Privacy Policy on the Processing of Personal Data.
INTRODUCTION
This policy takes into account the provisions of the GDPR and the Italian Privacy Code (Legislative Decree No. 196 of 30 June 2003). The document has also been drafted in accordance with the Guidelines of the Italian Data Protection Authority (in particular the Guidelines on combating spam issued on 4 July 2013).
Data Controller: Eglooh S.r.l. | VAT No. IT01739420931 | R.E.A. PN - 100678 | Share Capital € 10,000.00 fully paid | Email info@eglooh.com
Website to which this privacy policy refers: https://www.eglooh.com/ (Website).
The Data Controller has not appointed a Data Protection Officer (DPO). You may therefore send any enquiries directly to the Data Controller.
GENERAL INFORMATION
This document describes how the Data Controller processes your personal data provided on the Website.
The main processing activities involving your personal data are described below. In particular, we explain the legal basis for the processing, whether the provision of personal data is mandatory, and the consequences of not providing it. Where necessary, we have specified whether and when a particular processing activity is not carried out. On the Website you may enter personal data relating to third parties. In doing so, you warrant that you have obtained the consent of those individuals to the entry of their personal data. You therefore agree to indemnify and hold harmless the Data Controller from any liability in this regard.
Registration on the Website
The information and data requested at the time of registration will be used to allow you access to the reserved area of the Website and to use the online services offered by the Data Controller to registered users. The legal basis for the processing is the need for the Data Controller to take pre-contractual steps at your request. The provision of data is optional; however, refusal to provide the data will make it impossible to register on the Website. Registration is also possible via third-party services. In such cases, your registration data will be shared with those third-party providers solely for the purpose of enabling registration. The legal basis is the legitimate interest of the Data Controller in enabling registration via external services. Failure to provide your data will make it impossible to register via such external services.
Purchases on the Website
Your personal data will be processed to enable you to make purchases on the Website. In the case of an online purchase order, this is necessary to conclude the purchase contract and properly carry out the related transactions (and, where required by applicable law, to fulfil tax obligations). This processing also includes the possibility of sending communications (e.g. tracking information and order updates, and requests for reviews) via automated tools such as email, SMS and/or WhatsApp. The legal basis for the processing is the Data Controller's obligation to perform the contract with you or to comply with legal obligations. Independently of the above (and therefore of your consent), the Data Controller may process your data for so-called "soft spam" purposes, governed by Article 130 of the Italian Privacy Code. This means that, limited to the email address you provided in connection with a purchase on the Website, the Data Controller may use it to send direct offers for similar products or services, unless you object to such processing in the manner set out in this policy. The legal basis is the legitimate interest of the Data Controller in sending such communications. The Data Controller may also send emails reminding you to complete a purchase. The legal basis is the Data Controller's legitimate interest in sending such communications. Through the "follow on shop" option, the Data Controller may process your personal data to send you updates by email and/or telephone regarding order status, shipments and/or supplies. The legal basis is the Data Controller's legitimate interest in sending such communications, which corresponds to your interest in receiving such updates. Provision of data for this purpose is optional; however, without such data the Data Controller will be unable to send these communications. The Data Controller does not offer products or services restricted to persons under 18 years of age. Accordingly, no specific age-verification system is in place, as no content subject to legal restrictions is present.
Responding to Your Requests
Your data will be processed to respond to your information requests. Provision is optional, but refusal will make it impossible for the Data Controller to reply to your enquiries. The legal basis is the Data Controller's legitimate interest in addressing user requests, which corresponds to your interest in receiving a response. The Data Controller may also process your personal data to manage support requests and/or tickets opened by you. The legal basis is the Data Controller's legitimate interest in handling such requests, which corresponds to your interest in receiving support.
General Marketing
Subject to your consent, the Data Controller may process the personal data you have provided in order to send you advertising material and/or newsletters relating to its own products or those of third parties. The legal basis is your consent. Provision of data for this purpose is purely optional. Failure to consent will make it impossible for you to receive advertising material about the Data Controller's and/or third parties' products or services, and will prevent the Data Controller from conducting market research or sending you newsletters. These communications will be sent to the email address you provided on the Website. We use Google services, such as Google Ads and Google Analytics, to personalise advertisements and improve the user experience. This involves the collection of personal data necessary to show you relevant advertising aligned with your interests. At the time of consent, you will be asked to authorise the use of such data. Further details on the use of cookies and consent management are available in the cookie policy of this website. Emails sent by the Data Controller contain tracking tools (so-called tracking pixels and tracked links) that record the opening of the message, the date, time and number of openings, the device and email client used, the IP address, and clicks on content, in order to measure the effectiveness of communications and improve their content and frequency. The legal basis is your consent, pursuant to Article 122 of Legislative Decree 196/2003 and Article 6(1)(a) of the GDPR, as clarified by the Italian Data Protection Authority in its Ruling No. 284 of 17 April 2026. Consent to tracking may be given together with consent to receive communications; it is optional and independent of the latter. You may withdraw it at any time — while continuing to receive communications — via the link at the bottom of each message or by contacting the Data Controller at the address indicated in this policy. Following withdrawal, communications will be sent without tracking pixels or tracked links. Data relating to openings and clicks are processed on behalf of the Data Controller by the sending platform provider, appointed as data processor pursuant to Article 28 of the GDPR.
