Personal data policy

Notice on the Processing of Personal Data collected through this website
Last revised: 11 August 2026

1. Introduction and regulatory references
This notice describes the processing of personal data collected through this website, including data acquired by means of cookies, tracking technologies and - where present - contact forms and any other features that may be active on the site.
This notice is addressed to anyone who accesses or uses this website, describing how the user’s personal data is collected, used and protected, as well as the rights granted by law.
These provisions do not concern other websites, pages or online services accessible through external links that may be present on the site, in respect of which you are invited to consult the relevant privacy notices.
This notice is provided in compliance with the principal national and international regulations on the protection of personal data, including:

  • Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
  • UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Privacy and Electronic Communications Regulations (PECR) and Data (Use and Access) Act 2025 (DUAA)
  • Swiss Federal Act on Data Protection (nFADP / FADP)
  • Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
  • Brazilian General Personal Data Protection Law (LGPD)
  • California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
  • Colorado Privacy Act (CPA)
  • Connecticut Data Privacy Act (CTDPA)
  • Delaware Personal Data Privacy Act (DPDPA)
  • Minnesota Consumer Data Privacy Act (MCDPA)
  • Montana Consumer Data Privacy Act (MTCDPA)
  • Nebraska Data Privacy Act (NDPA)
  • Nevada Privacy Law (NRS 603A)
  • New Hampshire Privacy Act (NHPA)
  • New Jersey Data Privacy Act (NJDPA)
  • Oregon Consumer Privacy Act (OCPA)
  • Tennessee Information Protection Act (TIPA)
  • Texas Data Privacy and Security Act (TDPSA)
  • Utah Consumer Privacy Act (UCPA)
  • Virginia Consumer Data Protection Act (VCDPA)
  • Other regulations that may be applicable.

2. Who manages your data and how can you contact us?
Your personal data is processed by:
SILMAR srl
 Via Ravizza 22, 56121 Pisa (PI)
 info@silmar.pisa.it
 VAT ID: 02303820506

For any information concerning the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.

For Brazil, to exercise your rights and for communications with the ANPD, you may use the Data Controller’s contact details indicated in this section.

3. On what legal bases do we process your data?
The processing of personal data collected through this site (including data collected by means of cookies, similar technologies, contact forms and any other features that may be active on the site) is based on one or more of the following legal bases:

  1. Performance of pre-contractual or contractual measures: where processing is necessary to respond to user requests, provide requested services and, where the site so provides, manage orders, accounts or contractual relationships.
  2. Compliance with legal obligations: where processing is necessary to comply with tax, accounting, administrative or security obligations or with requests from the authorities.

The Data Controller may also process the necessary data on the basis of its own legitimate interest, pursuing interests consisting in the security of the site, the prevention of abuse and fraud and the protection of its rights in legal proceedings. The user may in any case object to the processing in accordance with the applicable legislation, in the cases provided for by Article 21 GDPR.

For non-essential cookies and tracking tools - such as those for non-anonymized analytics, profiling or marketing - the processing is based on the user’s consent in the jurisdictions where such consent is required by the applicable legislation. The related methods of giving, managing and withdrawing it are described in the Cookie Policy.

Additional rules and rights for US jurisdictions:
Where laws such as the CCPA/CPRA (California), CPA (Colorado), CTDPA (Connecticut), DPDPA (Delaware), MCDPA (Minnesota), MTCDPA (Montana), NDPA (Nebraska), NRS 603A (Nevada), NHPA (New Hampshire), NJDPA (New Jersey), OCPA (Oregon), TIPA (Tennessee), TDPSA (Texas), UCPA (Utah), VCDPA (Virginia), as well as other US state laws on the protection of personal data, are applicable, the following principles also apply:

  • Opt-out: in the cases and within the limits provided for by the applicable legislation, the user may exercise the opt-out from the sale of personal data, from its sharing or from processing for targeted advertising and from profiling in furtherance of decisions that produce legal or similarly significant effects, through the dedicated opt-out functions and the Global Privacy Control (GPC) signal, whose effects are described in the Cookie Policy; the “Unsubscribe” link concerns the cessation of marketing communications.

Additional legal bases for Brazil (LGPD):
Where processing falls within the scope of the LGPD, further legal bases provided for by Article 7 of the LGPD may also apply, solely where the relevant conditions are met and in relation to the activities actually carried out by the Data Controller, including:

  • Credit protection: where necessary for this purpose, data may be processed, for example, to assess the data subject’s ability to meet financial obligations and the related risk of default, in compliance with the applicable legislation.
  • Regular exercise of rights: data may be processed for the regular exercise of rights in judicial, administrative or arbitration proceedings.

Failure to accept or the withdrawal of consent may limit certain features or services of the site.

