Privacy Policy

PRIVACY POLICY

LAST UPDATED 10/07/2026

Lodes S.r.l., with its registered office in Marcon (VE) – 30020, Via Pialoi No. 32, VAT No. 02992370276 (hereinafter, the “Data Controller” or “Lodes”), owner of the website (www.lodes.com) (hereinafter, the “Website”), in its capacity as Data Controller of the personal data of users browsing the Website (hereinafter,  “Data Subjects”), hereby provides the privacy notice pursuant to Article 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, the “Regulation”, “GDPR” or “Applicable Legislation”).

Data Subjects may contact the Data Controller at any time using the following methods:

  • By sending a registered letter with acknowledgement of receipt to the Data Controller’s registered office at Via Pialoi No. 32, Marcon (VE) – 30020;
  • By sending an email to: [email protected].

The Data Controller has not appointed a Data Protection Officer (DPO).

  1. SUBJECT OF THE PROCESSING

The Data Controller processes personal data – both identifying and non-identifying – provided and/or collected from Data Subjects whilst browsing the Data Controller’s website https://www.lodes.com, and in particular:

  • Browsing data such as the IP addresses or domain names of the computers used by Data Subjects connecting to the Website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the Data Subject’s operating system and IT environment. This information is collected via the cookies described in the Website’s Cookie Policy, to which reference is made.
  • Identifying data, such as: first name, surname, email address, address, country, town/city, postcode, telephone number, company, occupation, provided by the Data Subject to the Data Controller via the forms available on the Website (e.g. newsletter subscription form, press room registration form, form for booking a showroom visit, in the ‘Configurator’ section, the ‘Contacts – Request for Information’ section), or communicated via email.

Personal Data and Browsing Data will hereinafter also be referred to collectively as “Data”.

  1. PURPOSES OF PROCESSING

In particular, the personal data of Data Subjects will be lawfully processed for the following purposes.

  1. Without prior consent, for the following purposes:
  2. the performance of the contract and/or pre-contractual obligations, pursuant to Article 6 par. 1 letter b) of the GDPR, for the purpose of:
  • process requests from Data Subjects and ensure they can use the Website and the services available on it: the Data Subjects’ personal data are collected and processed by the Data Controller solely for the purpose of processing any requests made by them (for example, in relation to registration for the Press Room, or via the ‘Contact Us’ section);
  • provide appropriate assistance in the event of a support request from Data Subjects;
  • carry out organisational, administrative, financial and accounting activities, such as internal organisational activities and activities necessary for the fulfilment of contractual and pre-contractual obligations;
  1. the pursuit of a legitimate interest of the Data Controller, pursuant to Article 6(1)(f) of the GDPR, for the purpose of:
  • manage and maintain the Website: the Data Controller’s interest stems from the general interest of a business in ensuring its operational continuity, including through the operation of the Website, and in improving the efficiency of the service provided.
  • prevent or detect fraudulent activities or abuses harmful to the Website, as well as to exercise the Data Controller’s rights in court and manage litigation: the Data Controller’s interest corresponds to the general, legitimate, real and current interest in not suffering harm as a result of the unlawful conduct of others, as well as to the constitutionally guaranteed right of action (Article 24 of the Constitution) and, as such, is socially recognised as taking precedence over the interests of the individual data subject.
  • to group Data Subjects into homogeneous categories (clusters) based on any parameters provided when completing the registration form (profession or occupation and geographical area of residence), in order to send commercial communications and newsletters that are relevant and consistent with the professional profile and the available product catalogue. The Data Controller’s interest in optimising its commercial communications by sending content relevant to the recipient based on their sector of activity and geographical area is concrete, genuine, proportionate and overriding, given the low intrusiveness of the processing (the data used are objective, static and provided directly by the Data Subject), their reasonable expectation of receiving communications tailored to their sector and market, and the absence of behavioural analysis, purchasing habits or individual preferences. This activity does not constitute ‘profiling’ within the meaning of Article 4(4) of the GDPR. The Data Subject is in any case entitled to object to such processing pursuant to Article 21 of the GDPR, at any time, using the channels indicated in paragraph 9 below.
  1. compliance with legal obligations, pursuant to Article 6 par. 1) letter c) of the GDPR, for the purpose of:
  • comply with the obligations laid down by laws, regulations, EU legislation, orders and requirements of the competent authorities.
  1. B. Only subject to the free, unambiguous, optional and revocable consent of the data subjects, in accordance with Article 6(1)(a) of the GDPR, for marketing purposes: with the data subject’s free and optional consent, given by ticking the relevant box at the bottom of the data collection form or following the activation of the newsletter service, some of your personal data may be processed by the Data Controller for the purpose of sending the newsletter, which may include commercial and marketing content relating to the Data Controller’s products and/or services and/or promotions. Commercial communications and newsletters may be of a general nature or relevant and consistent with your professional profile and the available product catalogue, based on the categorisation processing described in the preceding paragraph and subject to the Data Subject’s right to object;

