Privacy policy

THE PRIVACY POLICY OF THE RUPES WEBSITE

This page describes how the website of RUPES S.p.A. (single-member company) (“RUPES”), accessible at www.rupes.com (hereinafter, the “Website”), is managed with regard to the processing of the personal data of users who register on the Website to access content reserved for registered users and to subscribe to the newsletter service provided by RUPES.

This notice applies only to the Website (including subdomains such as download.rupes.com) and not to any other websites the user may visit through links on the Website.
This notice is also provided pursuant to Article 13 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), to those who interact with RUPES web services. The notice is also based on Recommendation No. 2/2001, adopted on 17 May 2001 by the European data protection authorities meeting in the Working Party established by Article 29 of Directive 95/46/EC, to set certain minimum requirements for the online collection of personal data and, in particular, the methods, timing and nature of the information that data controllers must provide to users when they connect to web pages, regardless of the purpose of the connection.

In any case, the processing of Website users’ personal data will be based on the principles of fairness, lawfulness and transparency and on the protection of the confidentiality and rights of the data subject, in accordance with the GDPR, any applicable national legislation and the guidance of the Italian Data Protection Authority (Garante per la protezione dei dati personali).

1. Data Controller
Data relating to identified or identifiable natural persons may be processed as a result of visiting this Website.

The Controller of such processing is RUPES S.p.A. (single-member company), with registered office at Via Manfredo Camperio 9, 20123 Milan (MI), Italy, and operational headquarters at Via Marconi 3A, 20080 Vermezzo, Vermezzo con Zelo (MI), Italy, VAT No. 05094230157 (hereinafter “RUPES” or the “Controller”).

2. Place of Data Processing and Recipients
Processing related to the Website services takes place in Italy at the above-mentioned RUPES premises and is handled only by specifically authorised personnel, or in Europe (France) at the premises of the company that manages RUPES servers. RUPES does not transfer data to third countries outside the EEA.

Should suppliers located outside the EU or the EEA be used, RUPES will adopt the safeguards required by the applicable legislation on international transfers of personal data.

The data is or may be disclosed to the following recipients (appointed as data processors pursuant to the GDPR):

• other companies of the business group to which RUPES belongs, based within the EU;
• parties providing RUPES with Website hosting, maintenance and update services (only where such disclosure is strictly necessary to provide the services requested by the user), newsletter delivery services, etc.;
• providers of consultancy services on tax matters, where required by the type of processing carried out (e.g. where the user purchases RUPES goods or services that give rise to tax obligations);
• other categories of parties to whom RUPES must disclose personal data in order to perform contracts and/or respond to requests between RUPES and the user, to comply with legal obligations, or at the request of the authorities.

3. Types of Data Processed
Browsing data
During their normal operation, the computer systems and software procedures used to run the Website acquire certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category includes, for example, the IP addresses or domain names of the computers used by users connecting to the Website, the URI addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response, and other parameters relating to the user’s operating system and IT environment.
This data is used mainly to obtain anonymous statistical information on the use of the Website and to check that it is functioning correctly. Except where necessary to establish liability in the event of hypothetical computer crimes against the Website, data on web contacts is kept for the time strictly necessary for the above purposes and, in any case, no longer than the period indicated in section 8 below.

Data voluntarily provided by the user
Completing the registration procedure and the optional, explicit and voluntary sending of emails to the addresses indicated on the Website entail the acquisition and processing of the data subject’s personal data, which is necessary to allow access to the reserved content on the Website, to provide the requested newsletter service, or to respond to requests made by email or through contact platforms available on the Website.

In particular, the RUPES download centre may collect the user’s first name, surname, company name, contact information, email address and the business sector in which the user operates.

Specific summary notices will be progressively provided or displayed on the Website pages set up for particular on-demand services.

Data processed in connection with newsletters
Subscribing to the newsletter involves the processing of the email address and any other data provided by the data subject in order to send information, updates, promotional and commercial communications, newsletters and invitations to events relating to RUPES products and services.

As a general rule, commercial communications are sent by email only with the prior consent of the data subject, which must be freely given, specific, informed and relate to a clearly identified purpose.

