Cookie Policy

Personal data policy – Cookies and browsing data

This Cookie Policy has been drawn up and customised specifically for the website www.cefla.com owned by Cefla s.c. via Selice, 23/a – 40026 Imola (BO) Italy, (hereinafter the “Data Controller”).

This policy has been drawn up based on the provisions of the Data Protection Authority (Italian supervisory authority: Garante per la protezione dei dati personali). It supplements and updates other information already present on the website and/or, in combination with it, provides all the elements required by Article 13 of EU Regulation 2016/679.

1. Data processing method

  • Cookies
    Cookies are short text strings sent to the browser during visits to a website, stored and transmitted back to the Website upon your next visit.
    Cookies allow us to collect information about your browsing experience.
    Cookies can be stored permanently on your computer and have a variable duration (persistent cookies), or they may not be stored permanently on your device and be automatically deleted when the browser is closed (session cookies).
    Cookies can be installed by the website you are browsing or they can be installed by other websites that provide a variety of services to that site (third-party cookies).
  • Technical cookies
    Cookies in this category allow the Website to function efficiently. Those installed by the Website are listed in the table below in point 1.6.
  • Statistical cookies
    The Website also uses statistical cookies either created directly by the Data Controller, or provided by third parties, as indicated in the table below in point 1.6.
  • The statistical cookies created directly by the Data Controller will be used by the Data Controller to carry out statistical analyses relating to various domains, websites or apps belonging to the Company, so that the Company can perform its own statistical processing without such analyses being aimed at making commercial decisions.
  • Third-party statistical cookies, when used exclusively to produce aggregate statistics, with minimisation measures suitable for significantly reducing their identifying power and without combining them with additional information held by the supplier, are treated as technical tools and do not require the user’s consent. In this case, tools have been introduced to reduce their identifying power, for example by masking significant portions of the IP addresses processed. In the event that third-party statistical cookies are used, the third party has contractually committed to the Data Controller to use them exclusively for the supply of the required service, to store them separately and not to “supplement” or “cross-reference” them with other information which may be available to them.

By contrast, all analytics cookies, which do not have these characteristics, as well as those used by third parties for purposes other than the mere production of aggregate statistics, still require the user’s prior consent. If these cookies are also used for individual tracking, marketing, content personalisation or integration with CRM tools purposes, they will be treated as profiling cookies.

The legal basis applicable to each cookie is specified in this document.

  • Marketing cookies
    Marketing cookies are non-technical cookies that allow the Data Controller to carry out marketing activities. The Data Controller uses the marketing cookies listed in the table below in point 1.6.
  • Profiling cookies
    Profiling cookies are non-technical cookies that allow the Company to provide you with customised services based on your specific requirements.  The Company uses the profiling cookies listed in the table below in point 1.6.
    1.6. Cookies table
    For a list of active cookies, please refer to the detailed page: https://www.cefla.com/en/cookie-policy-scan/

2. Deleting and disabling cookies

Your browser can be configured to prevent the processing of cookies, or to delete them immediately after the end of a browsing session. Below is a list of methods for disabling and deleting cookies in the main browsers:

Delete/disable cookies with Firefox

http://support.mozilla.com/it/kb/Eliminare%20i%20cookie

 
Delete/disable cookies with EDGE https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
Delete/disable cookies with Chrome

http://support.google.com/chrome/bin/answer.py?hl=it&answer=95647

 
Delete/disable cookies with Safari https://support.apple.com/it-it/guide/safari/sfri11471/mac

3. Navigation data and environmental variables

The Website automatically captures some personal data relating to your browsing.  This category of data includes, for example:

  • the IP addresses of the computer you are using;
  • the number of accesses;
  • the pages used;
  • the date and time of access;
  • the URL your browser was at before viewing the Website;
  • the type of browser you are using;
  • the operating system used.

4. Data submitted voluntarily

You have the right and are free to submit data by sending emails to the addresses indicated on the Website, which the Company may acquire for the purposes indicated from time to time. In addition to the email address required to send you feedback, any other personal data contained in the relevant communication will be processed. The data collected in this way will be stored and processed exclusively for correspondence purposes, and not for any other purposes.

5. Purpose and legal basis of data processing, optional nature of consent and consequences of failure to consent

  • Personal data processed with technical cookies and browsing data: The submission of personal data is a contractual obligation, as without these data, the website cannot be made fully functional in accordance with the terms and conditions of use.
  • Personal data processed with statistical cookies (similarly to technical cookies): The submission of personal data is a contractual obligation, as without these data, the website cannot be made fully functional in accordance with the terms and conditions of use.
  • Personal data processed with marketing cookies: The submission of personal data is purely optional. Failure to provide your data will make it impossible for the Company to carry out marketing The legal basis for data processing is your consent, expressed in accordance with applicable legislation.
  • Personal data processed with profiling cookies: The submission of personal data is purely optional. Failure to provide your data will prevent the Company from providing personalised services through profiling. The legal basis for data processing is your consent, expressed in accordance with applicable legislation.
  • Personal data submitted voluntarily via email or by completing forms: The submission of personal data is purely optional. Failure to provide the required data will prevent the Company from responding to requests. The legal basis for data processing is the legitimate interest of the Company, as the Data Controller, to respond to inquiries.

