Privacy Policy

Data Controller	Utilplastic S.r.l.
Registered office	Via del Campo Sportivo, 180 – 51036 Larciano (PT) – Italy
Contacts	Tel. +39 0573 83161 \| Email: info@utilplastic.it \| VAT No. 00978680478
Last updated	13/04/2026

This privacy notice describes how Utilplastic S.r.l. processes personal data through the website www.utilplastic.it, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).

1. Data Controller

Utilplastic S.r.l.
Via del Campo Sportivo, 180 – 51036 Larciano (PT) – Italy
Email: info@utilplastic.it
PEC: utilplastic@pec.it
Phone: +39 0573 83161

The Data Controller determines the purposes and means of the processing.

No Data Protection Officer (DPO) has been appointed.

2. Types of data processed

2.1 Data voluntarily provided

First and last name
Email address and phone number
Company and professional information (B2B context)
Content of messages sent through forms

Data is collected through the contact forms available on the website.

The data may be:

sent by email
stored in the website database for organizational purposes and request management

2.2 B2B reserved area (WooCommerce)

The website includes a reserved area intended for customers and business partners.

In this context, the following data is processed:

Company identification data
Login credentials
Order and request history
Commercial information

Access is restricted to registered and authorized users.

2.3 Browsing data

IT systems automatically acquire certain data, including:

IP address
Browser and device used
Date and time of access
Technical and security logs

2.4 Cookies and tracking tools

The website uses:

Necessary technical cookies
Analytics cookies (Google Analytics)

Analytics cookies are activated only after the user has given consent.

For further details, please refer to the Cookie Policy.

3. Purposes and legal bases of processing

3.1 Request management

Purpose: responding to information requests
Legal basis: Article 6(1)(b) GDPR (pre-contractual measures)

3.2 Management of the reserved area and B2B relationships

Purposes:

account management
order management
management of business relationships

Legal basis: Article 6(1)(b) GDPR (contract)

3.3 Statistical analysis (Google Analytics)

Purpose: analysis of website traffic and usage

Legal basis: Article 6(1)(a) GDPR – consent

The service is activated only after cookie acceptance.

3.4 Website security

Purposes:

prevention of unauthorized access
protection against cyber attacks

Legal basis: Article 6(1)(f) GDPR (legitimate interest)

3.5 Commercial communications (where applicable)

Purpose: sending commercial or informational communications

Legal basis: consent (Article 6(1)(a) GDPR)

4. Data recipients

Data may be processed by third parties acting on behalf of the Data Controller, including:

Playnet Srl
Google LLC (Google Analytics)
Fact s.r.l.s.
Computer Line Srl

These parties act as Data Processors pursuant to Article 28 GDPR.

The complete list of any Data Processors may be requested from the Data Controller using the contact details provided in this notice.

5. Transfers outside the EU

Some providers, such as Google, may process data outside the European Economic Area.

Transfers take place on the basis of:

Adequacy decisions, such as the Data Privacy Framework
Standard Contractual Clauses (SCC)

6. Data retention

Form data: up to 24 months
Reserved area data: for the duration of the business relationship
Technical logs: up to 6 months
Marketing data: until consent is withdrawn

7. Data subject rights

Users may exercise the rights provided for under Articles 15–22 GDPR:

Access to personal data
Rectification
Erasure
Restriction of processing
Data portability
Objection
Withdrawal of consent

Users may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Requests may be sent to: info@utilplastic.it

The Data Controller will respond within 30 days, extendable by a further 60 days in complex cases. The exercise of rights is free of charge, except in the case of manifestly unfounded or excessive requests.

8. Automated decision-making

The Data Controller does not carry out automated decision-making pursuant to Article 22 GDPR. Profiling is carried out exclusively for commercial purposes and requires consent.