PRIVACY POLICY

Website Privacy Policy

Protecting data privacy is very important. Gualapack and Affiliates are committed to safeguarding users' personal information that is collected, processed and protected when browsing this website with the utmost care by implementing adequate security measures.

1. Data Controller

The Data Controller is Guala Pack S.p.A. with its registered office in via Carlo Mussa, n. 266 - 15073 Castellazzo Bormida (Alessandria) - Italy, web contact form or by e-mail at privacy@gualapack.com.

This Privacy Policy:

• applies to users that interact with www.gualapack.com website and provide their personal data voluntarily or by consent (artt.13 and 14 of the (EU) Regulation 2016/679 (GDPR), in compliance with applicable Data Protection Laws;
• describes the logic behind the processing methods of users' personal data who surf the site (data are processed lawfully, clearly and fairly, art. 5 GDPR), to enable them to consent to the management of their data in a conscious, explicit and informed manner before providing any personal information;
• supplements other Gualapack privacy policies, including the Cookie Policy;
• points at specific security measures implemented by the Data Controller to prevent data loss, unlawful, or inappropriate use and unauthorized access and deletion (art.32 GDPR);
• applies only to this site and does not extend to other websites that may be accessed via hyperlinks.

2. Types of Data Processing

Browsing data
The IT systems and software procedures used to operate this site acquire certain user's personal data whose transmission is implicit in the use of Internet communication protocols. The www.gualapack.com website may obtain and manage users' personal information to enable identification either independently, or in conjunction with other data already collected, or through processing with others held by third parties. The data includes the IP addresses or domain names of PCs and stations used by users, the location (country), the URI/URL (Uniform Resource Identifier/Locator) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response and other parameters relating to the user's operating system and computer environment. Such data, which is necessary for the use and proper functioning of Gualapack's web services, is also processed to obtain anonymous statistical information on the use of the services (number of visitors per hour or per day, most visited pages, geographical areas of origin, etc.), in which case the data is deleted immediately after processing). The data could also be used to determine liability in the event of digital technology crimes against the website. On Gualapack's website, there might be links to social networks or other sites to facilitate user interaction and content sharing. The data entered by the user on various social media occurs in accordance with these domains' data protection rules and settings, accepted by the user upon registration, and not Gualapack's domain.

3. Cookies and tracking tools

This site uses cookies and similar tracking solutions to ensure that the site works properly, to guarantee users a pleasant browsing experience and satisfying interactions with external content, networks and platforms. Cookies are small pieces of data stored on a website by a user's browser (i.e., a browsing program like Chrome, Mozilla, Firefox, Safari, Explorer). They are typically used to keep track of the settings users have selected and actions they have taken on a site like www.gualapack.com (such as login data, language, source size to other display settings). A cookie cannot retrieve any other data from the user's hard disk nor transmit computer viruses or acquire e-mail addresses. Each cookie is unique to the user's web browser. Users may also receive third-party cookies and tracking solutions when browsing this site (e.g. web beacons, pixels, tags, etc.). This site uses:

• technical cookies (set up and managed by Guala Pack S.p.a.) and third-party cookies (set up and managed by third parties in accordance with their own privacy policies and not under the control of the Controller, such as images, specific links to pages in other domains, etc.), which are strictly necessary for the proper functioning of the site. They are not used for any further purpose and are normally installed directly by the Controller or webmaster. Users' prior consent is not required for the installation of such cookies, which once stored in the user's browser can either be automatically deleted at the end of the session (session cookies), or may remain for a certain period of time unless the user, if so desired, deletes them directly from the browser (persistent cookies);
• analytics cookies are collected anonymously (by masking portions of the user's IP address), and statistical and aggregate information on how users surf the site (e.g., number of pages visited and accessed, time spent on the site) to improve its performance. These are cookies installed precisely by the chosen browser, which, however, cannot access the user's personal data. The use of these so-called statistical cookies does not require the acquisition of the user's consent, who can still decide to disable their use on their browser. In this case, some features of the site may not work.
• Functionality cookies to allow the user to browse according to set criteria (e.g. language) and improve the service. The use of such cookies (first or third-party) is essential for the proper functioning of the website and services linked to other sites.
• profiling cookies (including experience, measurement and marketing cookies) and other tracking devices subject to the user's consent, are also aimed at creating profiles relating to the user visiting the site and are used to send advertising messages in line with the preferences expressed by the user to browse the web. Hence, when accessing the site, a banner pops up to inform and allow the user to accept cookies and similar tracking solutions by selecting the "Accept" button, or to disable all cookies by selecting the "Reject" button or to manage the user's preferences by selecting the "Cookie settings" button. Profiling cookies and other tracking tools are used to monitor and profile users as they browse the site, to analyze their movements and browsing habits (what they read, etc.). The selected cookies are in turn stored in the user's browser where they remain for a longer period of time to avoid during that period the re-submission of the request to the user and allow for a more expeditious navigation, unless the user decides at any time to delete them from the browser;
• third-party cookies may occasionally be found on the site as references to other websites' functions (such as Youtube videos https://policies.google.com/privacy?hl=it) or so-called social buttons, icons that depict some social network platforms and allow browsing users to interact with a "click" directly with such websites' domains. There may also be links to social networks or other sites on the site to facilitate users' interaction and content sharing. The site does not share any browsing information or user data with sites accessible in this way, but the use of these features means that users may also receive profiling cookies in their browsers from these third-party sites. These technologies do not collect users' names, email addresses, phone numbers, addresses. In the case of cookies and other third-party tracking tools, the site does not have direct control over individual cookies and cannot control them (it can neither set them directly nor delete them), but users can set their browsers to alert them to the presence of cookies and decide whether or not to accept a specific cookie. For more details on the list of cookies, types, retention and expiration, how to disable them and their respective controllers, click on the Cookie Policy.

