Privacy Notice on the Processing of Personal Data pursuant to Article 13 of Regulation (EU) 2016/679

Last update: 02/11/2026

 

GRAMMELOT S.r.l. (hereinafter, the “Owner”) considers the protection of personal data to be of fundamental importance. The Owner processes personal data in accordance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), applicable data protection legislation and the principles of lawfulness, fairness and transparency, ensuring that appropriate safeguards are applied to protect the rights and freedoms of data subjects.

For the purposes of this Privacy Notice, the term “Personal Data” has the meaning given to it in Article 4(1) of the GDPR, namely any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Depending on how you interact with our Website and services, the Personal Data we may collect includes:

• First and last name;
• Email address;
• Telephone number;
• Organization name (for example, the name of the company or other organization with which you are affiliated);
• Tax identification number, where required in connection with purchases made through our e-shop, for order management and applicable tax and invoicing obligations.

Under the GDPR, “processing” means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4(2) of the GDPR).

Before collecting and processing your Personal Data, we provide you with information about the purposes and methods of processing, the legal bases on which it is carried out and your rights as a data subject. The purpose of this Privacy Notice is to provide this information in a clear and accessible manner, so that you can understand how your Personal Data is processed and exercise your rights where appropriate.

 

1. Who will process your Personal Data?

The Data Controller responsible for processing your Personal Data for the purposes described in Sections 2 and 3 below is GRAMMELOT S.r.l., with its registered office at Via Casale, 5 – 20144 Milan (MI), Italy (hereinafter also referred to as the “Owner”).

 

2. For what main purposes will your personal data be processed?

The Owner collects and processes your Personal Data for the following purposes:

• To respond to requests for information, enquiries and reports submitted through the Website;
• To allow users to access and use the services and functionalities available on the Website;
• To take steps at your request before entering into a contract and to enter into, perform and manage contractual relationships with you;
• To manage purchases made through our e-shop, including order processing, payment management, delivery and related customer support;
• To comply with legal and regulatory obligations, including accounting and tax obligations, and requests or orders issued by competent authorities.

 

3. Additional purposes

Subject to your prior, freely given, specific, informed and unambiguous consent, pursuant to Article 6(1)(a) of the GDPR, the Owner may also process your Personal Data for the following optional purposes:

• To send you newsletters containing information about the Owner’s news, initiatives, activities, products and services, including promotional and commercial information.

The Owner may also use email tracking technologies provided by ActiveCampaign, such as web beacons, tracking pixels and tracked links, to collect information about whether newsletters have been opened and whether links included in those emails have been clicked. This information may be used to measure recipient engagement and improve future communications. This tracking activity is subject to your separate and specific consent.

The provision of Personal Data for these additional purposes and the related consent are entirely optional. You may refuse to provide consent or withdraw it at any time, including separately for newsletter communications and email tracking, without affecting the lawfulness of processing carried out before withdrawal.

As further explained in Section 7 below, you may withdraw your consent to receiving newsletters or to email tracking independently of one another.

 

4. To which subjects can your Personal Data be communicated?

Your Personal Data may be disclosed to or made accessible to certain recipients where this is necessary for the purposes described in this Privacy Notice or required by applicable law. For the purposes of Article 4(9) of the GDPR, recipients include natural or legal persons, public authorities, agencies or other bodies to whom Personal Data are disclosed, whether or not they are third parties.

In particular, the following categories of recipients may process your Personal Data:

• Employees and collaborators of the Owner who are authorized to process Personal Data and who have received appropriate instructions concerning the security and proper handling of such data;
• External service providers supporting the Owner in specific activities, including email marketing and communication services, such as ActiveCampaign, and website analytics services, such as Google Analytics. Depending on the nature of the services provided, these providers may process Personal Data on behalf of the Owner as data processors, where appointed pursuant to Article 28 of the GDPR, or act as independent data controllers;
• Public authorities, supervisory bodies and judicial authorities, where disclosure is required by law, by a lawful request or order, or is necessary for the establishment, exercise or defence of legal claims.

The Owner ensures that Personal Data are disclosed only to recipients who need access to such data for the relevant purposes and in accordance with applicable data protection legislation.

 

5. How long will your Personal Data be processed for?

The Owner will retain your Personal Data only for as long as necessary to fulfil the purposes for which they were collected and processed, taking into account the nature of the relevant processing activities and any applicable legal obligations.

Where a specific retention period cannot be determined in advance, the Owner will establish the appropriate retention period on the basis of objective criteria, including the purposes of the processing, applicable legal requirements and the need to establish, exercise or defend legal claims.