Consent to receive the newsletter is separate from any consent that may be requested for other purposes, such as the use of cookies or tracking tools in electronic communications. Refusing consent to marketing or tracking does not prevent the data subject from using the website or interacting with the Services offered, where the processing is not necessary for those activities.

Tracking pixel
Where the data subject has given specific consent, newsletters may contain a tracking pixel, also known as a “web beacon” or “pixel tag”.

A tracking pixel is a very small graphic element, usually invisible, embedded in the body of an email. It contains or calls a link to a resource, generally an image file, hosted on a server. When the image is loaded by the program or device used to read the email, the device may establish a connection with the server and transmit certain information relating to the viewing of the message.

Where technically available, the use of the tracking pixel may make it possible to detect:

• whether and when the newsletter was opened;
• the number of times the message was opened;
• the device, operating system or program used;
• the IP address or technical information associated with the viewing;
• interaction with specific content or links contained in the newsletter.

This information is used to assess the effectiveness of newsletters, understand which content is viewed most, improve the communications sent and, where provided for and authorised, carry out statistical analysis or personalisation activities.

The use of the tracking pixel for individual open-rate measurement, behavioural analysis or personalisation is subject to the prior, freely given, specific, informed and unambiguous consent of the data subject, collected separately from the consent to receive the newsletter.

The data subject may refuse or withdraw consent to the use of the tracking pixel at any time, without affecting the possibility of continuing to receive the newsletter, where technically possible, in a version without this tool.

Consent may be withdrawn by following the instructions contained in each newsletter.

Cookies
No personal data of users is acquired by the Website in this respect.

Cookies are not used to transmit personal information, nor are persistent cookies of any kind (except as specified below) or user tracking systems used.

The use of session cookies (which are not stored persistently on the user’s computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to allow safe and efficient browsing of the Website.

The session cookies used on this Website avoid the use of other computer techniques that could potentially compromise the confidentiality of users’ browsing, and do not allow the acquisition of personal data identifying the user.

If the user chooses to stay logged in to the Website, a cookie that helps keep the session open may be stored on their computer.

Geolocation cookies. This Website uses a system to determine the location from which the User is accessing it and to automatically select the language to display. A cookie containing this data may be stored on the user’s computer.

Third-party cookies. This Website may use third-party cookies to facilitate the use of services provided by other websites, such as displaying videos uploaded to YouTube, based on the user’s choice to use those services and/or view those videos.

4. Purposes of Processing
Personal data is collected and processed by RUPES for the following purposes:

a) to allow users to browse the Website easily and securely;
b) where the user decides to register on the Website, to allow them to download the materials available in the download centre;
c) to provide the newsletter service requested by the user from RUPES;
d) to send commercial and promotional communications, where the data subject has given the necessary consent or one of the specific cases provided for by applicable law applies;
e) subject to specific consent, to analyse interactions with newsletters by means of tracking pixels, in order to measure the effectiveness of communications and improve the content sent;
f) to provide the service, requested by the user, of contact with RUPES or its distributors;
g) to comply with laws, regulations or European Union legislation.

5. Legal Bases for Processing
The processing of personal data carried out by RUPES for the purposes indicated above is based on the following legal grounds:

• Article 6(1)(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract, for example to allow access to reserved content or to provide an expressly requested service;
• Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation to which the Controller is subject;
• Article 6(1)(a) GDPR: processing is based on the freely given and informed consent of the data subject, as in the case of promotional communications and, where applicable, the use of the tracking pixel and tools for the individual measurement of interactions. For commercial or promotional communications sent by email, consent may be withdrawn at any time through the preference centre, accessible via the link in the footer of each newsletter. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal;
• Article 6(1)(f) GDPR, only where applicable and where consent is not required by specific legislation: processing is necessary for the purposes of a legitimate interest of RUPES, duly balanced against the rights and freedoms of the data subject, for example for system security, abuse prevention or the technical management of communications.

6. Optional or Mandatory Nature of the Provision of Data
The provision of data necessary to fulfil contractual or pre-contractual obligations, to allow access to reserved content or to comply with legal obligations is mandatory. Refusal may result in the requested services not being provided, or being provided only in part.