The provision of data supplied directly by the user is generally optional, except for any data indicated as mandatory in the individual forms or where it is required by a legal or contractual obligation or is necessary to perform a contract or pre-contractual measures requested by the user; in such cases, failure to provide it may make it impossible to follow up on the request or to deliver the service. Technical navigation data is in any case collected automatically and is necessary for the functioning of the site.

4. What data do we collect when you visit the site?
While browsing this site, the following data may be collected, including by means of cookies and similar technologies such as pixel tags, web beacons, local storage and equivalent technologies, namely:

  • Navigation and technical data: information such as IP address, device identifiers, data relating to the operating system and browser, requested URLs, connection times, technical logs, technical preferences, and usage data collected through cookies and tracking technologies (pixel tags, web beacons, local storage and equivalent tools).

  • Identifying data provided voluntarily: information entered in the digital forms on the site (e.g. first name, last name, e-mail, telephone) and/or provided by sending e-mails or through other contact channels, used to respond to requests, provide services and any consultations.

5. How do we process your data, how do we protect it and how long do we keep it?
The personal data collected through this site is processed mainly by electronic and digital means in accordance with the principles of lawfulness, fairness, data minimization, integrity and confidentiality.

Appropriate technical and organizational measures are adopted to prevent unauthorized access, loss, alteration or unauthorized disclosure of data, including:

  • Encryption of communications (https): communications between your browser and the site are protected by HTTPS encryption, a measure aimed at reducing the risk of interception or manipulation of the data transmitted during browsing;
  • Periodic backups: data is copied and stored periodically to protect it from any accidental loss or technical incidents;

Data is retained according to the following timeframes:

  • Cookie preferences and consents: retained for 180 days, as set out in the Cookie Policy on this site.
  • Navigation and technical data: retained for the time strictly necessary for security purposes and, as a rule, no longer than 12 months, after which it is deleted or anonymized, save for longer periods imposed by legal obligations or by the need to establish, exercise or defend a right in legal proceedings.
  • Data connected to any contractual relationships established with the Data Controller: where they exist, it is retained for the duration of the relationship and, thereafter, for the time required by the applicable legal obligations (for example in accounting and tax matters).
  • Data entered through forms or specific requests: retained for the time necessary to respond to the request and to fulfill the related purpose, and thereafter for any period required by legal obligations.

6. Who can receive your data?
The following may access the personal data collected through this site, within the limits of their respective responsibilities and purposes:

  • Authorized internal persons designated by the Data Controller, duly instructed on privacy and security matters;
  • Suppliers and third parties appointed as Data Processors (for example: technical providers and IT services, site maintenance, e-mail providers, consultants, where applicable);
  • Third parties that provide services integrated into the site (e.g. fonts, maps, image display), which may process technical data as independent controllers in accordance with their own notices (in which case please also consult the individual notices of such third parties);
  • Competent public authorities and supervisory bodies, within the limits imposed by law or in order to comply with requests from the judicial authority;

The updated list of external recipients can be made available on request by writing to the Data Controller’s contact details.

7. Where can your data be transferred?
The personal data collected through this site is processed, as a rule, in the country where the Data Controller is established and at the service providers it uses. Where data is transferred or made accessible outside the relevant territory under the applicable legislation, the transfer takes place by means of one of the mechanisms it permits, including adequacy decisions, appropriate or suitable safeguards and, where applicable, derogations or other conditions provided for by the applicable legislation. For transfers subject to the GDPR, the relevant territory is the European Union / European Economic Area and, in particular, the EU-U.S. Data Privacy Framework, limited to certified organizations, and the Standard Contractual Clauses adopted by the European Commission are relevant. Information on the applicable mechanism and, where provided for, a copy of the relevant safeguards, possibly redacted in the confidential parts, may be requested at the Data Controller’s contact details.

For transfers subject to the UK GDPR, lawfulness is based on the United Kingdom’s adequacy decisions (for the United States, the UK Extension to the EU-US Data Privacy Framework, the so-called “UK-US Data Bridge”, limited to certified providers) or on appropriate safeguards such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses, subject to a positive outcome of the “data protection test” (transfer risk assessment, or “TRA”), carried out in a reasonable and proportionate manner given the circumstances of the transfer, to verify that the level of protection is not materially lower than that guaranteed in the United Kingdom.

For transfers subject to the LGPD, the following are relevant, where applicable to the transfer actually carried out: the decision by which the ANPD recognized the level of personal data protection of the European Union as adequate (Resolução CD/ANPD No. 32 of January 26, 2026) and, for other countries, the standard contractual clauses approved by the ANPD (Resolução CD/ANPD No. 19 of August 23, 2024) or the other mechanisms provided for by Article 33 of the LGPD.

