Pursuant to Article 13 of EU Regulation No. 2016/679

Under Article 13 of EU Regulation No. 2016/679, which protects individuals with regard to the processing of personal data, we wish to inform you that the personal data you provide will be processed in compliance with the above legislation and the confidentiality obligations incumbent on IMO S.p.A.

Data controller
The data controller is IMO S.p.A., with registered office at Via Puccini 1, Milan, Italy, tax code/VAT No. 00714820156.

Purposes and legal basis of processing
Your personal data are processed:
A) without your express consent (Article 6(1)(b) and (c) GDPR), for the following service purposes:

• a) to allow registration on the Website, which is necessary to provide and manage the various services offered;
• b) to allow users to place product orders on the Website;
• c) to provide assistance and respond to users’ requests concerning purchased products;
• d) to fulfil pre-contractual, contractual and tax obligations arising from orders placed;
• e) to send order- and shipment-related communications (e.g. an order confirmation email, a shipping confirmation email or an email requesting feedback on the service received);
• f) to fulfil tax and/or accounting obligations;
• g) to comply with obligations imposed by law, regulations, EU legislation or an order of a public authority (for example, anti-money-laundering requirements);

B) only with your specific and separate consent (Article 6(1)(a) GDPR), for marketing purposes: to send you newsletters, commercial communications and/or advertising material by email, post, SMS and/or telephone concerning products or services offered by the Controller.
If you are already a customer, we may send you commercial communications about the Controller’s products and services similar to those you have already used, unless you object (Article 130 of the Italian Privacy Code).

Processing methods and retention period
Your personal data are processed through the operations listed in Article 4(2) GDPR, specifically: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, disclosure, erasure and destruction. Your data are processed both on paper and electronically.
The data referred to in section 2.A) will be retained for the duration of the contract and for a further 10 years after the service ends.
The data referred to in section 2.B) will be processed for 2 years, unless consent is withdrawn earlier.

Categories of personal data processed
In addition to personal data provided directly by users (such as first name, surname, postal address, email address, and delivery date and time), when users connect to the Website, the IT systems and software procedures used to operate it automatically and indirectly acquire certain personal data whose transmission is implicit in Internet communication protocols (e.g. IP addresses or domain names of computers used to access the Website, URI—Uniform Resource Identifier—addresses of requested resources, request time, method used to submit the request to the server, size of the returned file, numerical code indicating the server response status, and other parameters relating to the user’s operating system and IT environment).

Disclosure and dissemination of data
Personal data provided directly by users by completing online forms will not be disseminated or disclosed to third parties, except to:

• parties authorised to access the data under the law or by orders of the authorities;
• parties to whom disclosure is necessary to fulfil tax or administrative obligations;
• parties to whom disclosure is necessary to perform the contract (for example, order fulfilment, services and payment processing, credit-card management, debt collection, operation of the website and e-commerce platform, support services, promotions, website development, and email services used to send emails and/or newsletters);
• the Controller’s employees, collaborators and internal data processors (where appointed);
• the provider of the e-commerce web platform;

Rights of the data subject
In relation to the processing described above, you may exercise the rights granted by the GDPR, in particular the right to:

1. access your personal data and receive information about the purposes of processing, categories of data processed, recipients and categories of recipients to whom your data may be disclosed, the expected retention period, and whether profiling or automated decision-making mechanisms are used;
2. obtain correction of inaccurate personal data relating to you and/or erasure of your data in general without undue delay;
3. obtain restriction of processing;
4. object, in whole or in part and on legitimate grounds, to the processing of personal data relating to you, even where relevant to the purpose for which they were collected;
5. request portability of the data you have provided, meaning that you may receive them in a structured, commonly used and machine-readable format and transmit them to another controller without hindrance;
6. lodge a complaint with the competent data protection supervisory authority (the Italian Data Protection Authority).

You may exercise your rights by sending a written communication to IMO S.p.A., Via Firenze 34, 20060 Trezzano Rosa (MI), Italy, or by email to imo@imospa.it or by certified email (PEC) to imo@pec.imospa.it

Last updated on 25 November 2025