You can express your consent to the processing of personal data with non-technical cookies by clicking on a specific box displayed inside a banner.

Consent to the use of cookies and other non-technical tracking tools is obtained through a specific banner that allows the user to:

  • accept all non-technical cookies;
  • reject all non-technical cookies;
  • analytically select individual cookie categories.

Closing the banner using the “X” command will maintain the default settings and, therefore, allow browsing to be continued without having to install non-technical cookies.
The preferences expressed by the user are recorded by the Data Controller and can be modified at any time through a specific command always accessible from the website, using procedures at least as straightforward as those required for granting consent.

In the absence of significant changes to the processing conditions, the banner will not be displayed again until at least 6 months have passed since the user’s previous choice, unless the Data Controller is technically unable to track such timing.

6. Automated decision-making and profiling

If you consent to profiling cookies, the Data Controller can analyse your browsing preferences and interests in order to customise content, communications and promotional initiatives.

Unless expressly stated otherwise, this will not involve the adoption of decisions based solely on automated processing and such as to produce legal effects or effects similarly affecting the data subject pursuant to Art. 22 GDPR.

If you consent to profiling cookies, the Data Controller will carry out data processing including a decision-making process based solely on automated procedures, pursuant to Article 22 of the GDPR. This process aims to analyse and predict preferences and interests to provide a customised browsing experience and commercial communications in line with each specific profile.

The process is based on an algorithm that analyses the data collected through profiling cookies to target specific customer segments (clusters). The main criteria and data taken into consideration by the algorithm include:

  • Behavioural data: pages visited, products and services viewed, frequency of visits, time spent on specific sections of the website.
  • Interaction data: interaction with specific content (e.g., downloading brochures, watching videos), filling out contact forms.
  • Inferential data: based on observed behaviours, the algorithm infers possible professional interests or relevant business areas (e.g. “interest in the Medical sector,” “interest in the Finishing sector”).

The algorithm will not use special categories of data (sensitive data) pursuant to art. 9 GDPR. The underlying logic is non-discriminatory and is based exclusively on the analysis of your interactions with our website to customise our offering.

Assignment to a specific profile or segment has direct consequences on the type and frequency of communications and content shown to you. The main consequences to be expected are:

  • Content customisation: displaying content, banners or recommendations on the website in line with your interests as inferred from your profile.
  • Targeted commercial communications: ads relevant to a specific segment of interest.

For example, a user who frequently browses pages related to industrial packaging solutions and downloads the related catalogue will be automatically profiled as a “potential customer in the Packaging sector” and may be shown new machinery in that sector and receive dedicated discounts. These offers will not be sent to users with different profiles.

In accordance with Article 22 of the GDPR, you have the right not to be subjected to such a decision and you may, at any time, exercise the following rights:

  • Obtain human action from the Data Controller to revise your position.
  • Express your opinion regarding profiling and automated decision-making.
  • Challenge the decision made by the algorithm, requesting a revision.

To exercise these rights, contact the Data Controller using the contact details indicated in this policy. Please note that withdrawing your consent to profiling cookies (via a procedure as straightforward as granting your consent) will result in the immediate suspension of any form of automated processing described here.

7. Source from which personal data originate and categories of data

The personal data processed through the Website are collected directly from the data subject through navigation, the use of cookies and other tracking tools, as well as through the possible voluntary sending of communications or filling out of forms. The Data Controller will not process, within the scope of this Cookie Policy, data from publicly accessible sources or special categories of personal data pursuant to art. 9 of the GDPR.

8. Recipients or categories of recipients of personal data

Personal data may be received by:

  • companies that offer hosting services;
  • analytics, measurement, marketing automation and consent management platform providers;
  • entities that provide maintenance, assistance and security services for the Website;
  • group companies, where necessary for internal administrative purposes consistent with the listed ones;
  • public authorities and entities authorised to receive data pursuant to legal provisions or orders from the authorities.

The identity of the suppliers who operate by using cookies or other tracking tools is shown in the cookie table or can be requested from the Data Controller.

9. Data transfer

Some suppliers listed in the cookie table or among the recipients of data may be located in countries outside the European Economic Area, including the United States. In these cases, data transfer occurs exclusively in compliance with the conditions defined by applicable legislation, i.e., on a case by case basis:

  • on the basis of an adequacy decision by the European Commission; or
  • failing such a decision, through appropriate safeguards pursuant to Article 46 of the GDPR, supplemented where necessary by additional measures designed to ensure a level of protection essentially equivalent to that guaranteed within the European Union.

Information regarding the specific transfer basis applicable to each foreign supplier can be requested from the Data Controller using the contact details provided in this policy. To obtain a copy of the data or the location where they are made available or of the applicable guarantees, please send your request to the addresses indicated above.

