Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). Last updated: 7 October 2026. This is a translation: in case of discrepancy, the Italian version prevails.
Data controller
The data controller is ECS S.r.l., with registered office at Via di Pratignone 15/5, 50019 Sesto Fiorentino (FI), Italy, e-mail accounting@ecs.it (hereinafter “ECS” or the “Controller”).
The Controller uses the data to process registration requests and supply contracts for products/services purchased, to handle and carry out contact requests submitted by the Customer, to provide support, and to comply with the legal and regulatory obligations applicable to its business. ECS never sells the Customer’s personal data to third parties nor uses it for undeclared purposes.
Purposes and legal basis of processing
In particular, the Customer’s data will be processed for:
a) Registration and requests for contact and/or information material
The Customer’s personal data are processed to carry out the activities preliminary and subsequent to the registration request, to handle requests for information and contact (including through the forms on the website) and/or to send information material.
The legal basis for this processing is the performance of the services related to the request for registration, information and contact and/or the sending of information material (Art. 6(1)(b) GDPR).
b) Purposes related to the management of the contractual relationship
The data will be processed for: establishing, managing and terminating the contractual and commercial relationship resulting from the purchase of products/services, managing the related order, producing and/or shipping the product purchased and/or providing the service; fulfilling accounting and tax obligations; fulfilling legal obligations; tax and accounting checks; handling disputes; providing, supporting, updating and informing about the products offered.
The legal basis for this processing is the performance of the contractual relationship and compliance with legal obligations (Art. 6(1)(b) and (f) GDPR).
c) Purposes related to promotional activities
The data will be processed to send information/promotional material and information on activities and events in which ECS takes part or which it organises. This processing may take place, in an automated way, by e-mail and telephone.
The legal basis for this processing is the legitimate interest of the Controller (Art. 6(1)(f) GDPR). The Customer may object to this processing at any time by writing to the Controller.
d) Compliance with legal obligations
The data will be processed to comply with the legal obligations to which the Controller is subject (e.g. accounting, payroll and social security obligations, anti-terrorism checks). The legal basis for this processing is compliance with legal obligations (Art. 6(1)(c) GDPR).
Nature of the provision of data
Providing data for the purposes under a), b) and d) is optional, but necessary to fulfil legal and contractual obligations and to pursue the legitimate interests of the Controller indicated above. In all these cases, failure to provide the data will make it impossible for the Controller to establish business relations with the Customer. Providing data for the purpose under c) is optional, and failure to provide them will make it impossible for the Controller to carry out the activities needed to achieve that purpose.
Processing methods
Protecting its Customers’ data is a primary interest of ECS, which processes them according to the principles of fairness, lawfulness and transparency. Personal data will therefore be processed using tools and procedures that ensure maximum security and confidentiality, through paper archives and media, digital media, and IT and electronic means.
Retention period
The data will be kept for a maximum period equal to the limitation period of the rights that the Controller may enforce, as applicable from time to time. Regardless of the Customer’s decision to have them removed, personal data will in any case be kept according to the terms set out by the laws and/or national regulations in force, for the sole purpose of fulfilling those obligations.
Personal data will also be kept to fulfil obligations (e.g. tax and accounting) that remain after the termination of the contract (Art. 2220 of the Italian Civil Code); for these purposes the Controller will keep only the data necessary. This is without prejudice to cases in which rights arising from the contract and/or registration have to be enforced in court, in which case the Customer’s personal data, limited to those necessary for such purposes, will be processed for the time strictly needed.
Recipients of the data
The Customer’s personal data are communicated mainly to third parties and/or recipients whose activity is necessary to carry out the activities related to the relationship established and to comply with certain legal obligations, such as:
| Categories of recipients | Purpose |
|---|---|
| IT service providers (hosting, website maintenance, e-mail) | Technical management of the website and communications |
| Third-party suppliers* | Support, maintenance, delivery/shipping of products, provision of additional services related to the service requested |
| Credit and digital payment institutions, banks/postal institutions | Management of collections, payments and refunds related to the contract |
| External professionals/consultants and consulting firms | Compliance with legal obligations, exercise of rights, protection of contractual rights, debt recovery |
| Tax authorities, public bodies, judicial authorities, supervisory and control authorities | Compliance with legal obligations, defence of rights; lists and registers kept by public authorities or similar bodies under specific regulations, in relation to the contract |
| Persons formally delegated or with a recognised legal title | Legal representatives, receivers, guardians, etc. |
*The Controller requires its third-party suppliers and data processors to comply with security measures pursuant to Art. 32 GDPR. The Customer’s data will not be disclosed to the public.
Transfer of data outside the European Union
The Controller does not transfer the Customer’s personal data to countries where the GDPR does not apply (non-EU countries), unless otherwise specified, in which case the Customer will be informed and asked for authorisation.
Browsing data and cookies
During their normal operation, the IT systems and software procedures that run this website acquire some personal data whose transmission is implicit in the use of Internet communication protocols (for example IP addresses, date and time of the request, pages visited). These data are used only to ensure the correct operation and security of the website and are kept for the time strictly necessary.
Visit statistics (Matomo)
To understand in aggregate form how the website is used (most visited pages, where visits come from, internal searches), the Controller uses Matomo, installed on its own servers: the data are not transmitted to third parties or to analytics providers. Tracking takes place without cookies and the IP address is truncated (the last two bytes are removed) before being stored, so that the visitor cannot be identified. The legal basis is the Controller’s legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object to this collection at any time using the form below.
Visit statistics (Google Analytics)
Only if you accept it in the cookie banner (“Statistics” category), the website also uses Google Analytics 4, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to analyse in aggregate form how the website is used. Google Analytics sets the cookies _ga and _ga_* (maximum duration 2 years) and collects data such as pages visited, visit duration, device and browser type and approximate geographic location; Google Analytics 4 does not log IP addresses. Data sharing with other Google services is disabled and the data are kept for 2 months. The data may be transferred to the United States on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, in which Google LLC participates. The legal basis is consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the cookie settings below, without affecting the lawfulness of processing carried out before withdrawal. Google’s privacy policy: policies.google.com/privacy.
For information on the cookies used by the website, please see the Cookie Policy.
Rights of the data subject
Customers have the rights provided for, within the limits and in the cases set out, by Articles 15 to 22 GDPR. For example, each Customer may:
- obtain confirmation as to whether or not personal data concerning them are being processed;
- where processing is in progress, obtain access to the personal data and to information on the processing, and request a copy of the personal data;
- obtain the rectification of inaccurate personal data and the completion of incomplete personal data;
- obtain, where one of the conditions set out in Art. 17 GDPR applies, the erasure of personal data concerning them;
- obtain, in the cases set out in Art. 18 GDPR, the restriction of processing;
- receive the personal data concerning them in a structured, commonly used and machine-readable format and request their transmission to another controller, where technically feasible;
- object to processing based on the legitimate interest of the Controller, pursuant to Art. 21 GDPR.
The Customer may withdraw consent to the processing of their personal data at any time by sending a request to accounting@ecs.it, without this, however:
- affecting the lawfulness of processing based on consent given before its withdrawal;
- affecting further processing of the same data based on other legal grounds (for example, contractual or legal obligations to which ECS is subject).
Each Customer may also lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if they believe that their rights under the GDPR have been infringed, as indicated on the Authority’s website: www.garanteprivacy.it.
Changes to this notice
The Controller reserves the right to amend or update this notice. Any changes will be published on this page, with the date of the last update.