Privacy Policy

This Privacy Notice is provided pursuant to EU Regulation 2016/679 (GDPR), Legislative Decree 101/2018 and the guidelines of the Italian Data Protection Authority. It describes how GRANDI SRL collects, uses and protects the personal data of users who visit grandidesign.it or submit the contact form.

1. Data Controller

Controller: GRANDI SRL

Address: Viale Riviera Berica 630/b, 36100 Vicenza (VI), Italy

VAT no.: 04009980246

Email: commerciale@gradisrl.it

Website: www.grandidesign.it

The Controller has not appointed a Data Protection Officer (DPO) as it is not required to do so under Article 37 GDPR.

2. Data Collected and Purposes

2.1 Browsing data

During browsing, IT systems automatically collect certain technical data: IP addresses, browser type, operating system, pages visited and access times. This data is not linked to personal identifiers and is used for security and aggregate statistics.

Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

2.2 Data provided voluntarily (contact form)

Through the contact form on the website, users may voluntarily provide: name and surname, company, job role, email, phone, city, type of space, number of employees and project description.

This data is used solely to respond to the user's request and, with explicit consent, for future commercial communications.

Legal basis: steps prior to entering into a contract at the data subject's request (Art. 6(1)(b) GDPR); consent of the data subject for marketing communications (Art. 6(1)(a) GDPR).

2.3 Cookies and tracking technologies

The website uses technical cookies necessary for operation and, with the user's consent, analytics cookies via Google Analytics 4. For full details, please see the Cookie Policy on this website.

3. Data Processors (Third-Party Providers)

The Controller uses the following third-party providers, appointed as Data Processors under Article 28 GDPR:

Google Ireland Limited (Google Analytics 4)

Registered office: Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: statistical analysis of web traffic.

Data transfers: Google transfers data to the USA on the basis of Standard Contractual Clauses approved by the European Commission.

Opt-out: tools.google.com/dlpage/gaoptout

HubSpot, Inc.

Registered office: 25 First Street, Cambridge, MA 02141, USA

Purpose: CRM management of contacts, receipt and storage of data submitted via the contact form.

Data transfers: HubSpot transfers data to the USA on the basis of Standard Contractual Clauses. HubSpot participates in the EU-US Data Privacy Framework.

4. Data Retention

Personal data is kept for no longer than necessary for the purposes for which it was collected:

Browsing data: up to 26 months (GA4 default retention period).
Contact form data: stored in HubSpot CRM for up to 5 years from the last contact, unless otherwise required by law or requested by the data subject.
Data for legal obligations (tax and accounting): 10 years as required by applicable law.

5. Data Subject Rights

Under Articles 15–22 GDPR, the data subject has the right to:

Access: obtain confirmation of processing and a copy of the data (Art. 15).
Rectification: correct inaccurate or incomplete data (Art. 16).
Erasure: request deletion of data (Art. 17).
Restriction: restrict processing in certain cases (Art. 18).
Portability: receive data in a structured format (Art. 20).
Objection: object to processing on legitimate grounds (Art. 21).
Withdraw consent: withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights: commerciale@gradisrl.it

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

6. Updates

This Notice may be updated. The current version is always available on grandidesign.it. In case of material changes, notice will be given on the website.