of the data subject and the activities strictly necessary for the operation of the site and navigation itself (Art. 6, para. 1 lett. f and C47 of the GDPR). Period of storage: The storage of navigation data is up to the duration of the browsing session and in any case they do not persist for more than 7 days (except for any need to ascertain crimes by the Judicial Authority). Nature of conferment: The conferment of data is necessary for the navigation of the website. 3.2 Purpose related to the use of cookies and comparable technology. Legal basis: the processing is based on consent to the processing of personal data (Art. 6 par. 1 letter a and C42, C43 of the GDPR). For the nature of the conferment and the storage period See the cookie policy in the footer of the site. In addition to navigation: A) Personal data will be processed, according to the individual data collection area for the management of the requested service and related activities for:

3.A.I. Purposes of CONTACT MANAGEMENT The processing is related to sending contact requests, information. Legal Basis: The processing is necessary for the performance of a contract to which the data subject is a party or the execution of pre-contractual measures taken at the request of the data subject; (C44) art. 6 par. 1 lett. b) of the GDPR. Storage period: The storage period is 5 years. Nature of provision: The provision of data is necessary. Failure to provide the necessary data will result in the inability to receive the service.

3.A.II. Purpose of the SERVICE AND PRODUCT SATISFACTION SURVEY: The purpose of the processing is not related to marketing but to quality assurance, conducted via email and telephone. Legal basis: The processing is necessary for the pursuit of the data controller’s legitimate interest (C47-C50), Art. 6(1)(f) of the GDPR. In this specific case, the legitimate interest consists of the ability to receive feedback that is useful for improving the quality of the service and/or products. Retention period: The retention period lasts until you opt out. Nature of the provision: The provision of data is optional. You may object to the processing initially or in response to subsequent communications. 3.A.III. Purposes of DIRECT MARKETING, automated “SOFT-SPAM” emails (Art. 130, para. 4, of the Privacy Code) The data controller will use, for the purpose of direct sales of its products or services, the email addresses provided by the data subject in the context of the sale of a product or service, without requiring the data subject’s consent, for promotional and commercial communications and newsletters regarding services similar to those sold, provided that the data subject—having been adequately informed—does not object to such use, either initially or upon receiving subsequent communications. The data subject, at the time of collection and upon receipt of each communication sent for the purposes referred to in this paragraph, is informed of the possibility to object to the processing at any time, easily and free of charge. To compare and, where possible, improve the results of its communications, the Data Controller uses systems for sending newsletters and promotional communications that generate reports. Thanks to these reports, the Data Controller can determine, for example: the number of readers, opens, unique “clickers,” and clicks; the devices and operating systems used to view the communication; details on individual users’ activity; details on emails sent, delivered and undelivered emails, and forwarded emails; All of this data is used for the purpose of comparing, and potentially improving, the results of the communications. Email communications may contain tracking pixels or equivalent technologies—that is, markers that allow us to detect when a message is opened and the interactions performed by the recipient—for statistical, analytical, and performance measurement purposes. The use of these tools is subject to the data subject’s consent, which may be included in the consent to receive promotional communications. Consent to tracking may be revoked at any time, even separately from consent to receive communications. Legal basis: The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (C47-C50), Article 6(1)(f) of the GDPR. In this specific case, the data controller’s legitimate interest consists of the ability to inform the customer of products similar to those purchased by the customer. Retention period: The retention period lasts until the customer opts out. Nature of the provision: The provision of data is optional. You may object to the processing either initially or in response to subsequent communications. 3.B) DIRECT MARKETING PURPOSES To send advertising or direct sales materials, or to conduct market research and analysis, satisfaction surveys, or commercial and promotional communications, newsletters, event announcements, invitations, or similar communications via automated means (email, SMS, social media messaging systems), and traditional means (telephone). We also inform you that we may use social media platforms (Meta, Google, and TikTok) for commercial communications. These communications may contain promotional activities and/or logos of third-party partners and companies belonging to the group. No personal data will be transferred to third parties. For a complete list of group companies and partners, please write to privacy@cinius.com. To compare and, where possible, improve the results of automated communications, the Data Controller uses reporting systems. Thanks to these reports, the Data Controller will be able to determine, for example: the number of readers, opens, unique “clickers,” and “clicks”; the devices and operating systems used to view the communication; details on individual users’ activity; details on emails sent, delivered, undelivered, and forwarded; All of this data is used to analyze and, where possible, improve the results of communications. The processing is based on consent to the processing of personal data (C42, C43). Legal basis: Art. 6(1)(a) GDPR. Retention period: until consent is revoked (or opt-out). Nature of Data Provision: Providing data is optional. Failure to provide the necessary data will result in your inability to receive direct marketing communications. Direct marketing communications sent by telephone will be in compliance with the regulations governing the Public Opt-Out Registry.