4. Data Processing and Legal Basis

The Data Controller will process users' personal data provided via the site for the following purposes:

• ensure the proper functioning of the web pages and their content; the data processing is based on the Data Controller's legitimate interest;
• respond to users' information, products, quotes, marketing and assistance requests for which the processing is required to fulfill the users' request by e-mail, telephone call, SMS or other equivalent forms of electronic or paper communication;
• to execute a pre-contractual agreement or contract to which the data user is a party, or in order to process the data following the user's request prior to entering into a contract and subsequent communication Privacy Policy: Customers and Suppliers;
• filling out forms with personal data in order to receive newsletters, promotional material or business communication via e-mail or mailing lists on Gualapack and its Affiliates' products and/or services, and to keep users up to date on news and events. Gualapack may use e-mail marketing service providers to manage and send e-mails to users. The processing requires the user's prior consent; users can opt out of receiving any or all communication of this kind by unsubscribing through the link or the instructions provided in any e-mail received by Gualapack, or by contacting the Data Controller.
• store user's personal data collected in the Controller's Customer Relationship Management ('CRM'). The processing is based on the consent of the user;
• send news, special offers, and general information on other Gualapack products, services, and events even similar to those previously received, unless the user has already opted out and chosen not to receive them;
• to carry out promotional initiatives and send direct marketing communications, newsletters, as well as to carry out market research, on products and services of the Data Controller or its subsidiaries, parent and affiliated companies, by e-mail, text message, or similar; to carry out research and data analysis and statistics on aggregated or anonymous data (i.e, without identifying the user) to measure the functioning of the website, as well as its traffic, serviceability and interest, identifying usage trends, determining the effectiveness of promotional campaigns and, to evaluate and improve the user experience through the website;
• allow to share the user's personal data for commercial purposes with Gualapack's affiliates;
• register and participate in Gualapack's events that require the processing of personal images and/or videos. The processing is based on the consent of the user;
• exercise a legitimate interest as well as a right of the Data Controller (e.g., the right of defense in court, etc.);
• comply with the law, a judicial proceeding, court order, or other legal process or an order of the Authority.

5. Processing Methods

Personal data is processed manually, electronically or with automated tools for the time strictly necessary to achieve the purposes for which it was collected, stored and processed (e.g. through the use of cookies, or by using resources via a script on the user's device when interacting with the website). Specific security measures are applied in order to prevent any loss, illegal use or misuse of data, alteration as well as any unauthorized access, disclosure and deletion.

User's personal data will be processed by the Data Controller, by its specially appointed authorized personnel, or by independent Data Controllers or externally appointed Data Processors (e.g. external duly appointed IT service suppliers for the maintenance of the site, e-mailing systems' operators, etc.) Users may at any given time:

• request from the Data Controller a full list of the Data Processors appointed from time to time and involved in the processing of data for the purposes set out in this policy;
• withdraw the consent granted by contacting the Data Controller, or via the unsubscribe button available on any e-mail communication from Gualapack.

