Privacy notice

1. Introduction and scope

This notice describes how personal data are processed when users visit the website https://www.contenitori-interrati.it (the "Site") and use the features available on the Site.

This notice is provided pursuant to Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection law.

The Site provides information about Greenport, the specialist brand of Bunder Company SRL for underground containers, eco-islands and urban technologies, and allows users, among other things, to submit information requests through a contact form.

The Site is available in Italian and English.

This notice does not apply to third-party websites, services or platforms that may be reached via links on the Site, which are subject to their respective privacy notices.

2. Data controller

The data controller is:

Bunder Company SRL Viale F. De Blasio, s.n.c. 70132 Bari (BA) - Italia VAT no. 07734810729

To exercise the rights provided under the GDPR or for any request relating to personal data protection, you may contact the controller:

Email: info@bunder.it Phone: +39 393 572 1435

As of the date of this notice, a Data Protection Officer (DPO) has not been appointed, as the mandatory conditions under Article 37 GDPR do not apply to the controller's activities.

3. Categories of personal data processed

In connection with the Site, the categories of data described in the following sections may be processed.

3.1 Data provided voluntarily by the user

Through the contact form, depending on the fields completed, the following may be collected:

• first and last name;
• company name;
• address;
• VAT number;
• telephone number;
• email address;
• products or services of interest;
• content of the request or message.

Users are asked not to enter third parties' personal data or information that is not necessary for the request.

3.2 Browsing and technical data

In the normal operation of the Site, technical data generated by the IT systems and networks used to provide the service may be processed, including for example:

• IP address;
• date and time of the request;
• URI or requested resource;
• user agent and browser information;
• connection data;
• technical information relating to security and the handling of abuse or anomalies.

Such data are mainly processed to ensure proper operation, security and protection of the Site infrastructure.

3.3 Cookie preferences and similar technologies

The Site uses an in-house system to record the user's choices regarding cookies and tracking tools.

Preference information is stored using first-party tools, as described in the Cookie Policy (/en/cookie/).

The language-switch suggestion is based on the browser language and does not use cookies or persistent storage on the device; dismissing the message applies only for the current browsing session in memory.

3.4 Google Maps

The Contact page may offer an interactive Google Maps integration to show the office location.

The Google Maps embed is not loaded before the consent required for functional tools is given.

Alternatively, an external link allows users to open the location directly in Google Maps.

When the embed is activated, Google may process technical data relating to the connection, device and interaction with the map under its own terms and privacy notice.

3.5 Google Analytics 4

Subject to the user's consent to the statistics category, the Site uses Google Analytics 4 (GA4) to collect information on use of the Site, such as pages viewed, visit duration, traffic source, device and browser characteristics and other statistical browsing data.

GA4 is used for statistical purposes and to understand how Site content is used, in order to improve structure and content.

Before consent is given, analytics tools are not activated according to the consent configuration adopted on the Site.

For users in the European Economic Area, Google states that it does not record or store users' individual IP addresses in Google Analytics.

Remarketing or advertising profiling tools are not used via Google Analytics.

For further details on cookies and technologies used, please see the Cookie Policy (/en/cookie/).

4. How data are collected

Personal data may be collected:

• directly from the data subject via the contact form;
• automatically while browsing the Site, through the IT, network and security systems used to provide the service;
• through first-party tools used to record cookie preferences and certain interface preferences;
• through Google Analytics 4 only as described in this notice and the Cookie Policy and after consent is obtained;
• through Google Maps when the user requests activation and gives the relevant consent.

The Site does not offer user registration, a restricted area, e-commerce or newsletter sign-up through the public forms on the Site.

5. Purposes and legal bases of processing

Personal data are processed for specified, explicit and legitimate purposes as set out below.

5.1 Handling contact requests

Data provided via the contact form are processed to:

• receive and handle the user's request;
• respond to information requests;
• provide information on products and services;
• carry out pre-contractual steps requested by the data subject where the request is aimed at evaluating or establishing a commercial relationship;
• maintain communications necessary to handle the request.

The legal bases are:

Article 6(1)(b) GDPR where processing is necessary to take pre-contractual steps at the data subject's request;

Article 6(1)(f) GDPR where the request is not directly linked to pre-contractual steps but processing is necessary to handle a legitimately submitted request.

Submitting the form does not constitute consent to processing for contractual or pre-contractual purposes. Processing relies on the legal bases above.

The form may require confirmation that the privacy notice has been read; this does not constitute consent to processing.

5.2 Operation, security and protection of the Site

Technical and security data may be processed to:

• ensure operation of the Site;
• protect the infrastructure from unauthorised access, attacks and fraudulent activity;
• apply traffic limiting and anti-spam measures;
• carry out diagnostics, maintenance and technical management;
• establish, exercise or defend the controller's rights.

The legal basis is the controller's legitimate interest under Article 6(1)(f) GDPR, provided that interest does not override the data subject's fundamental rights and freedoms.

5.3 Compliance with legal obligations

Personal data may be processed to comply with obligations under laws, regulations or orders of competent authorities.

The legal basis is Article 6(1)(c) GDPR.

