Privacy

Last updated: 24 August 2026

This privacy notice describes how personal data of users visiting www.pennati.it is collected and processed, pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”).

1. Data controller

Pennati Costruzioni Meccaniche S.r.l.
Via Ingegnoli, 43 – 20093 Cologno Monzese (MI) – Italy
VAT and Tax Code: IT06992310158
Phone: +39 02 2536156 / +39 02 2536489
E-mail: info@pennati.it

No Data Protection Officer (DPO) has been appointed, as our processing activities do not fall within the cases in which such designation is mandatory under Article 37 GDPR.

2. How to contact us about your personal data

To exercise your rights or for any question regarding the processing of your personal data, you can write to info@pennati.it, using “Privacy request” as the subject of your message. We will reply within 30 days of receiving your request, as required by Article 12(3) GDPR.

3. What data we collect and how

3.1 Data you provide voluntarily

The website features contact forms (a general one and several product-specific ones) that allow users to send us information requests. Through these forms we collect:

• first and last name (or company name);
• e-mail address;
• the content of your message (which may contain additional personal data provided at your initiative).

Requests sent through the forms are stored in the website’s database (a native function of Ninja Forms) and delivered by e-mail to the relevant internal recipients. Each form is protected by Google reCAPTCHA to prevent automated submissions (see §7 on cookies).

3.2 Data collected automatically

Visit statistics (Matomo). We use Matomo, a web analytics tool installed on a dedicated server located within the European Union and operated by Supero Ltd. Our Matomo instance:

• does not use cookies;
• anonymises visitors’ IP addresses (masking of the last octets);
• does not share data with third parties for advertising purposes.

Thanks to these safeguards, our Matomo installation falls within the category of analytics tools exempt from prior consent according to the Italian Data Protection Authority’s Guidelines of 10 June 2021 on cookies and other tracking tools.

Security logs. Our security plugin (Solid Security) records the IP addresses of login attempts to the site’s administration area, in order to detect and block unauthorised access or suspicious activity. These logs are retained for a maximum of 60 days.

Server logs. As with any website, the servers hosting www.pennati.it automatically record technical connection information (IP address, timestamp, URL requested, user agent, etc.) for diagnostic and cybersecurity purposes. These logs are retained by our hosting provider for up to 24 months in compressed archive form, and are used only when investigating security incidents, intrusion attempts or technical malfunctions.

4. Purposes and legal bases of processing

Purpose	Legal basis
Responding to information requests submitted through the contact forms and managing subsequent pre-contractual communications	Article 6(1)(b) GDPR – performance of pre-contractual measures taken at the request of the data subject
Compliance with accounting, tax and administrative obligations arising from a business relationship that may be established	Article 6(1)(c) GDPR – legal obligation
Anonymous visit statistics via Matomo	Article 6(1)(f) GDPR – legitimate interest in assessing site usability and performance, using measures that exclude the identification of individual users
Site security and prevention of unauthorised access (Solid Security logs, reCAPTCHA)	Article 6(1)(f) GDPR – legitimate interest in the security of information systems

5. How long we keep your data

• Requests received via the contact forms: 24 months from the last contact with the data subject, if no active business relationship arises from them.
• Data related to established business relationships (quotes, orders, invoicing): 10 years from the end of the relationship, in accordance with Article 2220 of the Italian Civil Code on the retention of accounting records.
• Security logs (Solid Security): up to 60 days.
• Server logs (Apache/nginx access and error logs): up to 24 months in compressed archived form, for the purpose of investigating security incidents and diagnosing malfunctions.
• Matomo statistical data (anonymous): kept in aggregate form for an indefinite period, as it does not allow individual users to be identified.

