Privacy Policy

In compliance with the obligations arising from Italian national law (Legislative Decree no. 196 of 30 June 2003, Legislative Decree no. 101/2018) and European law (Regulation (EU) 2016/679, GDPR) and subsequent amendments, this website respects and protects the confidentiality of its visitors and users, implementing every appropriate technical and organisational measure so that users' rights are not infringed.

This privacy policy applies exclusively to the online activities of this website and is valid for its visitors/users. It does not apply to information collected through channels other than this website. The purpose of this notice is to provide maximum transparency regarding the information the site collects and how it is used.

Data controller

The data controller is Urbino Servizi S.p.A., with registered office in Urbino (PU), Via Puccinotti 3, VAT number 02168050413.

To contact the data controller on privacy matters, please write to: privacy@urbinoservizi.it

The Data Protection Officer (DPO) is Avv. Chiara Frangione, who can be contacted at: dpo@urbinoservizi.it

The up-to-date list of data processors and authorised personnel is available at the registered office mentioned above.

Nature of the data — browsing data

The computer systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category includes IP addresses or domain names of the computers used by users, the URI addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response, and other parameters relating to the operating system and computer environment used by the user.

Third-party services used

The site makes use of the following services provided by third parties, which may involve the processing of certain data (including the IP address) by the respective providers:

Google Analytics (Google Ireland Limited) — a statistical analysis service for site traffic and user behaviour, active only after explicit consent given via the cookie banner. More information in Google's privacy policy.
Google Tag Manager (Google Ireland Limited) — a tag management system used to activate, under the same consent rules, the measurement scripts present on the site.
Adobe Fonts (Adobe Inc.) — a font delivery service used for the site's typography; loading the fonts involves a request to Adobe's servers which may include the visitor's IP address. More information in Adobe's privacy policy.

For details of the cookies used by these services, see the Cookie Policy.

Legal basis for processing

This site processes data mainly on the basis of user consent. Consent is given through the use or consultation of the site, as conclusive conduct, and — for services that are not technically necessary, such as Google Analytics — through the dedicated cookie banner. By using or consulting this site, visitors and users explicitly approve this privacy policy and consent to the processing of their browsing data in the manner and for the purposes described.

Providing data is optional: users may withhold or withdraw consent at any time. However, withholding consent may make it impossible to provide certain services and may affect the browsing experience.

The data controller may also use data to fulfil obligations under national law, regulations and EU legislation, or instructions issued by legitimate authorities; in such cases, the related processing does not require the data subject's consent.

Purposes and methods of data processing

Browsing data is collected and processed for:

correct navigation of the data controller's site;
management, analysis and evaluation of the data controller's site, including through the third-party tools indicated above, subject to consent;
the data controller's legitimate interest;
security purposes (e.g. anti-spam filters, firewalls, virus detection): the data recorded automatically may also include the IP address, used to block attempts to damage the site or harmful or unlawful activities, in order to protect the site and its users.

Information gathered through browsing is processed in automated form and collected, where possible, in aggregate form, in compliance with the principles of fairness, lawfulness, relevance, proportionality and transparency required by applicable law.

Information that users of the site choose to make public through the services and tools made available is provided by the user knowingly and voluntarily, releasing this site from any liability regarding any breach of law. It is the user's responsibility to verify that they have permission to enter personal data belonging to third parties or content protected by national and international law.

Data retention period

Data collected by the site during its operation is used exclusively for the purposes indicated above and kept for the time strictly necessary to carry out the specified activities. Data used for security purposes (blocking attempts to damage the site) is kept for 30 days. Data collected via Google Analytics is retained according to the retention terms configured on that service.

Recipients

In addition to the data controller, categories of authorised persons involved in running the site (administrative, sales, marketing, legal staff, system administrators) and specifically appointed external parties (third-party technical service providers, hosting providers, IT companies, communication agencies) may have access to the data. The up-to-date list of processors and authorised personnel is available at the data controller's registered office.

Transfer of data outside the EU

This site may share some of the data collected with services (including Google and Adobe, mentioned above) located outside the European Union. Data transfer complies with the principles of GDPR 2016/679, Articles 44–50, and the recommendations of the EDPB.

User rights

Under Regulation (EU) 2016/679 (GDPR) and national law, users may, in accordance with the procedures and limits set out in applicable law, exercise the following rights:

request confirmation of the existence of personal data concerning them (right of access);
learn about its origin;
receive it in an intelligible form;
obtain information about the logic, methods and purposes of the processing;
request updating, rectification, completion, erasure, anonymisation, or the blocking of data processed in violation of the law, including data no longer necessary for the purposes for which it was collected;
where processing is based on consent, receive the data provided to the controller in a structured, commonly used and machine-readable format;
lodge a complaint with the supervisory authority (the Italian Data Protection Authority);
exercise all other rights recognised by applicable law.

Requests should be addressed to the data controller. Where data is processed on the basis of legitimate interest, data subjects' rights are still guaranteed (except the right to portability, which does not apply in that case), in particular the right to object to processing, which may be exercised by sending a request to the data controller.

Updates

This privacy policy was last updated on 24.08.2026.