 

6. Is it possible to revoke the consent given and how?

Where the processing of your Personal Data is based on your consent, you may withdraw that consent at any time, in whole or in part, without affecting the lawfulness of processing carried out before its withdrawal, as provided for by Article 7(3) of the GDPR.

You may withdraw your consent by contacting the Owner using the contact details provided in Section 7 of this Privacy Notice.

With specific regard to our newsletters, you may independently withdraw your consent to receiving marketing communications and your consent to email tracking. To do so, you can use the links provided in the footer of each email:

• “Unsubscribe” to withdraw your consent to receiving newsletters and other marketing communications;
• “Reject tracking” to withdraw your consent to email tracking technologies, such as tracking pixels, used to monitor whether emails have been opened or links have been clicked, while continuing to receive our newsletters.

You may also exercise these rights by contacting the Owner using the contact details provided in Section 7.

 

7. What are your rights?

Under the GDPR, you have the right to exercise the following rights in relation to the processing of your Personal Data, subject to the conditions and limitations provided for by applicable law:

• Right of access (Article 15 GDPR): you have the right to obtain confirmation as to whether or not your Personal Data are being processed and, where this is the case, to access your Personal Data and receive information about the processing, including its purposes, the categories of Personal Data concerned, the recipients or categories of recipients, the envisaged retention period or the criteria used to determine it, the source of the data where they were not collected directly from you, and the existence of any automated decision-making, including profiling, where applicable.
• Right to rectification (Article 16 GDPR): you have the right to obtain the correction of inaccurate Personal Data concerning you and, taking into account the purposes of the processing, to have incomplete Personal Data completed.
• Right to erasure (Article 17 GDPR): you have the right to obtain the erasure of your Personal Data where one of the grounds provided for by the GDPR applies, for example where the data are no longer necessary for the purposes for which they were collected, where you withdraw your consent and there is no other legal basis for the processing, or where the data have been processed unlawfully. This right is subject to the exceptions provided for by Article 17(3) GDPR, including where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
• Right to restriction of processing (Article 18 GDPR): you have the right to obtain the restriction of processing in the cases provided for by the GDPR, including where you contest the accuracy of your Personal Data, where the processing is unlawful and you oppose erasure, where the Owner no longer needs the data but you require them for legal claims, or while an objection to processing is being assessed. Where processing is restricted, your Personal Data may generally only be stored and processed further in the circumstances permitted by Article 18(2) GDPR.
• Right to data portability (Article 20 GDPR): where the conditions set out in the GDPR are met, you have the right to receive the Personal Data concerning you that you have provided to the Owner in a structured, commonly used and machine-readable format and, where technically feasible, to have those data transmitted directly to another data controller. This right applies to processing based on your consent or on a contract and carried out by automated means.
• Right to object (Article 21 GDPR): you have the right to object, on grounds relating to your particular situation, to processing based on the performance of a task carried out in the public interest or on the legitimate interests pursued by the Owner or a third party. You have the right to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling related to such marketing.
• Rights relating to automated decision-making (Article 22 GDPR): where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the exceptions provided for by the GDPR.

You also have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your Personal Data infringes the GDPR, without prejudice to your right to seek a judicial remedy.

To exercise your rights or request further information, you may contact the Owner using the following details:

• By registered letter addressed to GRAMMELOT S.r.l., Via Casale, 5 – 20144 Milan (MI), Italy;
• By email at: info@grammelot.eu.

 

8. Where will your Personal Data be processed?

Your Personal Data will be processed by the Owner within the European Union.

However, certain service providers used by the Owner, including providers of email marketing and website analytics services, may process Personal Data outside the European Economic Area (EEA), depending on the services provided and their technical configuration.

Where Personal Data are transferred to countries outside the EEA, the Owner will ensure that such transfers comply with Chapter V of the GDPR. In particular, transfers will take place only where an appropriate transfer mechanism is in place, such as:

• An adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR, confirming that the country concerned ensures an adequate level of data protection;
• Appropriate safeguards pursuant to Article 46 of the GDPR, such as standard contractual clauses adopted by the European Commission, together with any supplementary measures required in the circumstances.

Further information about international transfers of your Personal Data and the safeguards applied may be requested from the Owner using the contact details provided in this Privacy Notice.

 

Cookie policy

Cookies are small text files stored on your computer by your browser. They’re used for many things, such as remembering whether you’ve visited the site before, so that you remain logged in – or to help us work out how many new website visitors we get each month. They contain information about the use of your computer but don’t include personal information about you (they don’t store your name, for instance). This policy explains how cookies are used on this website (the “Website”) and to provide information on how to reject or delete these cookies.