6. Who we share your data with (data processors)

The personal data we collect is not disclosed or transferred to third parties for marketing purposes. It may be shared only with the following entities, which act as Data Processors under Article 28 GDPR, and with whom we have in place the agreements required by law:

• Hosting provider: the website and its databases are hosted on infrastructure managed by Supero Ltd, in data centres located within the European Union.
• Website technical maintenance provider: Supero Ltd also handles maintenance, updates and monitoring of the site through a centralised management platform (MainWP), which allows their staff to access the administrative functions of the site as part of their support activities.
• Web analytics service (Matomo): as described in §3.2, our Matomo instance runs on Supero Ltd infrastructure in the EU.
• Google Ireland Ltd., as the provider of Google reCAPTCHA, Google Maps and YouTube services used on specific pages of the website. For details of the cookies involved, see §7.

The data may also be accessed by internal staff of Pennati Costruzioni Meccaniche S.r.l. tasked with handling commercial enquiries, duly authorised and instructed pursuant to Article 29 GDPR.

7. Cookies and tracking tools

This site uses only technical cookies and does not directly set profiling cookies. However, some third-party features embedded on the site (Google reCAPTCHA in the contact forms, the Google Maps embed on the Contact us page, YouTube videos embedded on specific pages) may set their own non-technical cookies: prior consent for such cookies is collected through our cookie banner (managed by the CookieYes plugin).

The cookies used on this site are:

Category	Type	Description
WordPress session cookies	Technical	Maintain the browsing state during the visit. Necessary for the correct functioning of the site.
WPML cookie (_icl_current_language)	Technical	Remembers the language chosen by the user (Italian/English).
CookieYes cookie	Technical	Stores the user’s preferences regarding the cookie banner itself.
Google reCAPTCHA	Third party — consent required	A service by Google Ireland Ltd. used to protect the contact forms against automated submissions. Privacy notice: policies.google.com/privacy.
Google Maps	Third party — consent required	Present only on the Contact us page. A service by Google Ireland Ltd. for embedding interactive maps. Privacy notice: policies.google.com/privacy.
YouTube	Third party — consent required	Present on specific pages where videos are embedded. A service by Google Ireland Ltd. Privacy notice: policies.google.com/privacy.

You can update your cookie preferences at any time using the preference management button on the cookie banner, which is available on every page of the site.

8. Transfers of data outside the European Union

The data we collect is stored on servers located within the European Union. Transfers outside the EU may occur in the following cases:

• Google services (reCAPTCHA, Google Maps, YouTube): Google Ireland Ltd. may transfer data to its parent company in the United States. This transfer is covered by Google’s certification under the EU-US Data Privacy Framework, adopted by the European Commission’s Adequacy Decision of 10 July 2023.
• Responding to enquiries from users outside the EU: when a user residing in a non-EU country contacts us on their own initiative through the site’s forms, our reply entails the transfer of their e-mail address and the information contained in their message to the destination country. Such transfer takes place under Article 49(1)(b) GDPR (transfer necessary for the performance of pre-contractual measures taken at the request of the data subject).

9. Your rights

In relation to your personal data, as a data subject you may at any time exercise the rights set out in Articles 15 to 22 GDPR, and in particular:

• Right of access (Art. 15): to obtain confirmation of the existence of processing activities and receive a copy of your data;
• Right of rectification (Art. 16): to request the correction of inaccurate data;
• Right to erasure (Art. 17): to request deletion of your data, within the limits set by law;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20): to receive in a structured format the data you have provided;
• Right to object to processing (Art. 21);
• Right to withdraw consent (Art. 7(3)), where processing is based on consent, without affecting the lawfulness of processing carried out prior to the withdrawal.

To exercise these rights, please write to info@pennati.it, using “Privacy request” as the subject.

10. Right to lodge a complaint

If you believe that the processing of your personal data infringes the applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. As the data controller is established in Italy, the competent authority is the Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it), Piazza Venezia n. 11, 00187 Rome, Italy. Users residing in another EU/EEA Member State may alternatively contact their local supervisory authority — the list is available on the European Data Protection Board’s website (edpb.europa.eu).

11. Changes to this privacy notice

This privacy notice may be updated over time to reflect changes in the applicable laws, the introduction of new tools or services, or changes in the way we process personal data. The current version is always the one published on this page, along with the “last updated” date shown at the top.