This notice, provided under Article 13 of Regulation (EU) 2016/679 ("GDPR"), explains how Luce5 S.r.l. processes the personal data of people who visit www.luce5.it and use its forms and reserved area, of people who subscribe to the newsletter (section 7) and of people who interact with the Luce5 pages on social networks (section 8). Cookies are described in the Cookie policy. Job applications, whistleblowing reports and relations with customers and suppliers have their own notices, listed in section 10.
1. Data controller
Luce5 S.r.l., Via Fratelli Alinari 9/11, 52025 Montevarchi (AR), Italy, VAT no. 01910850518. For questions about your data and to exercise your rights, write to privacy@luce5.it or by post to the registered office address.
2. Data processed
- Browsing data: IP address, date and time of the visit, pages requested, browser type and other technical data that the server records at each visit.
- Cookie choice: the choice made on the banner, saved in the browser's technical cookie l5pref; to be able to demonstrate consent, the website also records its date and time, with your account if you are logged in to the reserved area, otherwise with your IP address.
- Statistics, only with your consent: the random identifier that the statistical cookies assign to your browser, the pages visited and actions taken on the website, device and browser type, language and approximate location (country or city).
- Contact requests: the data entered in the form or in the email, for example first name, last name, email address and company, and the content of the request.
- Reserved area: name, email address, company, login credentials and IP address.
- Newsletter: the data listed in section 7.
3. Purposes, legal basis and retention
| Purpose | Legal basis | Retention |
|---|
| Running and security of the website: running the website, protecting it from misuse and attacks, establishing any cyber offences | Legitimate interest in providing a working and secure website (Art. 6(1)(f) GDPR). Technical cookies do not require consent (Art. 122 of Legislative Decree 196/2003, the Italian "Privacy Code") | Server logs: 12 months at most |
| Cookie choice: respecting the choice made on the banner and being able to demonstrate consent | Obligation to be able to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR); legitimate interest in respecting your choice (Art. 6(1)(f)) | Acceptance: 17 months, that is the 90 days for which the choice is valid and the 14 months for which statistics data may be kept. Rejection: 90 days |
| Statistics: measuring how the website is used, to improve its content and functioning | Consent, given with "Accept all" or by choosing statistical cookies under "Customize" (Art. 6(1)(a) GDPR; Art. 122 of the Privacy Code) | Detailed visit data: 2 months. Data linked to the browser identifier: 14 months from the last visit |
| Contact requests: answering and providing the information, quotes or support requested | Pre-contractual steps requested by you (Art. 6(1)(b) GDPR); for other requests, legitimate interest in answering (Art. 6(1)(f)) | 24 months from the last contact. If a business relationship follows, the notice for customers and suppliers applies |
| Reserved area: creating and managing the account, giving access to reserved content, protecting the account from unauthorised access | Service requested by you (Art. 6(1)(b) GDPR); for the IP address, legitimate interest in account security (Art. 6(1)(f)) | As long as the account is active. Deletion within 24 hours if you delete the account, otherwise 48 months after the last login |
Without consent, statistics are not activated. You can withdraw consent at any time, as explained in the Cookie policy, without affecting earlier processing. Luce5 only looks at aggregated statistics, does not use these data to identify individuals and has disabled the advertising features of the statistics service and the sharing of data with the provider for its own purposes.
When the retention period ends, data are deleted or made anonymous. A period is extended only if the data are needed to establish an offence or defend a right, until the matter is closed. Backup copies follow their own rotation: deleted data remain in a backup copy until that copy expires.
4. Obligation to provide data
Browsing data are collected automatically because they are needed to use the website. The mandatory fields of the forms are needed to answer you or to create the account: without them Luce5 cannot follow up on your request. Consent to statistics is optional: without it, the website works in the same way.
5. Recipients
Within Luce5, data are accessible only to authorised persons who need them: the IT Office, which runs the website, and the sales staff who answer requests. The provider of the website hosting service, the provider of the statistics service (only with consent) and the provider of the email service, which delivers form messages, receive the data as processors (Art. 28 GDPR). Data are disclosed to authorities only where required by law and are not published.