Please refer to paragraph 8 below for information on how the Data Subject may withdraw their consent to processing for marketing purposes as referred to in this paragraph.

  1. METHODS OF PROCESSING

The processing of Data Subjects’ data is carried out by computerised means through the operations of collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, disclosure, erasure and destruction of data. The Data is subject to electronic and, where applicable, computerised processing. The Data is protected in such a way as to minimise the risk of destruction, loss (including accidental loss), unauthorised access or use, or use incompatible with the original purpose of collection. This is achieved through the technical and organisational security measures implemented by the Data Controller.

  1. DATA RETENTION

The Data Controller processes the Data for the time necessary to fulfil the purposes set out above and, in any event, subject to the statutory limitation periods, for the periods set out below:

  • In the case of Data collected and processed for the purposes referred to in paragraph 2, point A, sub-paragraph 1 above, the personal data of Data Subjects will be retained for the time strictly necessary to process the request and, in any event, for a maximum of 2 (two) months from the closure of the request or support ticket. Where a contractual relationship is established, contractual and accounting documents will be retained for 10 (ten) years from the termination of the relationship, in accordance with the applicable limitation periods.
  • In the case of data collected and processed for the purposes referred to in paragraph 2, point A, sub-paragraph 2 above, the personal data of data subjects will be retained for the time strictly necessary to fulfil the purposes for which they are collected and processed. In particular, with regard to browsing data and system logs, the retention period is 6 (six) months from the date of collection. With regard to data collected via cookies, please refer to the Website’s Cookie Policy.
  • In the case of data collected and processed for the purpose of sending marketing communications and newsletters, as referred to in paragraph 2, point B above, the data subjects’ personal data will be retained for a maximum of 24 (twenty-four) months from the date on which consent is obtained, with an ongoing (rolling) automatic erasure process. As the expiry date approaches, the Data Controller may send a request for consent renewal to the Data Subject, but only to those Data Subjects who have already given their marketing consent. In any event, the data will be deleted should the Data Subjects withdraw their consent before the 24-month period expires.

 

  1. PROVISION OF DATA

The provision of data for the purposes referred to in paragraph 2(A)(1) above is mandatory. Without such data, we cannot guarantee that Data Subjects will be able to register on the website or access the services made available by the Data Controller.

The provision of data for the purposes referred to in paragraph 2(A)(2) above is optional. The data subject has, in any case, the right to object to the relevant processing pursuant to Article 21 of the GDPR, using the channels indicated in paragraph 9 below. However, the consequences of failing to provide data or of exercising the right to object vary depending on the specific purpose pursued:

  • with regard to the management and maintenance of the Website and the prevention of fraudulent or abusive activities: browsing data is collected automatically whilst using the Website. Objecting to such processing could compromise the proper functioning of the Website and the adequate protection of its cyber security, as well as the Data Controller’s ability to detect and counter unlawful or abusive conduct. The Data Controller therefore reserves the right not to accept the objection if it can demonstrate the existence of compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject, in accordance with Article 21(1) of the GDPR;
  • with regard to the management of legal disputes and the exercise of the Data Controller’s rights in court: data processing for this purpose is carried out only where necessary and for the time strictly necessary. Objection to such processing could prejudice the Data Controller’s ability to exercise or defend its rights in court and, therefore, pursuant to Article 21(1) of the GDPR, the Data Controller is entitled to disregard the objection where the processing is necessary for the establishment, exercise or defence of a legal claim.
  • With regard to clustering for the purpose of sending newsletters: failure to provide data relating to profession and geographical area, or the exercise of the right to object to such processing, does not affect the Data Subjects’ ability to access the Website and its services, nor does it affect the receipt of general commercial communications and newsletters (where the relevant consent has been given). However, such communications will not be tailored to the data subject’s professional profile or geographical area

The provision of data for the purposes referred to in paragraph 2, point B, is, however, optional: if consent is not given, data subjects will not receive commercial communications or newsletters.

  1. SCOPE OF DATA DISCLOSURE AND ACCESS TO DATA

Data subjects’ data may be disclosed, even without prior consent, for the purposes set out above to supervisory bodies, law enforcement agencies or the judiciary, which will process such data, upon their express request, in their capacity as independent data controllers for institutional purposes and/or as required by law during investigations and inspections.

Data may also be disclosed to third parties (for example, partners, freelancers, agents, etc.), acting as independent data controllers, for the performance of activities necessary to achieve the purposes set out above.

Furthermore, the Data may be accessed by the Data Controller’s employees and/or collaborators responsible for managing the Website and handling requests from Data Subjects. These individuals, who have been instructed accordingly by the Data Controller in accordance with Article 29 of the Regulation, will process the Data Subjects’ data exclusively for the purposes set out in this privacy notice and in compliance with the provisions of the Applicable Legislation.

Finally, personal data relating to data subjects may be disclosed to third parties who may process personal data on behalf of the Data Controller in their capacity as data processors pursuant to Article 28 of the Regulation, such as, by way of example, IT and logistics service providers necessary for the operation of the Data Controller’s website, outsourcing or cloud computing service providers, media agencies, etc.

The data subject has the right to obtain a list of any data processors appointed by the Data Controller by submitting a request to the Data Controller via the channels indicated in paragraph 9 below.

  1. DATA TRANSFER

The Data Controller will not transfer Data outside the European Union.

We may transfer Data outside the European Union. To this end, in accordance with data protection legislation, the Data Controller assesses the impact of such Data transfers and, where applicable, puts in place the most appropriate safeguards (for example, adequacy decisions or standard contractual clauses).

For information regarding the transfer of personal data collected via cookies, including third-party cookies, please refer to the Website’s Cookie Policy and the privacy policies of each third party, available on their respective websites.

  1. RIGHTS OF THE DATA SUBJECT

The Data Controller informs Data Subjects that, as data subjects, provided that the restrictions laid down by law do not apply, they have the right to:

  • obtain confirmation as to whether or not your personal data exist, even if not yet recorded, and to have such data made available to you in an intelligible form;
  • obtain information and, where applicable, a copy of: a) the source and category of the personal data; b) the logic applied in the case of processing carried out with the aid of electronic means; c) the purposes and methods of the processing; d) the contact details of the Data Controller and Data Processors; e) the recipients or categories of recipients to whom the data may be disclosed or who may become aware of it, in particular if they are in third countries or international organisations; e) where possible, the period for which the data will be stored or the criteria used to determine that period; f) the existence of automated decision-making and, where this is the case, the logic involved, as well as the significance and the consequences envisaged for the data subject; g) the existence of appropriate safeguards in the event of a transfer of the Data to a country outside the EU or to an international organisation;
  • to obtain, without undue delay, the updating and rectification of inaccurate Data or, where they have an interest in doing so, the completion of incomplete Data;
  • to have the Data erased, anonymised or restricted: a) where the Data has been processed unlawfully; b) where the Data is no longer necessary in relation to the purposes for which it was collected or subsequently processed; c) where consent on which the processing is based has been withdrawn and there is no other legal basis; d) where the Data Subjects have objected to the processing and there are no overriding legitimate grounds for continuing the processing; e) where there is a legal obligation to do so; f) where the Data relates to children. The Data Controller may refuse to erase data only in the following cases: a) where the right to freedom of expression and information is exercised; b) where a legal obligation is being fulfilled, a task carried out in the public interest is being performed, or public powers are being exercised; c) for reasons of public health interest; d) where the data is archived in the public interest, for scientific or historical research, or for statistical purposes; e) where a right is being exercised in legal proceedings;
  • to obtain restriction of processing in the following cases: a) where the accuracy of the Data is contested; b) where the Data Controller has processed the Data unlawfully, to prevent its erasure; c) where the Data Subjects are exercising a right in court; d) to assess whether the Data Controller’s legitimate grounds override those of the Data Subjects;
  • to receive, where the processing is carried out by automated means, without hindrance and in a structured, commonly used and machine-readable format, the personal data concerning the Data Subjects in order to transmit it to another controller or – where technically feasible – to obtain direct transmission by the Data Controller to another controller;
  • to object, in whole or in part: a) on legitimate grounds relating to the processing of personal data concerning the data subjects; b) to the processing of personal data concerning the Data Subjects for the purposes of sending advertising or direct marketing material, or for carrying out market research or commercial communications, through the use of automated calling systems without the intervention of an operator, by email and/or through traditional marketing methods by telephone and/or post;
  • to lodge a complaint with the Data Protection Authority (in the Member State in which they habitually reside, in the Member State in which they work, or in the Member State in which the alleged infringement occurred). The Italian supervisory authority is the Garante per la protezione dei dati personali, with its registered office at Piazza Venezia, No. 11, 00187 – Rome (RM) (garanteprivacy.it).

Where Data is processed on the basis of consent, the Data Subject may withdraw such consent at any time by submitting a request to the Data Controller via the channels indicated in paragraph 9 below.

The Data Subject may also easily object to further email communications from the Data Controller by clicking on the dedicated link to withdraw consent, which is included in every email. Once consent has been withdrawn, the Data Controller will send the Data Subject an email to confirm that consent has been withdrawn.

The Data Controller informs you that, following the exercise of the right to object to the sending of communications via email, it is possible that, for technical and operational reasons (e.g. the compilation of contact lists having already been completed shortly before the Data Controller received the request to object), the Data Subject may continue to receive a few further messages. Should the Data Subject continue to receive messages more than 24 hours after exercising their right to object, please report the issue to the Data Controller using the contact details set out in paragraph 9 below.

  1. HOW TO EXERCISE YOUR RIGHTS AND CONTACT DETAILS

The Data Subject may exercise the rights guaranteed by the Applicable Legislation at any time by contacting the Data Controller in the following ways:

  • By sending an email to the Data Controller at [email protected]
  • By sending a registered letter with acknowledgement of receipt to the Data Controller’s registered office at Via Pialoi No. 32, Marcon (VE) – 30020.

 

  1. MINIMUM AGE

This Website and any services offered via the Website are reserved for minors. By registering on the Website in the designated section, as well as when completing any data collection forms on these Websites or when requesting the provision of or registering for the Newsletter service, the Data Subject confirms that they are at least 18 years of age, or, where consent is given, that they are at least 14 years of age or, in any event, that they are not younger than the age specified by the legislation of their country of residence where other age limits apply.

 

  1. EXTERNAL LINKS

The Website may contain links, including hyperlinks, widgets and banners, to external websites and/or platforms managed by third parties other than Lodes. For information on the purposes, type and methods of collection, processing, use and storage of Personal Data by such platforms, please consult their respective privacy policies.

 

  1. CHANGES TO THE PRIVACY POLICY

This policy may be amended from time to time, and we therefore encourage Data Subjects to consult this page periodically. To this end, the policy displays the date of the last update.

Last revised July 2026