3.C) Purposes of NON-AUTOMATIC PROFILING In order to carry out analysis, evaluations and to divide the interested parties into homogeneous groups by specific characteristics of activities for a better management of services; to allow the analysis of its profile, also according to the area and sector of belonging, for the creation of clusters, aimed at the analysis of habits of consumption choices and behavioral; this in order to build loyalty and to improve the commercial offer, the services proposed and send communications more in line with its interests. The processing of personal data could also concern customer care activities, consisting in the offer of personalized services and courtesy services. These purposes are also pursued through the inclusion of data in the company’s Data Base/CRM/platforms. The processing is based on consent to the processing of personal data; (C42, C43) Legal basis: art. 6 par. 1(A) of the GDPR. Retention period: The retention period is until revocation of consent and in any case maximum 5 years. Nature of data provision: Data provision is optional. Failure to provide the necessary data will result in the inability to conduct analysis and/or send targeted communications.

3.D) Purposes of PREVENTION AND CONDUCT OF DISPUTES AND OTHER LEGAL ASPECTS AND FOR DEFENSE IN CASE OF JUDGMENT Legal basis: The processing is necessary for the pursuit of the legitimate interests of the data controller or a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail (C47-C50) Art. 6 PAR. 1(f) GDPR. In this case, the legitimate interest of the Data Controller takes the form of the need to protect itself in case of litigation. Retention period: 10 years, unless objected to and except for the time necessary for defense in court. Nature of provision: The provision of data is necessary. Denial will have to be balanced against the legitimate interest of the Controller stated in the purposes of this section.

3.E) Purposes of SELECTING PERSONNEL IN WORK WITH US AREA. For the purpose of applying for personnel selections, carrying out the activity of research and selection of personnel for the purpose of the possible establishment of an employment relationship, even for any positions different from those for which the person concerned has spontaneously applied; preservation of personal data also for future selections; management of applications in response to job offers posted on our website; interviews and any video interviews (data processing also image/audio).For other purposes related to the selection, please refer to specific information in dedicated area where present on the site. Legal basis: Processing is necessary for the performance of a contract to which the data subject is a party or the execution of pre-contractual measures taken at the data subject’s request; (C44) art. 6 par. 1 lett. b) of the GDPR. For other purposes related to the selection, please refer to specific information in dedicated area where present on the site. Retention period: The retention period is a maximum of 12 months. In principle, data collected during the recruitment process will be deleted as soon as it becomes clear that no offer of employment will be made or that the offer will not be accepted by the candidate. For other purposes related to selection, please refer to specific information in dedicated area where on the site. Nature of Conferral: Conferral is necessary to process data for selection purposes. Failure to provide the necessary data will result in the inability to apply. For other purposes related to the selection, please refer to specific information in dedicated area where on the site.

3.F) PURPOSE OF MANAGEMENT OF REQUESTS TO EXERCISE THE RIGHTS OF INTERESTED PARTIES, pursuant to Art. 15 et seq. of the GDPR (rights of the data subject) Legal basis: The processing is necessary to comply with a legal obligation to which the data controller is subject (C45) Art. 6 par. 1(c) of the GDPR. Retention period: The retention period is 5 years from the closing of the request, subject to litigation. Nature of provision: The provision of personal data is mandatory, as it is indispensable in order to be able to execute the obligations of the Law.

3.G) Purposes of MARKETPLACE MANAGEMENT CONTRACTUALITY with Adeo Market Services Legal basis: The processing is necessary for the performance of a contract to which the data subject is a party or the execution of pre-contractual measures taken at the request of the data subject; (C44) art. 6 par. 1 lett. b) of the GDPR. Please refer to specific information in dedicated area. Period of storage: The period of storage please refer to specific information in dedicated area. Nature of conferment: The conferment is necessary. Please refer to specific information in dedicated area.