For disclosures abroad subject to the FADP, the following are relevant: the list of countries with adequate protection established by the Federal Council (Annex 1 to the Swiss Data Protection Ordinance), which for the United States includes only organizations certified under the Swiss-U.S. Data Privacy Framework, and, for other countries, the standard contractual clauses approved, issued or recognized by the FDPIC or the other safeguards and exceptions provided for by Articles 16 and 17 of the FADP.

Countries to which transfers may take place: Israel.

8. What are your rights regarding the data collected?
The user, under the applicable legislation, has the right to:

  • Obtain confirmation as to whether or not personal data concerning them is being processed and, if so, obtain access to that data and the related information (right of access).
  • Request the rectification, updating or erasure of data that is inaccurate or no longer necessary (right to rectification and erasure).
  • Request the restriction of processing or object, for reasons connected with your particular situation, to processing based on the Data Controller’s legitimate interest, subject to the existence of the conditions provided for by Article 21 GDPR.
  • Receive, in the cases and under the conditions provided for by the applicable legislation, the personal data concerning you in the format required by it and obtain its transmission to another controller or provider; for the EU/EEA and the UK, the right concerns the data you have provided, the format is structured, commonly used and machine-readable and direct transmission is carried out where technically feasible (right to data portability).
  • Withdraw at any time any consent given, without affecting the lawfulness of processing based on consent carried out before the withdrawal (for example for the sending of commercial communications or newsletters, where active).
  • Withdraw the consent given to the use of non-essential cookies and to the processing of data collected through tracking tools.
  • In Canada, where PIPEDA or the relevant provincial legislation applies, withdraw consent to the collection, use or disclosure of personal information in the manner and within the limits provided for by the applicable law; where PIPEDA applies, with reasonable notice and subject to legal or contractual restrictions.
  • Report any irregularities or abuses to the competent supervisory authorities.

In Italy, the rights concerning the personal data of deceased persons may be exercised, within the limits of Article 2-terdecies of the Privacy Code, by anyone who has a personal interest, acts to protect the data subject as an agent or invokes family reasons worthy of protection.

In Brazil, in the cases provided for by the LGPD, you may also: obtain the anonymization, blocking or deletion of unnecessary or excessive data or of data processed in violation of the LGPD; request the deletion of data processed on the basis of consent, except where the law permits its retention; know the public and private entities with which the Data Controller has shared the data; receive information about the possibility of not giving consent and about the consequences of refusal; object to processing based on a legal basis other than consent, if it is carried out in violation of the LGPD; request a review of decisions made solely on the basis of automated processing that affects your interests, including profiling decisions, and receive clear information about the criteria and procedures used, subject to commercial and industrial secrets; file a petition with the ANPD and, where applicable, with consumer protection bodies.

Rights of US residents

If you reside in one of the states listed in section 1 and the relevant law applies to the Data Controller, you may exercise, depending on the applicable law, one or more of the following rights regarding your personal data:

  • confirm whether your data is being processed and access it;
  • obtain a copy of it in a portable format;
  • correct inaccurate data;
  • obtain its deletion;
  • opt out of the sale, the sharing or the processing for targeted advertising;
  • object, where provided for, to profiling or to the use of automated decision-making technologies for decisions with legal or similarly significant effects;
  • where applicable, limit the use and disclosure of sensitive personal data;
  • not receive discriminatory or retaliatory treatment for exercising these rights, except as permitted by the applicable law.

Minnesota: you have the right to obtain the list of the specific third parties to which the Data Controller has disclosed your personal data; if the Data Controller does not maintain this information for each consumer, it may provide you with the list of the specific third parties to which it has disclosed the personal data of any consumer. In the case of profiling in furtherance of decisions with legal or similarly significant effects, you have the right to question the result, to be informed of the reasons for it and, where possible, to know what actions you could have taken or could take to secure a different decision; you may also review the personal data used and, if the decision was based on inaccurate data, have that data corrected and obtain a new evaluation based on the corrected data.

Oregon: you have the right to obtain, at the Data Controller’s option, either the list of the specific third parties, other than natural persons, to which your personal data has been disclosed, or the list of the specific third parties to which the personal data of any consumer has been disclosed.

Connecticut: you have the right to obtain the list of the third parties to which the Data Controller has sold your personal data or, if the Data Controller does not maintain such a list for each consumer, the list of all third parties to which it has sold personal data, unless doing so would require disclosing trade secrets. If your personal data has been used for profiling in furtherance of an automated decision with legal or similarly significant effects, you have the right, where possible, to question the result, to be informed of the reasons for it and to review the personal data used; if the decision concerns housing, you also have the right to correct any inaccurate data used and to obtain a new evaluation based on the corrected data.

