This notice describes how the personal data of users who visit the site https://mandrilemelis.it/it/ are processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003 ("Privacy Code").
The data controller is Mandrile Melis S.r.l., with registered office at Strada del Santuario, 64 12045 Fossano, VAT number 01925210047. For any request relating to the processing of personal data, you may write to info@mandrilemelis.it.
The data controller has not appointed a Data Protection Officer (DPO), as the cases in which appointment is mandatory under Article 37 GDPR do not apply.
Browsing data. The computer systems that run the site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet protocols: for example the IP address, the browser type, the operating system, the pages visited, and the date and time of the request. These data are used to ensure the operation and security of the site.
Data voluntarily provided by the user. When the user fills in the forms on the site, the data entered are processed, such as name, email address and any other information contained in the message. Users are asked not to enter special categories of data in the forms (for example health data) unless strictly necessary.
Cookies and other tracking tools. For information on the cookies and similar tools used by the site, please refer to the Cookie Policy.
The data are processed for the purposes indicated below, each based on the corresponding legal basis.
| Purpose | Legal basis | Retention |
|---|---|---|
| Operation, security and prevention of abuse of the site | Legitimate interest of the data controller in ensuring the operation and security of the site (Art. 6(1)(f) GDPR) | 6 months |
| Replying to requests sent through the contact forms | Performance of pre-contractual measures taken at the request of the data subject or legitimate interest in replying (Art. 6(1)(b) and 6(1)(f) GDPR) | 24 months from the reply |
| Display of third-party content and services embedded in the site | Consent of the data subject (Art. 6(1)(a) GDPR), expressed through the cookie banner | See the Cookie Policy |
At the end of the periods indicated, the data are erased or anonymised. The data may be retained for longer only if necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.
The site uses services provided by Google (Google Fonts (loaded from a remote server), Google Tag Manager / Google tag, YouTube (embedded videos)), which are activated only with the user's consent when they are not strictly necessary. The operation of these services, including any advertising functions, is described in the Cookie Policy. To find out how Google uses information from sites that use its services, you can consult the page policies.google.com/technologies/partner-sites.
The data are processed by electronic means and, where necessary, on paper, adopting technical and organisational measures appropriate to ensure their security and confidentiality, pursuant to Article 32 GDPR. The data are processed by persons authorised and instructed by the data controller.
The data may be disclosed to the following parties, who normally act as data processors under a contract with the data controller (Article 28 GDPR) or, in the cases indicated in their respective privacy notices, as independent data controllers:
| Service | Provider | Provider's privacy notice |
|---|---|---|
| Website hosting provider | Seeweb S.r.l. | Privacy notice |
| Cookie-Script (consent management) | Objectis Ltd | Privacy notice |
| Public CDNs (JavaScript and CSS libraries) | CDN providers (e.g. jsDelivr, cdnjs, unpkg) | — |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Privacy notice |
| Google Tag Manager / Google tag | Google Ireland Limited | Privacy notice |
| Mailjet (sending of emails from the contact forms) | Mailjet SAS (Sinch group) | Privacy notice |
| YouTube (embedded videos) | Google Ireland Limited | Privacy · Cookie |
The data may also be received by the consultants and providers who assist the data controller (for example for site maintenance or accounting obligations), as well as by public authorities in the cases provided for by law. The up-to-date list of data processors may be requested from the data controller.
Some of the providers indicated may process data outside the European Economic Area. In these cases the transfer takes place on the basis of an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified US providers, or of other appropriate safeguards pursuant to Articles 45-46 GDPR, such as the Standard Contractual Clauses.
| Service | Provider | Transfer and safeguards |
|---|---|---|
| Public CDNs (JavaScript and CSS libraries) | CDN providers (e.g. jsDelivr, cdnjs, unpkg) | Possible transfer to non-EEA countries depending on the provider's network. |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Possible transfer to the US, covered by the EU-US Data Privacy Framework. |
| Google Tag Manager / Google tag | Google Ireland Limited | Possible transfer to the US, covered by the EU-US Data Privacy Framework. |
| YouTube (embedded videos) | Google Ireland Limited | Possible transfer to the US, covered by the EU-US Data Privacy Framework. |
The provision of browsing data is necessary to use the site. The provision of the data requested in the forms is optional, but the fields marked as mandatory are necessary to follow up on the request: without them it will not be possible to reply. Consent for marketing purposes and for non-technical cookies is always optional and its refusal has no consequences on the use of the site.
The site and the services offered are not aimed at minors under 14 years of age, the minimum age provided for in Italy to give consent independently to the processing of data in connection with online services (Article 8 GDPR and Article 2-quinquies of the Privacy Code). Minors under 14 must not provide personal data through the site. If the data controller becomes aware that it has collected data of a minor under 14 without the consent of the holder of parental responsibility, it erases them without delay. Parents or guardians who believe that this has occurred may write to info@mandrilemelis.it.
At any time the data subject may exercise the rights provided for in Articles 15-22 GDPR:
Requests may be sent to info@mandrilemelis.it. The data controller replies within one month of receipt, a period that may be extended by two months in cases of particular complexity, as provided for in Article 12 GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Roma – www.garanteprivacy.it) or with the supervisory authority of the Member State in which they reside or work.
The data are not subject to solely automated decision-making, including profiling, which produces legal effects or similarly significantly affects the data subject (Article 22 GDPR).
The data controller does not use artificial intelligence systems to process the personal data collected through the site. In the future it may use artificial intelligence tools to analyse the data collected for the data controller's own information purposes: in that case this notice will be updated before the processing begins.
The data controller may amend this notice, including as a result of changes in legislation or in the services used. Users are invited to consult this page periodically.
Last updated: 09/11/2026