Privacy Policy

Pursuant to art. 13 of EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

Controller: SPAPPERI NT S.r.l.

Site: www.spapperi.com

Last updated: 28 May 2026

Language note: This Privacy Policy is available in Italian (official version), English, French, German, Spanish, Portuguese and Chinese. In case of discrepancy, the Italian version shall prevail.

Pursuant to art. 13 of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter "GDPR"), and art. 13 of Legislative Decree 30 June 2003 no. 196 (Personal Data Protection Code, as amended by Legislative Decree 101/2018), SPAPPERI NT S.r.l. (hereinafter "SPAPPERI" or the "Controller") informs you about the purposes and methods of processing the personal data collected during your browsing and use of this website (hereinafter "Site").

The processing of your personal data is always based on principles of lawfulness, fairness and transparency, in compliance with all applicable regulations.

1. Data Controller

SPAPPERI NT S.r.l.

Via Pietro Ercolani, 5/B — 06012 Città di Castello (PG), Italy

VAT number: 03467460543

E-mail: privacy@spapperi.it

2. Categories of data processed

2.1 Browsing data

The computer systems operating this Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes: IP addresses, browser type, operating system, domain name and addresses of sites from which access was made, pages visited, access time, time spent on individual pages and other parameters related to the user's computing environment.

Such data are collected and used exclusively in an aggregate and anonymous manner, and may be used to ascertain liability in the event of hypothetical computer crimes against the Site.

2.2 Data voluntarily provided by the user

a) Contact form and information requests

First name, last name, e-mail, phone, country, message. If the user selects "Company": company name (mandatory), activity type and sector (optional). Providing consent to the processing of personal data pursuant to the GDPR is mandatory; consent to marketing is optional.

b) Newsletter subscription

E-mail, name (optional), occupation (optional), language preference. Subscription is subject to e-mail confirmation (double opt-in). Consent to commercial communications is optional.

c) Job applications ("Work with us")

First name, last name, e-mail, phone (optional), curriculum vitae (mandatory), other attachments (optional), message (optional), position of interest. Attached files may contain special categories of data pursuant to art. 9 GDPR (e.g. health status): you are invited not to include such information unless strictly necessary. Providing consent to the processing of personal data pursuant to the GDPR is mandatory.

d) Video call requests

First name, last name, e-mail, phone, country, service of interest, preferred date and time, message. If the user selects "Company": company name (optional). Providing consent to the processing of personal data pursuant to the GDPR is mandatory.

e) Customer reserved area

E-mail, company name, customer code, contact name (optional), phone (optional), job title. Access is permitted exclusively to customers registered by the Controller.

f) Requests to exercise rights (art. 15–21 GDPR)

First name, last name, e-mail, type of request, message (optional). Data are collected exclusively to process the data subject's request.

g) Technical assistance requests

First name, last name, company (optional, only collected when the user selects "Company"), e-mail, phone (optional), country (optional), machine serial number (optional), message, photographic attachments (optional, formats HEIC/JPG/PNG/WebP/BMP, max 5 files of 15 MB each). Providing consent to the processing of personal data pursuant to the GDPR is mandatory; consent to marketing is optional.

2.3 Data collected via cookies and tracking technologies

The Site uses technical cookies necessary for operation and, subject to your consent, analytical cookies (Google Analytics 4) and marketing cookies (Google Ads). For more information please refer to the Cookie Policy available on the Site.

2.4 Data processed through the AI virtual assistant

The Site provides an artificial-intelligence virtual assistant, named "Gaia", to give information about products, services and contacts. Interacting with the assistant involves processing the data the user freely enters in the chat: the text of the messages, the language, a technical session identifier and certain technical metadata (date and time, tools used).

To generate replies, messages are processed through OpenAI, L.L.C. (United States) acting as data processor (see points 7 and 8). Users are asked not to enter personal, confidential or special-category data in the chat.

3. Purposes and legal bases of processing

4. Further purposes — Direct marketing

Subject to your express, free and unambiguous consent pursuant to art. 6(1)(a) GDPR, the Controller may process your data for sending promotional and marketing communications relating to SPAPPERI's products and services, including the newsletter, by e-mail.

