Notice pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR)

Privacy & cookies

Last updated: 4 November 2026

This notice sets out how the personal data of users visiting www.caseificiorabbia.it, or contacting the Data Controller through the website contact form, is processed, and how cookies are used.

1. Data Controller

The Data Controller has not designated a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR do not apply. Any communication concerning the processing of personal data may be sent to the contact details above.

2. Data processed

• Data voluntarily provided through the contact form: name, email address and the content of the message.
• Data provided by email: the sender's address and any further data contained in the communication.
• Browsing data: the IT systems operating the website acquire, in the course of their normal operation, certain technical data whose transmission is inherent in the use of Internet communication protocols (such as IP address, browser type, date and time of the request, resource requested). This data is used solely to ensure the proper functioning and security of the website and is not intended to identify users.

Users are asked not to submit, through the contact form, data that is not relevant to their request, in particular the special categories of data referred to in Article 9 GDPR.

3. Purposes and legal basis of processing

• Responding to user requests (product information, orders, commercial and partnership proposals): performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR) and the Data Controller's legitimate interest in responding to communications received (Art. 6(1)(f) GDPR).
• Technical management and security of the website: the Data Controller's legitimate interest in ensuring the availability and protection of the website (Art. 6(1)(f) GDPR).
• Compliance with legal obligations: where an enquiry leads to a business relationship, data is processed to fulfil tax, accounting and administrative obligations (Art. 6(1)(c) GDPR).

Data is not used for marketing, promotional communications or profiling, nor is it disclosed or sold to third parties.

4. Provision of data

Providing a name, email address and message is necessary for the Data Controller to respond to the request. Failure to provide this data will make it impossible to process the request submitted through the form; users may nevertheless contact the Data Controller by telephone.

5. Recipients of the data

Data is processed by the partners and expressly authorised staff of the Data Controller and is not disseminated. To provide the services connected with the website, the Data Controller relies on the following providers, acting as data processors pursuant to Article 28 GDPR:

• Cloudflare, Inc.: website hosting (Cloudflare Pages) and management of browsing data.
• Web3Forms: forwarding of messages submitted through the contact form. Data is retained by the provider in accordance with its own privacy policy (web3forms.com/privacy).
• Aruba S.p.A.: email services.

Data may also be disclosed to external advisers (such as the Data Controller's accountants) and to the competent authorities, solely where required by applicable law.

6. Transfers to third countries

Certain providers (Cloudflare and Web3Forms) may process data outside the European Economic Area, in particular in the United States. Such transfers take place in compliance with the safeguards provided for by Articles 45 and 46 GDPR, such as European Commission adequacy decisions (for example the EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the Commission.

7. Data retention

• Requests received through the website or by email: 24 months from the date of the last contact, after which the data is erased.
• Data relating to business relationships: data connected with orders, invoices and contracts is retained for the period required by civil and tax law (normally 10 years).
• Browsing data: for the period strictly necessary, as set by the hosting provider for security purposes.

8. Rights of the data subject

Pursuant to Articles 15–22 GDPR, data subjects are entitled to obtain from the Data Controller, at any time:

• confirmation as to whether their personal data is being processed and access to such data (right of access);
• the rectification of inaccurate data or the completion of incomplete data (right to rectification);
• the erasure of their data (right to erasure);
• the restriction of processing (right to restriction);
• the receipt of their data in a structured, commonly used and machine-readable format (right to data portability);
• the cessation of processing based on the Data Controller's legitimate interest (right to object).

Requests may be sent to info@francescorabbia.it; the Data Controller will respond within 30 days of receipt. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9. Cookies

This website does not use profiling, advertising or analytics cookies and does not set any cookies of its own on the user's device. Accordingly, no consent banner is required.

• Fonts are served directly from the website's own server, without recourse to third-party services.
• The hosting service may use only technical cookies strictly necessary for the operation and security of the website, for which user consent is not required.
• The references to Instagram, Facebook, LinkedIn and Google Maps are plain hyperlinks: no content from these services is loaded before the user accesses them. Once opened, the privacy and cookie policies of the respective operators apply.

Users may manage or delete cookies at any time through their browser settings.

10. Changes to this notice

The Data Controller reserves the right to update this notice, in particular where new services are introduced (such as analytics tools, embedded maps or multimedia content). In such cases, where required by law, user consent will be obtained in advance. The date of the last update is shown at the top of this document.