4. TO WHOM WILL PERSONAL DATA BE COMMUNICATED? RECIPIENTS OF THE DATA Personal data will be communicated, according also to the purposes envisaged in specific areas, to subjects who will process the data as autonomous Data Controllers, or Data Processors (Art. 28 GDPR) and processed by natural persons (Art. 29 GDPR) acting under the authority of the Data Controller and Data Processors on the basis of specific instructions given regarding the purposes and methods of processing, for specific purposes according to the area of reference. The data will be communicated to recipients belonging to the following categories:

• Subjects that provide services for the website and communication networks, including e-mail, host, website management, platforms and CLOUD, management;
• Studies or Companies in the context of assistance and consulting relationships;
• For online payments to banks and lending institutions and for installment payments/financing;
• Business information companies for evaluation of creditworthiness and payment habits and/or to entities for debt collection purposes in case of administrative accounting purposes;
• For direct marketing, soft spam similar product and with prior consent for generic marketing and profiling with prior consent, to entities for the management of direct marketing activities;
• By area works with us, to individuals for managing recruitment activities and dedicated platforms;
• Competent authorities for fulfillment of legal obligations and/or provisions of public bodies, upon request.

The list of Data Processors is available by writing to this address: privacy@cinius.com or to the other contact details above.

5. WILL THE DATA BE TRANSFERRED TO NONSEE COUNTRIES? Personal data may be transferred to countries outside the EEA, in order to comply with related purposes stated above. The transfer is put in place in accordance with Art.46 EU Reg. 2016/679. Regarding the purpose 3. E), as indicated in the appropriate information, there is a transfer to the U.S. pursuant to art.45 “Third countries international organizations for which the Commission has intervened with an adequacy assessment” and in compliance with art.46 to entities that have provided adequate guarantees, with standard contractual clauses (SCC) of the Commission. The data subject may obtain information about data transfer guarantees by writing an email to privacy@cinius.com

6. IS THERE AN AUTOMATED PROCESS? Personal data will be subject to traditional manual, electronic and automated processing. It should be noted that fully automated decision-making processes are not carried out. With reference to the profiling activity, possibly carried out upon the express consent of the interested party as indicated in the purposes, it will be carried out through the intervention of the operator who will process the profile of the interested party and analyze their habits and consumption choices, in order to improve the commercial offer and services of the owner (non-automated profiling).

7. WHAT ARE YOUR RIGHTS? HOW CAN HE EXERCISE THEM? You may exercise your rights as set forth in EU Regulation 2016/679, Articles 15 et seq., by contacting the Data Controller, sending an email to privacy@cinius.com, or writing to the DPO at the contact information provided above. You have the right, at any time, to request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17), and restriction of processing (Article 18). The Data Controller shall notify (Article 19) each recipient to whom the personal data has been disclosed of any rectifications, erasures, or restrictions on processing that have been made. The Data Controller shall inform the data subject of these recipients if the data subject so requests. Furthermore, in the cases provided for, you have the right to data portability (Art. 20), and in such cases, your data will be provided to you in a structured, commonly used, and machine-readable format. You have the right to object, in the cases provided for (Art. 21), at any time, to the processing of data based on legitimate interest, as well as to withdraw the consent you have provided without affecting the lawfulness of the processing based on consent prior to withdrawal. With regard to tracking pixels in email communications, the data subject also has the right to withdraw consent to tracking even separately from consent to receive communications. To stop receiving automated direct marketing communications (email or SMS), simply send an email at any time to privacy@cinius.com with the subject line “unsubscribe from” and specifying the communication channel you no longer wish to be contacted through, or use our automated unsubscribe systems, which are available for email only. To stop receiving any marketing communications, simply send an email at any time to privacy@cinius.com with the subject line “unsubscribe from marketing.” You may revoke your consent to (non-automated) profiling by sending an email at any time to privacy@cinius.com with the subject line “no profiling.” If you believe that the processing of personal data by the Data Controller violates the provisions of Regulation (EU) 2016/679, the data subject has the right to lodge a complaint with the supervisory authority, specifically in the Member State where the data subject habitually resides or works, or in the place where the alleged violation of the Regulation occurred, or to bring the matter before the appropriate courts. 8. Changes to the Privacy Policy The Data Controller reserves the right to modify, update, add, or remove portions of this privacy policy. To make it easier to review and modify the text, the privacy policy will include the date it was last updated. Last updated: September 18, 2026