5.4 Cookie preference management

Non-essential tracking tools are activated only where required by applicable law and, where necessary, after the user's consent.

Preferences may be changed or withdrawn at any time via the "Cookie preferences" feature on the Site.

5.5 Google Maps

The Google Maps embed is activated only at the user's request and after consent to the relevant category of tools.

The legal basis is the data subject's consent under Article 6(1)(a) GDPR, together with applicable cookie and tracking law.

Consent may be withdrawn at any time via cookie preferences.

5.6 Google Analytics 4

GA4 is used only after the user's consent to the statistics category.

The legal basis is the data subject's consent under Article 6(1)(a) GDPR.

Consent may be withdrawn at any time via cookie preferences.

6. Cookies and similar technologies

For specific information on technical cookies, statistical analytics tools, Google Maps tools, cookie duration, third parties involved and how to manage, change or withdraw preferences, please see the Site's Cookie Policy at /en/cookie/.

Cookie preferences are recorded using first-party tools.

The Site does not use Google Tag Manager as a separate container, advertising pixels, remarketing systems or social widgets that automatically track users on simple browsing.

7. Providers and parties that may process data

To provide the Site and its features, the controller may use specialised technical providers, which may process personal data only to the extent necessary for their services.

Depending on the services actually in use, these include:

• web hosting and infrastructure providers;
• Cloudflare, Inc., for network, security, content delivery and API services;
• Plus Five Five, Inc. (Resend), for transmitting emails generated by the contact form;
• Google Ireland Limited / Google, for Google Maps and Google Analytics 4 under the applicable processing terms.

Where a provider acts as processor, the relationship is governed under Article 28 GDPR.

Where a provider acts as an independent controller or under a controller-to-controller relationship, processing is governed by the provider's terms and notices.

8. Recipients of data

Personal data may be accessed, within the scope of their roles, by:

• authorised staff of the controller;
• technical providers engaged to deliver the services;
• parties that support the controller in technical management and Site security;
• public authorities or competent bodies where disclosure is required by law or by an authority order.

Personal data are not disclosed to the public.

An up-to-date list of processors may be requested from the controller at info@bunder.it.

9. Transfers of data to third countries

Some technology providers used by the Site may process personal data outside the European Economic Area.

Where transfers to third countries occur, the controller uses the mechanisms under Articles 44 et seq. GDPR, including where applicable:

• European Commission adequacy decisions;
• European Commission standard contractual clauses;
• any further safeguards or mechanisms permitted by applicable law.

Transfers via US providers are handled according to the transfer mechanisms applicable to those services and contracts.

10. Retention periods

Personal data are kept for no longer than necessary for the purposes for which they were collected, unless further retention is required by law or for the protection of the controller's rights.

10.1 Contact request data

Information relating to contact requests is kept for as long as needed to handle the request and related communications and, absent a subsequent contractual or commercial relationship or other legitimate needs, for a maximum of 24 months from closure of the request.

Where a contractual or commercial relationship arises from the request, relevant data may be kept for periods required by civil, tax, accounting law or to protect the controller's rights.

10.2 Technical logs and security data

Technical logs are kept for as long as needed for security, maintenance and diagnostics purposes and, ordinarily, for no more than 90 days, unless longer retention is necessary to investigate or handle incidents, abuse, breaches or disputes.

10.3 Google Analytics 4

User and event data collected via Google Analytics 4 are retained according to the period configured in the Analytics property and, at present, for a maximum of 14 months, unless the configuration or service features change.

10.4 Cookie preferences

Consent preferences may be stored for up to 12 months, unless deleted earlier by the user or unless significant changes to processing require preferences to be collected again.

11. Whether provision of data is mandatory

Providing data marked as mandatory in the contact form is necessary for the controller to receive and handle the request.

Failure to provide necessary data may prevent submission or proper handling of the request.

Users are asked to provide only data necessary for the purpose pursued.

Consent to non-essential tracking tools is optional; refusal does not prevent normal use of parts of the Site that do not depend on those tools.

12. Automated decision-making and profiling

The controller does not carry out automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them.

13. Rights of the data subject

The data subject may exercise, where provided by applicable law, the rights under Articles 15 et seq. GDPR, including:

• confirmation as to whether personal data concerning them are being processed;
• access to personal data;
• rectification of inaccurate data or completion of incomplete data;
• erasure of data in the cases provided;
• restriction of processing in the cases provided;
• objection to processing in the cases provided;
• data portability in the cases provided under Article 20 GDPR;
• withdrawal of consent previously given, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests may be sent to: info@bunder.it

The controller responds to requests within the time limits under Article 12 GDPR.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority under applicable law.

Italian Data Protection Authority: https://www.garanteprivacy.it

14. Security of processing

The controller adopts technical and organisational measures appropriate to the nature of the data and the risks of processing, aimed at protecting them against loss, unauthorised access, alteration, destruction or unauthorised disclosure.

Security measures may be updated over time in light of technological developments, risks and the services used.

15. Changes to this notice

The controller may amend or update this notice when necessary, for example due to regulatory, technical, organisational changes or changes to the services used on the Site.

The updated version is published on this page with the date of the last update.