Personal Data Processing Notice
Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”), San Demetrio S.r.l. explains in this notice how it processes the personal data of users who visit www.sandemetriosrl.com, contact the company or subscribe to its newsletter.
This notice covers processing carried out through this website. External websites accessible through links have their own privacy notices.
Last updated: 15 October 2026
1. Data Controller
The data controller is:
San Demetrio S.r.l.
SP 374, Km 5 – 73040 Specchia (LE), Italy
VAT number: 03484290758
Email: info@sandemetriosrl.it
Telephone: +39 0833 539899
For information about the processing of personal data or to exercise your rights, please write to the email address above, using “Privacy” as the subject line.
2. Personal Data We Process
Browsing data
When you browse the website, its IT systems may collect technical data necessary for the operation and security of the service, such as your IP address, the date and time of requests, the resources requested, browser and operating system information, request outcomes and any errors.
These data may be recorded in technical logs.
Data you provide
When you complete a form or contact the company by email or telephone, we process the information you provide, such as your first name, surname, email address, telephone number and the content of your communication.
For commercial enquiries, quotations, distribution opportunities or Private Label projects, we may also process your company name, professional role and other business information necessary to handle your enquiry.
Please provide only relevant information and avoid including health data or other particularly sensitive information that is not necessary to handle your request.
Newsletter data
If you subscribe to the newsletter, we process your email address, any additional information requested in the subscription form, and the information necessary to document your subscription, consent and any subsequent withdrawal of consent.
Cookies and other tracking technologies
Information about cookies and any analytics or tracking technologies is provided in the [Cookie Policy – insert link], which describes the services used, their purposes, their duration and how to manage your preferences.
3. Purposes and Legal Bases for Processing
Handling enquiries and communications
We use personal data to respond to messages, provide information about products and services, and handle requests for quotations, business partnerships and Private Label projects.
Where an enquiry concerns a potential contractual relationship with you, the legal basis is taking steps at your request before entering into a contract, pursuant to Article 6(1)(b) GDPR.
For other communications, including those from company representatives, processing is based on the controller’s legitimate interest in managing correspondence and professional relationships, pursuant to Article 6(1)(f) GDPR, while respecting the rights of the individuals concerned.
Sending an enquiry does not automatically subscribe you to the newsletter.
Sending newsletters and promotional communications
With your consent, we use your data to send newsletters, product updates, company news, information about initiatives and promotional communications from San Demetrio by email.
The legal basis is consent, pursuant to Article 6(1)(a) GDPR.
Consent is optional and may be withdrawn at any time by using the unsubscribe link included in our emails or by contacting the controller. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Withholding consent does not prevent you from browsing the website, requesting information or entering into a commercial relationship.
Website operation and security
Technical data are processed to display website pages, maintain the website’s operation, identify faults and prevent unauthorised access, fraud and other unlawful activities.
The legal basis is the controller’s legitimate interest in ensuring the security and operation of its systems, pursuant to Article 6(1)(f) GDPR.
Access to information stored on your device is also subject to the specific rules governing cookies and other tracking technologies.
Compliance with legal obligations
Personal data may be processed to comply with legal obligations or binding requests from competent authorities.
The legal basis is Article 6(1)(c) GDPR.
Protection of legal rights
Where necessary, personal data may be used to establish, exercise or defend legal claims, whether in or out of court.
The legal basis is the controller’s legitimate interest in protecting its rights, pursuant to Article 6(1)(f) GDPR.
4. Providing Your Data
You may choose whether to provide your personal data.
Fields marked as mandatory in our forms are necessary to handle your enquiry. Failure to complete them may prevent you from submitting the form or receiving a response from the company.
Providing other information is optional.
Providing your email address and consenting to the relevant processing are necessary to receive the newsletter. Refusing to do so means only that you will not be subscribed to this service.
Technical data essential for communication and website security are collected during browsing.
5. How We Process Personal Data
Personal data are processed primarily using electronic and online systems and, where necessary, on paper.