Nevada consumers: you may request that the Data Controller not make any sale, as defined by Nevada law, of covered information collected or to be collected about you, by sending a verified request to the Data Controller using the contact details indicated in section 2; the email address designated for such requests is info@silmar.pisa.it. Using the same contact details, you may request to review, and request changes to, the covered information about you, in the manner described in this section. The third parties that provide the tools listed in the Cookie Policy may collect information about your online activities over time and across different websites or online services when you use this site.

To exercise these rights, it is sufficient to send a request to the Data Controller’s contact details. The Data Controller will respond without undue delay and within the time limits provided for by the applicable legislation. For requests subject to the GDPR or the UK GDPR, a response is provided within the ordinary period of one month, calculated in accordance with the applicable legislation; that period may be extended by a further two months, taking into account the complexity and number of the requests, and the data subject is informed of the extension and the related reasons within the ordinary period.

In the United Kingdom, the time limit for responding may be paused where the Data Controller reasonably requests the information needed to confirm the user’s identity or to clarify the subject of the request; the Data Controller carries out reasonable and proportionate searches in order to comply with access requests.

For requests subject to US state laws, unless different time limits are indicated in this notice for specific laws or requests, the Data Controller responds without undue delay and in any case within 45 days of receipt; where permitted by the applicable law, this period may be extended once by an additional 45 days, in which case you will be informed of the extension and the reasons for it within the initial period. Where NRS 603A applies, the Data Controller responds to a verified request not to sell within 60 days of receipt; where reasonably necessary, this period may be extended by up to an additional 30 days, in which case you will be informed of the extension. If the Data Controller declines your request in whole or in part, it will inform you of the reasons. If the applicable state law provides for a right to appeal, you may submit an appeal within a reasonable period after the response, using the same channels indicated for exercising your rights and stating that it is an appeal. The Data Controller will inform you in writing of its decision on the appeal, with the reasons, within the period set by that law and, if the appeal is denied, will provide you with the information or mechanism required by that law to submit a complaint to the competent state authority.

Brazil (LGPD): as a rule, confirmation of the existence of processing or access to the data is provided immediately in simplified form or, upon request, through a clear and complete statement within 15 days of the request; different time limits may apply in the cases provided for by the regulations.

Switzerland (FADP): the information requested in the exercise of the right of access is generally provided within 30 days of receipt of the request; if this is not possible, the Data Controller will inform you within the same period, indicating when it will provide the information.

Canada (PIPEDA): the Data Controller responds to written access requests within 30 days of receipt; this period may be extended in the cases provided for by law, in which case you will be informed, within the first 30 days, of the new time limit, the reasons for the extension and your right to file a complaint with the Privacy Commissioner of Canada.

9. How is minors’ data processed?
The protection of minors is a fundamental priority.

This site is not directed at minors and does not intentionally collect their data through its forms. Where, in the context of a request or query, the user provides personal data relating to third parties - including any minors - they must ensure that they are authorized to do so; such data will be processed within the limits and for the purposes of the request, in compliance with the applicable legislation. For requests for rectification, restriction or erasure, you may write to the Data Controller’s contact details.

If and to the extent required by an applicable US state law, the Data Controller does not sell or share the personal data of minor consumers and does not process it for targeted advertising or for the forms of profiling prohibited by that law, where the age knowledge standard set by that law is met. Any processing takes place only with the authorization of the minor or of the parent or guardian, where the law permits and requires it; the non-waivable prohibitions set by the applicable law remain in effect. For children under 13, the Data Controller complies with COPPA where it applies.

10. How can you make reports or complaints to the authorities?
If you believe that the processing of your personal data through this site does not comply with the applicable legislation, you may contact the competent authorities indicated below free of charge, in accordance with the applicable legislation, including by lodging a complaint pursuant to Article 77 of the GDPR:

For users in the United Kingdom, it is possible to make a data protection complaint to the Data Controller, who will acknowledge receipt within 30 days and take appropriate steps to respond to the complaint without undue delay according to a documented procedure, informing the data subject of the progress and outcome. This is without prejudice to the right to approach the competent UK supervisory authority.

11. How do we inform you of changes to this notice?
This notice is subject to periodic revision to reflect regulatory changes or modifications to the services offered through the site. Any significant change will be communicated through this page. For Minnesota consumers, when the Data Controller makes a material change to this notice or to its processing practices, it takes reasonable electronic measures to notify affected consumers, with respect to personal data collected after the change, and gives them a reasonable opportunity to withdraw consent to any further materially different collection, processing or transfer of previously collected personal data. For Connecticut consumers, in the event of material changes with retroactive effect, the Data Controller takes reasonable electronic measures to notify affected consumers and gives them a reasonable opportunity to withdraw consent to any further materially different collection, processing or transfer of previously collected personal data.
Last revised: 11 August 2026