10. Data retention time

  • The Data Controller will retain personal data processed with technical cookies in order to allow users to correctly use the Website and browsing data for a period not exceeding 12 months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
  • The Data Controller will retain personal data processed with statistical cookies for a period not exceeding 12 months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
  • The Data Controller will retain personal data processed with marketing cookies in order to carry out marketing activities for a period not exceeding 12 months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
  • The Data Controller will retain personal data processed with profiling cookies for a period not exceeding 12 (twelve) months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
  • The data processed through cookies are stored for a period of time corresponding to the technical duration of each cookie, as specifically indicated in the table above.

If processing of data collected via cookies continues beyond the cookie’s technical lifespan, the relevant retention period is indicated, for each identified purpose, either in this policy or in the Website’s general privacy notice.

In the event of a conflict between the cookie table and the general descriptions contained in this policy, the specific information provided in the table shall prevail, without prejudice to the Data Controller’s obligation to keep all information constantly aligned and updated.

The Data Controller reserves the right, in any case, to ask you to renew your consent to data processing and/or to verify any consent that you may have already expressed.

11. Right to object

As the data subject you have the right to object at any time, on grounds relating to each particular situation, to the processing of your personal data pursuant to points (e) or (f) of Article 6, paragraph 1 of GDPR, including profiling when based on those provisions.

The Company shall then no longer process personal data unless the Company can demonstrate compelling legitimate grounds for data processing which override the interests, rights and freedoms of the data subject or for the establishment, enforcement or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, their personal data shall no longer be processed for such purposes.

Data subjects may object to the processing of their personal data for direct marketing purposes even only partially, e.g. by objecting to the sending of promotional communications via automated and/or digital tools, or to the sending of hard copy communications and/or to telephone communications.
Where personal data of the data subject are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89, paragraph 1 of the GDPR, the data subject, on grounds relating to their particular situation, has the right to object to the processing of their specific personal data, unless such processing is necessary for reasons of public interest.

12. Other rights

The Company would also like to inform you of the existence of the following rights:

  • Right of access: Data subjects have the right to obtain confirmation from the Company as to whether or not any of their personal data are being processed. In this case, as the Data subject you have the right to access your personal data and specific information, pursuant to Article 15 of the GDPR;
  • Right to rectification: Data subjects have the right to obtain from the Data Controller without undue delay the rectification of inaccurate personal data. In consideration of the purposes of data processing, you have the right to obtain the integration of incomplete personal data, including by providing a supplementary statement, pursuant to Article 16 of the GDPR;
  • Right to erasure: Data subjects have the right to obtain from the Data Controller without undue delay the deletion of inaccurate personal data. The Company has the obligation to delete personal data without undue delay if the grounds listed in Article 17 of the GDPR apply;
  • Right to restriction of processing: Data subjects have the right to obtain from the Company restriction of data processing, if the grounds listed in Article 18 of the GDPR apply;
  • Right to data portability: Data subjects have the right to receive the personal data concerning them and submitted to the Company in a structured, commonly used and machine-readable format, as well as the right to transmit such data to another Data controller without hindrance from the Company, in the cases and under the conditions specified in Article 20 of the GDPR;
  • Right to object to commercial communications: Data subjects have the right to object at any time, free of charge, to receiving commercial communications from the Company;
  • Right to lodge a complaint with a Supervisory Authority: Data subjects have the right to lodge a complaint with the Data Protection Authority to report a violation of personal data protection regulations, pursuant to Article 77 of the GDPR.
  • Right to withdraw consent (Cookies): Where the processing of personal data is based on consent, the Data subject has the right to withdraw it at any time, without affecting the lawfulness of any processing carried out before such withdrawal. Consent may be withdrawn according to a procedure that must be as straightforward as the consent granting procedure, using the cookie preferences management panel accessible at any time from the Website. The right to object still applies to cases where data processing has a different legal basis, according to which the right to object is provided for by the applicable legislation.

13. How to exercise your rights

You may exercise the rights indicated in the Cookie Policy by addressing your request directly to the Company at the email address privacy@cefla.it or by registered mail to Via Selice Provinciale 23/a, 40026 Imola, Italy.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) using the methods provided on the official website and the contact details available at https://www.garanteprivacy.it/home/footer/contatti.

14. Accessibility

The Cookie Policy can be viewed at www.cefla.com/it/cookie-policy and at the Company’s premises. If expressly requested, the Company may provide information orally by telephone, by calling +39 0542-653111, subject to caller identity verification.

15. Changes

The Company may edit its Cookie Policy, also to comply with national and/or European Union legislation or technological innovations. Any new versions of the Cookie Policy will be posted on the Website. You are therefore requested to periodically check the Cookie Policy. Any changes will be notified via a pop-up on the Website or through different methods and/or IT tools. If the Company substantially modifies its Cookie Policy, introducing new processing purposes and/or categories of personal data processed, or changing third parties, the Company itself will provide the relevant information, requesting the necessary consent, via a specific banner. If it is impossible for the Company to verify that cookies have been stored on your device, if e.g. if you have deleted installed cookies, during a subsequent visit to the Website the Company will inform you, requesting the necessary consent via a specific banner. If at least 6 (six) months have passed since the previous banner published on the Website, the Company will provide the required information, requesting the necessary consents, via a specific banner.

Imola, 01 July 2026