PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

September 2025 Edition

This privacy notice has been drafted as a supplement to previous notices and does not replace them.

Pursuant to Article 13 of EU Regulation 2016/679 (GDPR), this privacy notice concerns your personal data—i.e., any information relating to you—processed by GPI S.p.A. through the website [www.riedlautomation.com]

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

1.1. The Data Controller is GPI S.p.A., with registered office at Via Ragazzi del ’99 no. 13 – 38123 Trento (TN), VAT No.: 01944260221.

1.2. Contact information: a) phone: +39 0461381515; b) e-mail: info@gpi.it; c) PEC: gpi@pec.gpi.it.

2. DATA PROCESSED, PURPOSES AND LEGAL BASIS OF THE PROCESSING, NATURE OF THE PROVISION, RETENTION PERIOD

2.1. In this paragraph, for each purpose, you will also find: the personal data processed, the legal basis of the processing, the nature of the provision, and the retention period.

A. Website browsing. Personal data processed: personal data implicitly transmitted while using internet communication protocols (IP address, domain names of computers used to connect to the site, URI – Uniform Resource Identifier – addresses of requested resources, time of request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the server’s response status, and other parameters related to the user’s operating system and IT environment).

Purpose: to allow browsing and consultation of the website. Legal basis: Art. 6(1)(f) GDPR, as the processing is necessary for the legitimate interest of the controller. Nature of provision: necessary for browsing the website. Retention period: for the entire duration of the browsing session for data collected during the session, and for a maximum of seven (7) days thereafter, unless further retention is required to ascertain responsibility for potential cybercrimes.

B. Request for information Personal data processed: first name, last name, email address, as well as optional data such as profession, organisation, phone number, country of origin, and any other information you voluntarily provide. Purpose: to respond to information requests. Legal basis: Art. 6(1)(b) GDPR, as the processing is necessary for the performance of a contract to which the data subject is party or for pre-contractual measures taken at the data subject’s request. Nature of provision: necessary in order to request information. Retention period: for the time necessary to respond to your information requests.

C. Fraud prevention. Personal data processed: behaviour on the website, including IP addresses. Purpose: security and prevention of fraudulent actions, through an automated control system that detects and analyses user behaviour on the site, including processing of personal data such as the IP address. Legal basis: Art. 6(1)(f) GDPR, as the processing is necessary for the legitimate interest of the controller. Nature of provision: necessary for website browsing. Retention period: seven (7) days unless an anomaly is detected. In that case, data will be retained until behaviours have been verified and, in case of legal action, until its conclusion.

D. Sending periodic newsletters. Personal data processed: first name, last name, email address. Purpose: to send you informational communications from the Data Controller by email. Legal basis: your consent, Art. 6(1)(a) GDPR. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal. Nature of provision: optional and does not affect the use of other services. Retention period: until you withdraw your consent.

E. Email marketing. Personal data processed: email address. Purpose: to send you commercial communications, event invitations, or promotional initiatives by email. Legal basis: your consent, Art. 6(1)(a) GDPR. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal. Nature of provision: optional and does not affect the use of other services. Retention period: until withdrawal of your consent or for a maximum of twenty-four (24) months from the date consent was given. After 24 months, you will be asked to renew your consent if you wish to continue receiving such services.

F. Data provided in the Product Catalogue section. Personal data processed: email address. Purpose: to send you, via email, the requested brochure containing updated product information, and—only if you consent—to send related commercial communications. Legal basis: Art. 6(1)(b) GDPR, as the processing is necessary to implement pre-contractual measures; Art. 6(1)(a) GDPR for related commercial communications based on your explicit consent. Nature of provision: optional for commercial communications; necessary to obtain the brochure. Retention period: for sending the brochure, until delivery of the catalogue and handling of the request; for related communications, until withdrawal of consent.

2.2. Regarding cookies, please refer to the cookie policy available in the dedicated section of the website.

2.3. Regarding browsing on the Data Controller’s social network profiles, please refer to the privacy sections of the respective websites.

2.4. Your personal data may also be processed, when necessary and after your provision for the purposes above, to establish, exercise, or defend legal claims, based on the Data Controller’s legitimate interest (Art. 6(1)(f) GDPR).

3. POTENTIAL RECIPIENTS OF THE DATA

3.1. In order to provide the requested services, the Data Controller may entrust your personal data to various service providers, with whom a specific agreement has been drafted to safeguard your personal data and ensure compliance with data protection legislation. These subjects act as Data Processors and process your personal data based on a specific mandate pursuant to Art. 28 GDPR, following the instructions and directives of the Controller. In particular, these may include:
a) individuals, companies, or professional firms providing assistance and consulting services to the Controller;
b) subjects necessary for enabling website browsing, such as hosting service providers;
c) subjects responsible for technical support and maintenance of network devices and electronic communication networks.
The complete list of data processors is available upon request by contacting the Controller through the contact details provided in this notice.

3.2. The Data Controller may disclose your personal data to subjects, entities, or authorities to whom disclosure is mandatory by law or by order of authorities. These subjects will act as independent data controllers.

3.3. Your personal data may be communicated to and processed by individuals authorised by the Controller pursuant to Art. 29 GDPR, who have committed to confidentiality or are subject to an appropriate legal obligation of confidentiality, such as company employees.

4. TRANSFER OF DATA TO NON-EU COUNTRIES AND/OR INTERNATIONAL ORGANISATIONS

4.1. Your personal data may be transferred to non-EU countries based on the Standard Contractual Clauses under Art. 46 GDPR.

4.2. Regarding cookies, please refer to the cookie policy available on this website.

5. RIGHTS OF THE DATA SUBJECT AND COMPLAINTS

5.1. With regard to the data, the data subject—or a person delegated in writing—may exercise the following rights, also by writing to the Controller’s contact points indicated in this notice: a) right of access under Art. 15 GDPR; b) right to rectification under Art. 16 GDPR; c) right to erasure under Art. 17 GDPR; d) right to restriction of processing when one of the cases under Art. 18 GDPR applies; e) right to receive confirmation that the operations carried out pursuant to Articles 16, 17, and 18 GDPR have been communicated to recipients, unless this proves impossible or entails disproportionate effort (Art. 19 GDPR); f) right to data portability under Art. 20 GDPR; g) right to object to processing under Art. 21 GDPR; h) right not to be subject to a decision based solely on automated processing under Art. 22 GDPR; i) right to withdraw consent at any time under Art. 7 GDPR; j) right to lodge a complaint with a supervisory authority under Art. 77 GDPR.

6. FURTHER INFORMATION

6.1. The Data Controller remains available for any clarification needs and, should the processing change from that described in this document, will provide a specific updated notice.

6.2. The protection of your data and compliance with the principles set out by the legislation, particularly the principle of transparency, are of primary importance to us. We would be grateful if you could help us by reporting any unclear sections of this document or suggesting improvements through the Controller’s contact points listed above.

7. DATA PROTECTION OFFICER (DPO)

7.1. GPI S.p.A. has appointed a Data Protection Officer (RPD/DPO), who may be contacted for any matter concerning the processing of personal data and the exercise of rights under the GDPR at the following contacts:
a) phone: 055750808;
b) email: dpo@gpi.it