You may withdraw your consent at any time:

- By clicking the unsubscribe link present in every communication;

- By writing to privacy@spapperi.it;

- By registered letter to the Controller's registered office.

The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.

5. Mandatory or optional nature of providing data

Providing the data marked as mandatory in the forms is necessary for the delivery of the requested service. Without such data it will not be possible to process the request. Providing optional data does not affect the use of the Site's services.

6. Retention periods

Upon expiry of the above periods, data are automatically deleted or irreversibly anonymised.

7. Recipients of personal data

Your personal data may be communicated, within the limits strictly necessary for the purposes set out in this Privacy Policy, to the following categories of recipients:

a) Data Processors (art. 28 GDPR), including:

- Provider of hosting and IT infrastructure services (VPS server);

- Provider of e-mail services (SMTP) used for sending notifications;

- Google LLC — for the Google Analytics 4 service (only if the user has consented to analytical cookies) and Google Ads (only if the user has consented to marketing cookies);

- Cloudflare, Inc. — for the Turnstile service (CAPTCHA verification on public forms of the Site), aimed at preventing abuse and spam.

- OpenAI, L.L.C. (United States) — processing of the messages sent to the AI virtual assistant to automatically generate replies.

b) Individual persons, employees and/or collaborators specifically authorised by the Controller.

c) Public bodies or judicial authorities, where required by law or to prevent or suppress the commission of crimes.

8. Transfer of personal data to third countries

Some of the recipients referred to in section 7 (in particular Google LLC and Cloudflare, Inc.) are established outside the European Economic Area (EEA). The transfer is carried out in compliance with the safeguards provided for by artt. 44 et seq. of the GDPR, in particular:

Recipients involving a transfer to the United States also include OpenAI, L.L.C., which processes the messages sent to the AI virtual assistant. The transfer is carried out on the basis of the Standard Contractual Clauses (SCCs) and appropriate safeguards under Art. 44 et seq. GDPR.

- Standard Contractual Clauses (SCC) approved by the European Commission;

- Any applicable adequacy decisions of the European Commission.

For processing operations that do not require extra-EEA transfers (contacts, job applications, video calls, customer area), data are processed exclusively within the territory of the European Union.

9. Minors

Persons under the age of 18 must not provide personal data to SPAPPERI without the consent of those exercising parental responsibility.

10. Rights of the data subject

You may exercise at any time, against the Controller, the following rights provided for by artt. 15–22 GDPR:

- Right of access (art. 15): obtain confirmation that processing of your data is taking place and access to the relevant information.

- Right to rectification (art. 16): obtain the correction of inaccurate data or the completion of incomplete data.

- Right to erasure (art. 17): obtain the deletion of your data in the cases provided for by the regulation.

- Right to restriction of processing (art. 18): obtain the restriction of processing in the cases provided for by the regulation.

- Right to data portability (art. 20): receive your data in a structured, readable format, or request their transmission to another controller.

- Right to object (art. 21): object to processing based on the legitimate interest of the Controller or for direct marketing purposes.

- Right to withdraw consent (art. 7): withdraw consent given at any time, without affecting the lawfulness of the processing prior to the withdrawal.

- Right to lodge a complaint with the Italian Data Protection Authority ([www.garanteprivacy.it](https://www.garanteprivacy.it)) or with the supervisory authority of your country of residence.

To exercise your rights, you may contact the Controller:

- E-mail: privacy@spapperi.it

- Post: SPAPPERI NT S.r.l., Via Pietro Ercolani, 5/B, 06012 Città di Castello (PG), Italy

The Controller will respond within 30 days of receiving the request (art. 12 GDPR).

11. Updates

This Privacy Policy may be subject to updates. SPAPPERI invites users to consult this page periodically. Substantial changes will be communicated with adequate notice via an announcement on the Site.

This Privacy Policy is available in Italian (official version), English, French, German, Spanish, Portuguese and Chinese.