 

TECHNICAL COOKIES

This type of cookies allows the proper operation of certain sections of the Website. There are two categories: persistent (after closing the browser are not destroyed but remain up to a preset expiration date) and session (erased every time the browser is closed). These cookies are necessary then to view the Website and are only related to technical services offered and will therefore always be used and deployed, unless you change the settings in your browser.

Name	Purpose	Retention	Type
PHPSESSID	PHP Session	Session	Cookie of the web application
UncodeAI.*	Responsive design: calculate adaptive image size	Session	Cookie of the web application
uncode_privacy	Cookie policy acceptance	12 Months	Preference cookie

 

ANALYTICAL COOKIES

In order to analyze website traffic and understand how visitors use our Website, we use Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses cookies (small text files) that are stored on your device to collect information about your use of the Website.

The information collected through Google Analytics may include information about your browsing activity and interactions with the Website. The extent to which this information is collected and processed depends on the configuration of the service and the applicable privacy settings. We do not assume that all information collected through Google Analytics is anonymous or that Google is unable to associate IP addresses with other information it holds.

For further information about how Google processes data through Google Analytics, please consult Google’s information on the privacy and safeguarding of data: https://policies.google.com/privacy

You can opt out of Google Analytics by following the procedure provided by Google: https://tools.google.com/dlpage/gaoptout?hl=en

Google Analytics cookies will only be activated after you have provided your express consent through the Website’s cookie banner. You may withdraw your consent or manage your cookie preferences at any time through the cookie settings available on the Website.

For general information about Google’s privacy practices and the use of cookies, please consult: https://policies.google.com/privacy

Name	Purpose	Retention
_ga	Used by Google Analytics to distinguish individual users and generate statistical data about how visitors use the Website.	Up to 2 years
_ga_<container-id>	Used by Google Analytics 4 to maintain session state and store information about the session.	Up to 2 years

 

THIRD PARTY COOKIES AND SOCIAL PLUGINS

This type of cookie is used to integrate features and content provided by third parties into the pages of our Website. These features may include social media icons and sharing widgets, videos, interactive maps (such as Google Maps) and other third-party services or software that provide additional functionalities. Some of these features are currently available on our Website, while others may be introduced in the future.

These cookies and similar tracking technologies may be set by third-party domains and websites whose services or content are integrated into the pages of our Website. Their use and the information collected through them are subject to the privacy and cookie policies of the relevant third parties. However, we remain responsible for providing appropriate information about the use of third-party technologies on our Website and for obtaining consent where required by applicable law.

Social plugins are commonly used to enable visitors to share content on social networks. When these plugins are integrated into our Website, they may allow the relevant social network providers to collect information about visitors’ interactions with the Website, including through cookies and similar tracking technologies. The collection and processing of such information are governed by the respective privacy and cookie policies of those providers.

For further information about how these third parties process personal data and how you can manage your privacy preferences, please consult the following resources:

Google – Privacy and cookies information: https://policies.google.com/technologies/cookies

Google – How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites

Google – Privacy settings and controls: https://myaccount.google.com/privacy

Facebook – Cookies information: https://www.facebook.com/help/cookies/

Facebook – Privacy and cookie settings: https://www.facebook.com/privacy/center/

LinkedIn – Cookie Policy: https://www.linkedin.com/legal/cookie-policy

LinkedIn – Privacy settings: https://www.linkedin.com/mypreferences/

 

GOOGLE MAPS

Google Maps is a mapping service provided by Google that may be integrated into our Website to display interactive maps and geographical information.

When Google Maps is embedded in our Website, Google may use cookies and similar tracking technologies to store user preferences, provide the mapping service, ensure its functionality and collect information about users’ interactions with the map.

The cookies and other technologies used, their purposes and their retention periods may vary depending on Google’s service configuration and the user’s interaction with the map. Such technologies may also involve the processing of personal data by Google.

Where required by applicable law, Google Maps and any associated non-essential cookies or tracking technologies will only be activated after the user has provided consent through the Website’s cookie banner.

For further information about Google’s use of cookies and the processing of personal data, please consult Google’s Privacy Policy: https://policies.google.com/privacy

 

VIDEO (THIRD-PARTY COOKIES STORED WHEN EMBEDDING OR DISPLAYING A VIDEO)

YouTube (Google)

Our Website may embed videos hosted on YouTube, a video-sharing service provided by Google LLC. When a visitor accesses a page containing an embedded YouTube video, YouTube may use cookies and similar tracking technologies to enable video playback, remember user preferences, ensure the security and functionality of the player, and collect information about how the embedded videos are used.