San Demetrio implements technical and organisational measures appropriate to the risks to protect personal data against unauthorised access, loss, alteration and unlawful disclosure.
Access is restricted to authorised individuals and service providers who need it to perform their duties, within the scope of the instructions they receive and their applicable obligations.
6. Recipients of Personal Data
For the purposes described above, personal data may be disclosed to:
the controller’s authorised staff and collaborators;
providers of hosting, IT infrastructure, email and technical support services;
providers of newsletter management and delivery services;
professional advisers and consultants, where necessary to meet legal obligations or protect legal rights;
public authorities and bodies where required by law.
Parties processing personal data on behalf of the controller are appointed as data processors pursuant to Article 28 GDPR. Other recipients may act as independent data controllers, depending on the service provided and their actual role.
You may contact the controller to request up-to-date information about recipients and data processors.
Personal data collected through forms and newsletter subscriptions are not intended for publication.
7. Transfers Outside the European Economic Area
Where personal data are transferred to countries outside the European Economic Area, the controller ensures compliance with the conditions set out in Chapter V GDPR.
Depending on the service, a transfer may be based on an adequacy decision adopted by the European Commission or on appropriate safeguards, such as standard contractual clauses, together with any necessary supplementary measures.
You may contact the controller for information about the applicable safeguards and how to obtain a copy, subject to the limitations provided by law.
8. Data Retention
Personal data are retained for periods proportionate to the purposes for which they were collected.
Specifically:
Enquiries and correspondence: for as long as necessary to handle the enquiry and subsequently for one year after it has been closed.
Enquiries resulting in a commercial relationship: for as long as necessary to manage the relationship and for any subsequent periods required by applicable legal obligations, as described in any separate privacy notices.
Newsletter: until consent is withdrawn or the service ends, with periodic reviews of whether retaining the data remains necessary.
Evidence of consent and management of unsubscribe requests: limited to the data necessary for these purposes.
Technical and security logs: for one year, unless further retention is necessary to investigate incidents or protect legal rights.
Cookies and tracking technologies: for the periods specified in the Cookie Policy.
In the event of disputes or requests from authorities, relevant data may be retained for as long as necessary to address those matters.
At the end of the applicable retention periods, personal data are deleted or anonymised. Backup copies are deleted in accordance with their respective retention cycles.
9. Cookies, Analytics and Third-Party Content
The website may use technologies necessary for its operation and, where enabled, additional services described in the Cookie Policy.
Where required by law, non-essential cookies and other tracking technologies are used only after you have given your consent.
Links to the company’s social media profiles lead to external platforms. Activities carried out on those platforms are also subject to the privacy notices of their respective operators.
10. Your Rights
Subject to the conditions and limitations set out in the GDPR, you may:
obtain confirmation of whether your personal data are being processed and access those data;
request the correction of inaccurate data and the completion of incomplete data;
request the erasure of your data;
request the restriction of processing;
receive your data in a structured, commonly used and machine-readable format and transmit them to another controller, where the conditions for data portability are met;
object, on grounds relating to your particular situation, to processing based on legitimate interests;
object at any time to processing for direct marketing purposes;
withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Requests may be sent to info@sandemetriosrl.it.
The controller will respond without undue delay and normally within one month of receiving the request. Where permitted by the GDPR, this period may be extended by a further two months. In that case, you will be informed within the first month, together with the reasons for the extension.
Where there are reasonable doubts about the identity of the person making the request, we may ask for only the additional information necessary to verify their identity.
You may also lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali, following the procedures available at https://www.garanteprivacy.it, or with another competent supervisory authority pursuant to Article 77 GDPR.
11. Automated Decision-Making
Within the processing activities described in this notice, San Demetrio does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Any profiling carried out through marketing technologies, where actually performed, must be specifically described and accompanied by the information and choices required by applicable law.
12. Updates to This Notice
This notice may be updated to reflect changes to our services, processing activities or applicable legislation.
The updated version will be published on this page with the relevant revision date. Where necessary, changes will also be communicated through other appropriate channels.