6. Disclosure of Personal Data

Users' data could be communicated or transferred to Gualapack's affiliates and third parties operating on behalf of the Data Controller who carry out certain technical, marketing, organizational activities on their behalf, such as:

• Service Providers: to perform activities on behalf of the Controller, data analysis, marketing and promotional services, website hosting and technical support. As per applicable law, the Controller's contracted service providers are required to take appropriate security measures to protect users' personal information in line with Gualapack's policies and are not allowed to use personal information for their own purposes;
• Affiliates and Business Partners: to disclose from time to time personal information to Gualapack's subsidiaries, affiliates and business partners (i.e. to identify prospects and facilitating the ability of such entities to share information with existing and potential business customers) about Gualapack's commercial products, upcoming events and other new developments, and in the event of extraordinary operations, they may be transferred or passed on to third parties in their own right. Affiliates include the parent company and any other subsidiaries, joint venture partners, or other companies that Gualapack controls or that are under common control, and that all require to honor this privacy policy.
• Authorities: to disclose the user's personal information if required by law or by public authorities (e.g., a court of law or governmental agency).

7. Data Retention

Users' personal data shall be processed and stored for as long as required for the purpose for which they have been collected, and as there are statutory retention obligations, or the data is necessary to exercise or defend against legal claims that are not yet time barred. In particular, the Data Controller implements the following rules:

• the data provided in contact forms or e-mails sent to the addresses published on the website will be kept only for the time necessary to respond and deal with the requests received;
• data provided for the receipt of press reviews (newsletters), offers and news will be processed until the user withdraws consent. Withdrawal of consent will be immediately recorded by the Controller but will not apply to campaigns already planned prior to receiving the request;
• data provided to conclude and execute contracts for the purchase of goods or services will be retained until the conclusion of administrative-accounting formalities. Data related to invoicing will be retained for ten years from the date of invoicing as detailed in the Privacy Policy - Customers and Suppliers;
• browsing data will be stored as described in this policy and by third parties according to the Cookie Policy.
• users' data will be processed to the extent necessary to comply with regulatory obligations, resolve disputes, and enforce the Controller's internal regulations and policies, to strengthen security or improve the functionality of the website.

Personal user data that is no longer required, or for which a legal basis for storage no longer applies, will be irreversibly anonymized or securely destroyed.

8. Children's Data Protection

Gualapack's website, products and services are intended for a general audience and are not directed to children, including those under the age of fourteen (14). As such, we do not knowingly collect, use, solicit or disclose personal information about children under the age of 14. The Controller invites the user under the age of 14 not to access the website. If a parent or guardian of a child under the age of 14 believes that a minor user has disclosed personal information via this website, please contact the Controller. If the Controller becomes aware that it has collected personal information from persons under the age of 14 without verification of parental consent, Gualapack will take steps to remove such information from its servers.

9. Personal Data Security and cross-border transfer

Gualapack implements appropriate security measures and organizational safeguards to guarantee the protection, security, integrity and accessibility of the user's personal data, which are stored on protected IT tools (or appropriately archived hard copies), or on those of the Data Controller's suppliers, and are accessible and usable in accordance with its own security standards and policies (or equivalent standards for suppliers). Access to all personal information is restricted and limited to a few authorized personnel on a need-to-know basis. The servers are located within the European Economic Area (EEA). Any transfer of processed personal data outside the EEA will take place in accordance with the rights and safeguards provided by applicable law.

Users' personal data may be collected, transferred to and stored by the Data Controller in extra-EU countries and by our affiliates and third parties disclosed in Gualapack's Cookie Policy that are based in other countries. Therefore, users' personal data may be processed outside of their country or jurisdiction, including in places that are not subject to an adequacy decision by the European Commission or your local law or regulator, and that may not provide for the same level of data protection. The Controller ensures that the recipient of its website users' personal data offers an adequate level of protection and security, for example by entering into the appropriate back-to-back agreements and, if required, European standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission (art. 46 GDPR), or other applicable regulators or legislators. Where required by applicable law, the Controller will only share, transfer or store users' personal data outside their jurisdiction with their prior consent.

10. Users' Rights

Users may exercise their rights at any time (art. 15 et seq. GDPR) by sending an e-mail to the address privacy@gualapack.com, or by ordinary mail to Guala Pack S.p.A. via Carlo Mussa n. 266 - 15073 Castellazzo Bormida (Alessandria) - Italy. Users also have the right to lodge a complaint with a DPA, if they deem that the processing of their personal data is in violation of the provisions of the "Privacy laws".

Legal Notice Update

This website Privacy Policy is valid as of January 2025 and is subject to changes, corrections and updates; users are therefore invited to check its content regularly.