The provision of data for sending promotional communications is optional. Failure to give consent will only mean that the promotional communications for which consent is required will not be received.

Consent to the use of the tracking pixel and to the individual monitoring of interactions with newsletters is optional and, in its effects, separate from the possibility of receiving promotional communications without a tracking pixel. The recipient may therefore choose to:

• receive newsletters with the tracking pixel;
• receive newsletters without the tracking pixel, where technically possible;
• stop receiving promotional newsletters.

Consent to the tracking pixel may be withdrawn at any time through the preference centre.

Withdrawal is free of charge and does not affect the lawfulness of processing carried out before it was received.

7. Processing Methods
Personal data is processed using automated and non-automated tools for the time strictly necessary to achieve the purposes for which it was collected.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

RUPES adopts appropriate technical and organisational measures to prevent data loss, unlawful or incorrect use and unauthorised access. Please note that anything the data subject transmits or provides online may be collected and used by others or unlawfully intercepted by third parties. No data transmission over the Internet can be guaranteed to be 100% secure. RUPES undertakes to use commercially reasonable means to protect data subjects’ information, but cannot guarantee the complete security of the information exchanged.

The RUPES download centre is password-protected. Disclosing the password to anyone is prohibited. RUPES will never ask registered users for their password by email. Should the user ever receive such a request, please inform RUPES immediately. The registered user is solely responsible for keeping their authentication credentials confidential.

8. Data Retention Period
The user’s personal data is kept for the period strictly necessary to achieve the specific purposes of processing referred to in section 4 and, specifically:
Data relating to registration, access to reserved content and the supply of goods and/or services requested by the user is processed for the period necessary to fulfil pre-contractual and contractual obligations and, in any case, no longer than the limitation period established by Italian law for rights (in contractual and/or non-contractual liability) connected with the supply of such goods and/or services.

The data will also be processed for the time necessary to fulfil legal or regulatory obligations (e.g. obligations to retain data and documentation for tax purposes) and is kept for the period required by the laws and regulations applicable to those obligations of the Controller from time to time.

Where personal data is processed in pursuit of a legitimate interest of the Controller, such processing will continue for as long as that legitimate interest exists, or until you request that your data no longer be processed for that purpose.

Where personal data is processed on the basis of the user’s consent, such processing will last no longer than 48 (forty-eight) months from the date the user gave consent. Processing ends when the data subject withdraws consent, except for the limited retention of data necessary to document the withdrawal, comply with legal obligations or protect the Controller’s rights.

In particular, data relating to newsletter subscriptions will be retained until consent is withdrawn or erasure is requested, unless retention is necessary to comply with legal obligations or to establish, exercise or defend legal claims.

Data relating to opens, interactions and other activities detected through tracking pixels, to tracking pixel load requests, and to preferences expressed in the preference centre is kept for the period strictly necessary to measure and improve newsletters and, where possible, will subsequently be aggregated or anonymised. In any case, such data will not be kept in identifiable form for longer than necessary for the purposes for which it was collected.

9. Data Subject Rights
The data subject may at any time exercise the rights provided for by Articles 15 to 21 of the GDPR and, in particular, may request:

• confirmation as to whether or not personal data concerning them exists;
• access to the personal data and to information about the processing;
• rectification of inaccurate data or completion of incomplete data;
• erasure of the data, in the cases provided for by law;
• restriction of processing;
• portability of personal data, where applicable;
• to object to processing, in particular for direct marketing purposes;
• to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To stop receiving newsletters or promotional communications, the data subject may use the unsubscribe link included in every communication, or withdraw consent to data tracking through the Preference Centre.

To exercise their other rights, the data subject may contact the Controller at the addresses indicated in this notice.

10. Complaint to the Supervisory Authority
The data subject has the right to lodge a complaint with the Supervisory Authority if the requests for information addressed to the Controller have not received a satisfactory response.

The competent authority is the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): https://www.garanteprivacy.it/web/guest/home/docweb/-/docwebdisplay/docweb/4535524

Policy last updated on 29 October 2026.