Privacy notice
Last updated:
This is a translation of the Italian text, which prevails if the two differ. Read the Italian version
This page explains what personal data we collect on this site, why we do it, how long we keep it and what you can ask us.
It is provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and of the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).
1. Who processes your data
The controller is Sanson S.r.l., which runs this site under the Sanson Tessile brand. Registered office: Via Feltre 82/G, 32036 Sedico (BL), Italy. VAT number and tax code 00658980255, entered in the Treviso-Belluno Companies Register under number 00658980255, REA BL-62952.
For any question about your data, write to tessile@grupposanson.com or call +39 0437 82695.
We have not appointed a Data Protection Officer: our activity does not fall within the cases in which Article 37 GDPR makes one mandatory.
2. What data we collect
When you visit the site. To show you the pages, the server receives your device’s IP address, the type of browser, the page requested, the date and the time. This happens with any website. These data stay in the technical logs of the hosting service and are used to run the site and protect it from abuse.
Fonts, images and videos are hosted on this site. When you open a page, your browser does not contact the servers of other companies: we use no advertising, embedded maps, social media widgets or external fonts. The only exception is visit statistics, and only if you have accepted them: until you do, your browser does not contact Google.
If you accept visit statistics. Google Analytics stores a random identifier on your device and records the pages you look at, how far you scroll them, clicks to other sites and downloads, where you came from, the type of device and browser, and your approximate city, derived from your IP address. It also records when you start filling in or send the contact form, but nothing of what you write to us. Google uses the IP address only to derive the approximate location and does not keep it. Statistics do not tell us who you are.
When you write to us through the contact form. The form collects your name and one way to reach you — email or phone — which are the two fields we need to reply. You can add a description of what you need and, if you write from a product page, the product or brand you are interested in. We also record the language you wrote in, so that we can reply in the same one.
To protect the form from automated submissions we use a hidden field and the time elapsed since the form was opened. To limit repeated submissions, we derive a temporary pseudonymised identifier from the IP address. The counter is valid for ten minutes; it is deleted on expiry or when the server resumes execution if it was suspended. The counter does not keep the IP address, nor is the address included in the email. The hosting service’s technical logs are separate.
The message is not saved in a database of this site. It reaches us by email and stays in our mailbox; the sending service keeps a technical copy as described in point 5. In the description, write only what is needed for the quote: we do not need information about your health or other sensitive data.
When you contact us in other ways. If you email us, call us or message us on WhatsApp through the links on the site, we use what you give us to reply, as with the form. WhatsApp is a service of WhatsApp Ireland Limited, which processes data as an independent controller under its own privacy notice. The links to Instagram, Facebook and the brands’ websites take you away from here: from there on, the privacy notices of those services apply.
3. Why we process them, on what legal basis and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Running the site and protecting it | IP address, browser, page requested, date and time | Our legitimate interest in having a working and secure site — Article 6(1)(f) GDPR | 30 days for the site’s execution logs available on Vercel. We have not configured their export to other services. Logs processed by the provider to secure its own infrastructure are covered by its privacy notice |
| Replying to you and preparing a quote | Name, contact detail, description, product or brand, language | Steps taken at your request prior to entering into a contract — Article 6(1)(b) GDPR. If you write on behalf of a company, our legitimate interest in replying to the person who represents it — Article 6(1)(f) | For as long as the exchange and any negotiation that follows require, and then for the period in which a request can still be taken up again or give rise to a dispute. If the request becomes an order, accounting records are kept for ten years as required by law (Article 2220 of the Italian Civil Code) |
| Understanding how the site is used | A random identifier stored in a cookie, the pages viewed and how you use them (scrolling, clicks to other sites, downloads, starting and sending the form without its content), where you came from, the type of device and the approximate location derived from the IP address | Your consent, which you can withdraw at any time without the site stopping working — Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code | Two months for the detailed data in Google Analytics, after which they are deleted automatically. Aggregate totals, which cannot be traced back to anyone, remain in the reports |
| Protecting the form from automated submissions and abuse | Temporary pseudonymised identifier derived from the IP address, number and time of attempts, hidden field, time elapsed since the form was opened | Our legitimate interest in keeping the form usable — Article 6(1)(f) GDPR | The counter and identifier stay in the server’s memory for a ten-minute window and are deleted on expiry, or when execution resumes if the server was suspended. The counter does not retain the original IP address or write data to disk |
The legitimate interests indicated are the security of the site and the ability to reply to those who write to us. You can object at any time, as explained in point 6.