The cookies and other technologies used by YouTube, their purposes and their retention periods may vary depending on the configuration of the embedded player, the user’s interaction with the video and the applicable privacy settings.

For further information about how Google uses cookies and processes information when its services are integrated into third-party websites, please consult:

Google Privacy Policy: https://policies.google.com/privacy

How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites

YouTube privacy-enhanced mode: https://support.google.com/youtube/answer/171780

EMAIL TRACKING TECHNOLOGIES (ActiveCampaign)

In addition to website cookies, we use email tracking technologies in our newsletters and other marketing emails to measure engagement and assess the performance of our email campaigns.

• Purpose: To record whether an email has been opened, track clicks on links included in the email, measure campaign performance and, where applicable, understand individual recipients’ interactions with our communications.
• Types of technology: Web beacons (invisible tracking pixels) and unique tracking links that redirect recipients to the intended destination while recording click activity.
• Data collected: Depending on the technology used and the recipient’s email settings, this may include information about email opens, link clicks, the time of interaction and information associated with the recipient or their device.
• Consent and legal compliance: We provide clear information about the use of email tracking technologies. Where required by applicable law, tracking pixels used to monitor individual recipients’ engagement with marketing campaigns are activated only after obtaining the recipient’s prior consent. Any use of tracking technologies for exclusively aggregated statistics must be configured so that the behaviour of individual recipients cannot be measured or identified. Recipients may withdraw their consent through an appropriate and easily accessible mechanism.
• Data retention: Information collected through email tracking technologies is retained for no longer than necessary to fulfil the purposes for which it was collected, taking into account the nature of the information and the applicable data retention requirements.

For further information about the provider’s processing of personal data, please consult ActiveCampaign’s Privacy Policy.

The use of tracking pixels in email communications is subject to the applicable data protection legislation, including Article 122 of Legislative Decree No. 196/2003 (the Italian Data Protection Code), as interpreted by the Italian Data Protection Authority’s Guidelines on the use of tracking pixels in email communications (Provision No. 284 of 17 April 2026, published in the Official Gazette on 29 April 2026): https://www.gazzettaufficiale.it/eli/id/2026/04/29/26A02030/sg

 

OTHER THIRD PARTY COOKIES

We may not always have direct control over all cookies and similar tracking technologies that may be placed on your device by third-party providers whose content or services are integrated into our Website. This may occur, for example, when our Website includes embedded content such as texts, documents, images or videos hosted on external platforms but displayed within our pages.

We make reasonable efforts to identify the third-party cookies and tracking technologies used through our Website and to provide appropriate information about them in this Cookie Policy. However, the cookies used, their purposes and their retention periods may change depending on the services provided by third parties and their configurations.

If you identify a third-party cookie or tracking technology on our Website that is not described in this Cookie Policy, you may contact us using the contact details provided in this Policy so that we can investigate and, where appropriate, update the information.

You may also consult the privacy and cookie policies of the relevant third-party providers for further information about their use of cookies and similar technologies.

 

HOW TO CONTROL AND DELETE COOKIES

You can manage, restrict or block cookies through the settings of your web browser. Most browsers allow you to view, delete or block cookies and, in some cases, configure different preferences for individual websites. Please refer to the help section or the official support documentation of your browser for instructions on how to manage cookies, including on mobile devices.

Please note that disabling or deleting certain cookies may affect the functionality and availability of some features of our Website.

You can also change or withdraw your consent to the use of cookies at any time through the cookie settings available on our Website. Managing cookies through your browser settings does not replace the consent management options provided on our Website.

 

CONSENT

When you visit our Website, you will be provided with information about the use of cookies and similar tracking technologies through our cookie banner and settings.

Cookies and similar tracking technologies that are not strictly necessary for the operation of the Website will only be activated after you have provided your prior consent, where required by applicable law. Your consent is freely given and may be specific to different categories of cookies and tracking technologies.

You may change or withdraw your consent at any time through the cookie settings available on our Website. Withdrawing your consent does not affect the lawfulness of any processing carried out before its withdrawal.

We may update this Cookie Policy from time to time to reflect changes in the cookies and tracking technologies used on our Website, in our practices or in applicable legislation. Any updated version will be published on this page and will indicate the date of the latest update. Where required, we will ask for your consent again before activating cookies or tracking technologies affected by such changes.