Profiling
Subject to your consent, the Data Controller may process your personal data for profiling purposes, i.e. to analyse your consumption choices by monitoring the type and frequency of your purchases, in order to send you advertising material and/or newsletters relating to the Data Controller's own products or those of third parties that are of specific interest to you. The legal basis is your consent. Provision of data for this purpose is purely optional. Failure to consent will prevent the Data Controller from building a commercial profile of you based on your purchasing choices and habits, and from sending you personalised advertising material. These communications will be sent to the email address you provided on the Website.
Data Transfer to Third Parties
The Data Controller does not transfer your personal data to third parties.
Geolocation
When accessing the Website, you may receive a notification on your device (fixed and/or mobile) giving you the option to allow or deny the identification of your device (so-called geolocation). You are free to allow or deny this setting without any material changes to the Website's functionality. You may change your geolocation settings at any time through your device settings. The legal basis is the Data Controller's legitimate interest in providing services relevant to your location, which corresponds to your interest in receiving the most relevant services possible.
Curriculum Vitae
It is not possible to submit CVs via the Website. Your data will therefore not be processed for this purpose.
Appointment Booking
No third-party appointment booking systems are active on the Website. Your data will therefore not be processed for this purpose. You may, however, contact the Data Controller at any time using the details provided above.
Photographs and Videos
The Data Controller does not request the publication of photographs and/or videos featuring you. Your data will therefore not be processed for this purpose.
Web Scraping
The use of any automated process or system to access, acquire, copy or monitor any part of this website, including but not limited to web scraping, crawling or spidering techniques, is strictly prohibited. The Data Controller reserves the right to take all necessary measures, including legal action, to prevent and pursue any unauthorised scraping activity. By using the Website, you and any third party undertake not to: (i) use automated systems, such as bots, scrapers or spiders, to access or interact with the Website; (ii) collect content, data or other information present on the Website without explicit written authorisation; (iii) distribute, display, publish or otherwise use content obtained through scraping techniques without consent. Any violation of this clause will be deemed a material breach of the Website's terms of use and will result in appropriate measures being taken, including possible suspension of access to the Website and the initiation of legal proceedings to protect the interests of the Data Controller.
Communication of Personal Data
In the course of its ordinary business activities, the Data Controller may communicate your personal data to certain categories of recipients. Article 2 lists the parties to whom the Data Controller may communicate your personal data. To facilitate the protection of your rights, Article 2 specifies in certain cases when your data is not communicated to third parties.
The "communication" of personal data to third parties differs from "transfer" (governed by the preceding section). In a communication, the third party receiving the data may only use it for the specific purposes described in its relationship with the Data Controller. In a transfer, the third party becomes an independent data controller. Furthermore, the transfer of your personal data to third parties always requires your consent.
Without prejudice to the foregoing, the Data Controller may still use your personal data to properly fulfil its obligations under applicable law.
SPECIFIC PRIVACY PROVISIONS
Art. 1 Methods of Processing
1.1 The processing of your personal data will be carried out primarily by electronic or automated means, using methods and tools designed to ensure security and confidentiality in accordance with the GDPR.
1.2 The information collected and the methods of processing will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances.
1.3 No "special categories" of personal data are processed through the Website. Special categories include data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature, health status and sexual life.
1.4 No judicial data is processed through the Website.
Art. 2 Communication of Personal Data
The Data Controller may communicate your personal data to specific categories of recipients. The Data Controller wishes to inform users that, in connection with the use of the YouTube service (operated and owned by Google LLC), certain personal data may be collected and shared. This data collection is essential to provide and improve the user experience on our Website and to enable the viewing of video content embedded via the YouTube API. Specifically, when a user views a video via the YouTube API on our Website, the following information may be collected: IP Address: used to connect your device to YouTube for video transmission. Behavioural Data: including information on how you interact with videos, which videos are viewed and for how long. Location Information: used to provide relevant content based on your geographical location. This data is collected automatically by the system and may in some cases be retained to improve the user experience and for YouTube's internal analytics. Please note that our Website uses YouTube API services; by viewing content through these APIs, you accept YouTube's Terms of Service, available at https://www.youtube.com/t/terms. For further details on data management by Google LLC, please consult Google's privacy policy at http://www.google.com/policies/privacy and YouTube's privacy policy at https://www.youtube.com/intl/ALL_it/howyoutubeworks/our-commitments/protecting-user-data/. The parties to whom the Data Controller reserves the right to communicate your data are listed below:
- The Data Controller may communicate your personal data to all parties (including Public Authorities) who have access to personal data by virtue of regulatory or administrative measures.
- Your personal data may be communicated to public and/or private entities and/or legal persons (legal, administrative and tax consultancies, courts, chambers of commerce, labour offices, etc.) where such communication is necessary or functional to the proper fulfilment of legal obligations.