4. Whether you have to give us your data
No law obliges you to give us your data, and nothing happens to you if you do not.
- Contact form: name and contact detail are required. Without them the form is not sent, and we would have no way to reply anyway. Everything else is optional.
- Browsing data: without them your browser cannot receive the pages. It is not our choice: it is how the web works.
- Statistics: they are optional. If you decline them, the site works exactly as before and you lose no function. You can change your mind at any time from the bottom of the page.
5. Who sees your data and where it goes
We do not make your data public and we do not sell it. It is read by the members of our staff who answer requests, authorised and instructed by us (Article 29 GDPR and Article 2-quaterdecies of the Italian Personal Data Protection Code).
It is also processed on our behalf, as processors under Article 28 GDPR, by the providers listed below. They are not third parties who can use it as they wish: they act on our instructions and cannot use it for their own purposes.
| Who | What they do | Where | Safeguard for transfers outside the EU |
|---|---|---|---|
| The provider of the site’s technical services | Built the site and maintains it on our behalf: it runs the form, the content panel and the providers listed below | Italy | Work carried out in Italy; transfers through the services used are described in the following rows |
| Vercel Inc. | Hosts the site and the function that receives the form, and keeps their technical logs | A US company with a global distribution network. The function that processes the form runs in the United States | EU-US Data Privacy Framework and standard contractual clauses |
| Plus Five Five, Inc. (Resend) | Delivers the form messages to our mailbox by email. The service’s standard policy provides for 30 days for content and delivery logs and seven days for backups. Retention in our mailbox follows the criteria in point 3 | A US company. Email content and delivery logs are stored in the United States, even when the selected sending region is in the European Union | EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited | Provides Google Analytics and produces the visit statistics, only for those who have accepted them | Ireland, with transfers to Google LLC in the United States | EU-US Data Privacy Framework and standard contractual clauses |
| The provider of our business mailbox | Receives and stores the messages in the mailbox where we read requests | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
We may disclose data to the authorities when the law requires it, and to our advisers — accountant, lawyer — when this is needed to meet a legal obligation or to defend a right.
On transfers outside the European Union: where indicated above, the data reach the United States. The transfer is based on the adequacy decision of the European Commission of 10 July 2023 (EU-US Data Privacy Framework) for the providers that are certified under it, and additionally on the standard contractual clauses approved by the Commission. You can ask us for a copy of the safeguards by writing to the contacts in point 1.
6. Your rights
At any time you can ask us:
- to know whether we process data about you and to obtain a copy (Article 15 GDPR);
- to correct them, if they are inaccurate or incomplete (Article 16);
- to erase them, when we no longer need them for the reasons explained in point 3 (Article 17);
- to restrict their use while we verify something you have contested (Article 18);
- to receive in a structured, commonly used and machine-readable format the data you provided to us and that we process by automated means on the basis of consent or a contract, and to have them transmitted to another controller where technically feasible (Article 20);
- to object to processing based on our legitimate interest, on grounds relating to your particular situation (Article 21).
You can withdraw your consent to statistics at any time using “Change your cookie choice” at the bottom of every page. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
Write to tessile@grupposanson.com. We reply within one month; if the request is complex we may take two further months, telling you so within the first.
If you believe that we are processing your data unlawfully, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy — garante@gpdp.it — www.garanteprivacy.it), or go to court. The complaint costs you nothing and you do not have to contact us first, although writing to us is usually the quickest way.
7. Automated decisions, profiling and minors
We do not take automated decisions that produce legal effects concerning you: requests are read and assessed by people. Statistics tell us how many people read which pages, not who you are, and we do not use them to profile you or for advertising.
The site is not aimed at children under fourteen and we do not knowingly collect their data. If you notice that a minor has written to us, let us know at the contacts in point 1 and we will delete the message.
8. Cookies and storage on your device
This site asks for your consent for one thing only, visit statistics. Everything else it stores on your device is needed to make it work and is exempt from consent under Article 122 of the Italian Personal Data Protection Code. We use no profiling or advertising cookies. The details, with names and durations, are in the cookie policy, and you can change your choice from the bottom of every page.
9. Changes
If we change this notice, we publish the updated version here and change the date at the top. If the change concerns the way we use data you have already given us, we tell you before applying it.