LEGAL

Privacy Policy

Last updated: 26 May 2026

1. Data Controller

The Data Controller of personal data collected through the website cofit.com is:

Cofit International S.r.l.
Via J.F. Kennedy 9, 20023 Cerro Maggiore (MI), Italy
VAT / Tax Code: 03654550155
Italian Business Register (REA): MI – 880673
Certified Email (PEC): cofit@pec.tuni.it
Email: info@cofit.com
Phone: +39 0331 1496674

For any matter related to the processing of personal data, you may contact the Data Controller at the contact details provided above.

2. Legal framework

This Privacy Policy is provided pursuant to Regulation (EU) 2016/679 (hereinafter “GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (“Italian Privacy Code”), as well as in compliance with applicable Italian and European data protection legislation.

3. Types of data processed

Cofit International S.r.l. collects and processes the following types of personal data:

3.1 Data voluntarily provided by the user

Through the contact form available on the website, users voluntarily provide:

  • Name
  • Company position (professional role)
  • Company website
  • Email address
  • Message content
  • Any other personal data included in the message

3.2 Browsing data

The computer systems and software procedures used to operate the website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. Such data include:

  • IP addresses
  • Browser type and operating system
  • Domain names of the computers used to connect
  • URI/URL addresses of the requested resources
  • Time of request
  • Method used to submit the request to the server
  • Size of the file received in response
  • Numeric code indicating the server response status

3.3 Cookies and similar technologies

The website uses technical, statistical and marketing cookies. For detailed information, please refer to the Cookie Policy.

4. Purposes and lawful basis of processing

Personal data are processed for the following purposes:

  • Responding to contact, commercial or technical information requests submitted through the form — Lawful basis: performance of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR)
  • Management of any subsequent commercial relationships — Lawful basis: performance of a contract (Art. 6.1.b GDPR) or legitimate interest of the Data Controller (Art. 6.1.f GDPR)
  • Compliance with legal obligations (e.g. tax, accounting) — Lawful basis: legal obligation (Art. 6.1.c GDPR)
  • Statistical analysis of website usage (in anonymous/aggregate form) — Lawful basis: consent of the data subject (Art. 6.1.a GDPR)
  • Marketing and profiling (where activated) — Lawful basis: consent of the data subject (Art. 6.1.a GDPR)
  • Defence of a right in court — Lawful basis: legitimate interest of the Data Controller (Art. 6.1.f GDPR)

Providing data through the contact form is optional. However, failure to provide data marked as mandatory will prevent the Data Controller from responding to the request.

5. Processing methods

Personal data are processed using electronic and telematic tools, with logic strictly related to the purposes indicated above. Processing takes place primarily through:

  • Internal corporate email mailboxes within the @cofit.com domain
  • Corporate IT systems with appropriate security measures

The Data Controller adopts technical and organisational measures suitable to guarantee a level of security adequate to the risk, pursuant to Art. 32 GDPR, in order to prevent the loss, unlawful or incorrect use, and unauthorised access to the data.

6. Data retention period

Personal data collected through the contact form are retained for the time strictly necessary to respond to the user’s request and, subsequently, for the period necessary for the possible establishment of a commercial relationship or related purposes, and in any case no longer than 24 months from the last significant contact with the data subject.

The retention obligation remains in force for longer periods where required by law (for example for tax, accounting or legal defence purposes, generally up to 10 years).

Browsing data are retained for the time strictly necessary for technical purposes and IT security.

Data collected through cookies are retained for the periods specified in the Cookie Policy.

7. Disclosure and dissemination of data

Personal data may be disclosed to:

  • Authorised company personnel of Cofit International S.r.l., duly trained and appointed as data processors or data processing officers
  • Third parties acting as Data Processors pursuant to Art. 28 GDPR, such as providers of IT services, hosting, email, statistical analysis and consultancy
  • Competent authorities in case of legal obligation or request from judicial authorities

Personal data are not subject to dissemination.

The updated list of Data Processors may be requested from the Data Controller at the contact details indicated in section 1.

8. Transfer of data outside the European Economic Area

Certain third-party services used by the website (in particular Google Analytics, Google Maps, Adobe Fonts, Vimeo, LinkedIn) involve the transfer of personal data outside the European Economic Area (EEA), in particular to the United States of America.

Such transfers take place on the basis of:

  • Adequacy decision of the European Commission for the United States, pursuant to Art. 45 GDPR, through the EU-U.S. Data Privacy Framework (DPF), for certified providers
  • Standard Contractual Clauses approved by the European Commission pursuant to Art. 46 GDPR, for non-DPF-certified providers
  • Supplementary measures of a technical, organisational and contractual nature, where necessary

Further details on individual third-party services and related safeguards are available in the Cookie Policy.

9. Rights of the data subject

Pursuant to Articles 15-22 GDPR, the data subject has the right to:

  • Access (Art. 15): obtain confirmation of the existence of personal data concerning them and access such data
  • Rectification (Art. 16): obtain correction of inaccurate data or the completion of incomplete data
  • Erasure (“right to be forgotten”, Art. 17): obtain the erasure of personal data in the cases provided for
  • Restriction of processing (Art. 18): obtain restriction of processing in the cases provided for
  • Data portability (Art. 20): receive their data in a structured, commonly used and machine-readable format, and transmit it to another data controller
  • Object to processing (Art. 21): object at any time to the processing of data on grounds related to their particular situation, and in particular to processing for marketing purposes
  • Withdraw consent (Art. 7.3): withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal
  • Lodge a complaint with the Supervisory Authority (Art. 77): file a complaint with the Italian Data Protection Authority — Garante per la Protezione dei Dati Personali (Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it)

To exercise these rights, the data subject may write to:

  • Email: info@cofit.com
  • Certified Email (PEC): cofit@pec.tuni.it
  • Postal mail: Cofit International S.r.l. — Via J.F. Kennedy 9, 20023 Cerro Maggiore (MI), Italy

The Data Controller will respond to the request within 30 days, subject to extensions in the cases provided for by Art. 12.3 GDPR.

10. Data Protection Officer (DPO)

Cofit International S.r.l. has not appointed a Data Protection Officer (DPO), as the requirements for mandatory appointment under Art. 37 GDPR do not apply.

For any matter related to the processing of personal data, you may contact the Data Controller directly at the contact details indicated in section 1.

11. Automated decision-making

Cofit International S.r.l. does not carry out any solely automated decision-making, including profiling, that produces legal effects on the data subject or that significantly affects them pursuant to Art. 22 GDPR.

12. Minors

The website is not intended for minors under 16 years of age. The Data Controller does not knowingly collect personal data from minors under 16 years of age. Should the Data Controller become aware of having collected personal data from a minor under 16 years of age without the consent of a parent or guardian, such data will be deleted.

13. Changes to this Privacy Policy

The Data Controller reserves the right to modify this Privacy Policy at any time, providing notice to users through publication on the website. Users are therefore invited to consult this page regularly, referring to the “last updated” date indicated at the top.

In the event of substantial changes, the Data Controller will provide notice in a more visible manner on the website or, where possible, through direct communication to the data subjects.

14. Contact details

For any information or request related to this Privacy Policy or to the processing of personal data:

Cofit International S.r.l.
Via J.F. Kennedy 9, 20023 Cerro Maggiore (MI), Italy
Email: info@cofit.com
Certified Email (PEC): cofit@pec.tuni.it
Phone: +39 0331 1496674
VAT / Tax Code: 03654550155
Italian Business Register (REA): MI – 880673