- The Data Controller employs staff and/or collaborators in any capacity. For the proper functioning of the Website, the Data Controller may communicate your personal data to such employees and/or collaborators.
- In the course of its ordinary Website management activities, the Data Controller engages companies, consultants or professionals responsible for the installation, maintenance, updating and general management of the hardware and software it uses to provide its services. Your data may therefore also be processed by such parties, exclusively for these purposes.
- For the sending of its communications, the Data Controller engages external companies responsible for sending this type of communication (CRM platforms). Your personal data (in particular your email address) may therefore be communicated to such companies.
- The Data Controller does not engage external companies to provide customer care services.
- The Data Controller engages banking institutions and companies managing national and international payment circuits for online payments for products and services purchased through the Website.
- Purchasers' personal data may be communicated to postal offices, couriers or forwarding agents responsible for the delivery of products purchased through the Website.
- Purchasers' personal data are not communicated to providers of generative artificial intelligence technology.
The Data Controller reserves the right to modify the above list in accordance with its ordinary operations. You are therefore invited to consult this policy regularly to check to which parties the Data Controller communicates your personal data.
Art. 3 Retention of Personal Data
3.1 This article describes how long the Data Controller reserves the right to retain your personal data.
- Your personal data will be retained only for as long as necessary to ensure the proper provision of the services offered through the Website.
- For marketing purposes, personal data will be retained until consent is withdrawn. For inactive users, personal data will be deleted one year after the last email was sent and viewed.
- For the purpose of performing the sales contract, data will be retained for 10 years from the date of receipt of the purchase order, to enable the Data Controller to exercise its right of defence and to demonstrate proper performance of the contract.
- For customer care purposes, data will be deleted once the support service is completed and, in any case, within a maximum of 3 months from the last email exchange with the individual concerned.
- As provided for in Article 2220 of the Italian Civil Code, invoices and all accounting records in general are retained for a minimum of ten years from the date of registration, so that they can be presented in the event of an audit.
- For marketing purposes, where consent is not withdrawn beforehand, data will be retained for 24 months from the time of submission. After withdrawal of consent or the expiry of the 24-month period, personal data will be deleted and no longer used for marketing purposes.
- Personal data provided via the quote request form will be retained for the time strictly necessary to respond to the request and, in any case, for no longer than 6 months from its receipt. After this period, data will be deleted or anonymised, unless a longer retention period is required by law.
- Through the Website (or by contacting the Data Controller), it is possible to delete your user account. In that case, all stored personal data will be deleted and will not be retained by the Data Controller for any purpose.
3.2 Without prejudice to Article 3.1, the Data Controller may retain your personal data for as long as required by applicable specific legislation, as amended from time to time.
Art. 4 Transfer of Personal Data
4.1 The Data Controller is established in a country that provides an adequate level of protection from a regulatory standpoint. Where the transfer of your personal data takes place to a non-EU country for which the European Commission has issued an adequacy decision, the transfer is in any case considered safe from a regulatory perspective. This Article 4.1 indicates on a case-by-case basis the countries to which your personal data may be transferred and for which the European Commission has issued an adequacy decision.
- To enable the proper functioning of the Website, your personal data may be transferred abroad. This is permitted pursuant to European Commission Decision No. 2002/2/EC of 20 December 2001 (published in the Official Journal of the European Communities L 2/13 of 4 January 2002), which found that Canada ensures an adequate level of protection for personal data transferred from the European Union to recipients subject to the Canadian Personal Information Protection and Electronic Documents Act of 13 April 2000.
- Your personal data may be transferred to the USA pursuant to the European Commission's adequacy decision, by which the Commission determined that the USA provides a level of data protection essentially equivalent to that offered by the European Union.
4.2 Without prejudice to Article 4.1, your data may also be transferred to non-EU countries for which the European Commission has not issued an adequacy decision. You are therefore invited to review this Article 4.2 regularly to check to which of these countries your data may be transferred.
4.3 In this article, the Data Controller indicates the countries in which it may specifically direct its activities. This may entail the application of the law of the relevant country, alongside the GDPR and the provisions governing the relationship with you as set out in the Introduction.
- At your request, the Data Controller will apply to the processing of your personal data any more favourable provisions under your national legislation.
Art. 5 Your Rights under the GDPR
Pursuant to Article 13 of the GDPR, the Data Controller informs you that you have the right to:
- request access to your personal data and the rectification or erasure thereof, or restriction of the processing concerning you, or to object to such processing, as well as the right to data portability;
- withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal;
- lodge a complaint with a supervisory authority.
The rights referred to above may be exercised by sending a request without formality to the contact details indicated in the Introduction.
Art. 6 Amendments and Miscellaneous
The Data Controller reserves the right to make changes to this policy at any time, giving appropriate notice to users of the Website and ensuring in any case an adequate and equivalent level of protection for personal data. To keep up to date with any changes, you are invited to consult this policy regularly. In the event of material changes to this privacy policy, the Data Controller may also give notice by email.