6. Transfers outside the European Economic Area
As a rule, data are processed in the European Economic Area. The statistics service may transfer data to the United States: the provider participates in the EU-U.S. Data Privacy Framework, which the European Commission found adequate by decision of 10 July 2023 (Art. 45 GDPR). If other providers process data outside the European Economic Area, the transfer takes place only on the basis of an adequacy decision or of the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).
7. Newsletter
People who subscribe to the newsletter with the website form receive emails about Luce5 products, projects and events. Luce5 may also send its customers emails about products similar to those they have purchased, at the email address provided in the sale. The data processed are the email address and, if provided, name and company; date and method of subscription; any withdrawals and objections.
| Purpose | Legal basis | Retention |
|---|
| Newsletter: sending subscribers communications about Luce5 products, projects and events | Consent, given when subscribing (Art. 6(1)(a) GDPR; Art. 130 of the Privacy Code) | Until consent is withdrawn or the newsletter is discontinued |
| Emails to customers about products similar to those they have purchased, sent to the email address provided in the sale | Legitimate interest in promoting its own products to its customers (Art. 6(1)(f) GDPR; Art. 130(4) of the Privacy Code) | Until the customer objects |
| Proof of subscriptions, withdrawals and objections; suppression list, so that no messages are sent to people who have withdrawn consent or objected | Obligation to be able to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR); legitimate interest in respecting the person's choice (Art. 6(1)(f)) | Proof: for the duration of the subscription and 5 years after withdrawal or objection. Suppression list: as long as Luce5 sends communications |
Luce5 does not use tools that track whether individual recipients open messages or click on links. If it uses them in the future, it will do so only with consent and will update this notice.
Subscribing is optional: without an email address you cannot receive the newsletter, and not subscribing has no consequences for any other relationship with Luce5. Data are accessible only to authorised Luce5 staff who handle communications and IT systems. The sending tool is installed on Luce5 systems; messages are sent through the email service, whose provider processes the data as a processor (Art. 28 GDPR). Data are not published or passed on to others.
Consent can be withdrawn at any time with the link in every message, from the "Unsubscribe from the newsletter" page of the website or by writing to privacy@luce5.it, without affecting earlier mailings. Customers can object at any time to emails about similar products, including at each single mailing, with the same link or by writing to privacy@luce5.it (Art. 21 GDPR; Art. 130(4) of the Privacy Code). The other rights are described in section 9.
8. Luce5 pages on social networks
Luce5 has company pages on Facebook and Instagram, run by Meta Platforms Ireland Limited, on LinkedIn, run by LinkedIn Ireland Unlimited Company, on YouTube, run by Google Ireland Limited, and on TikTok, run by TikTok Technology Limited. Each provider processes its users' data under its own privacy notice, also outside the European Economic Area: Facebook, Instagram, LinkedIn, YouTube, TikTok.
Luce5 processes:
- the user names, comments and messages of people who interact with the pages, to answer them and manage the pages. Legal basis: legitimate interest in communicating with the people who follow the pages (Art. 6(1)(f) GDPR). Comments and messages remain on the platform under its rules, and users can delete them at any time;
- page statistics, which the platforms provide only in aggregated form, without data that identify individuals. Legal basis: legitimate interest in knowing how the pages perform (Art. 6(1)(f) GDPR).
For page statistics, where the platform provides for it, Luce5 and the provider are joint controllers (Art. 26 GDPR). Under the agreements published by Meta and LinkedIn, the provider undertakes to inform users, to answer requests about their rights and to ensure the security of the data. Requests about page statistics can also be sent to Luce5, which forwards them to the provider.
No people appear in the content that Luce5 publishes on its pages. Paid campaigns are not addressed to individual persons or to narrowly defined audiences, and Luce5 does not use remarketing.
9. Rights and complaints
Everyone can ask Luce5 for access to their data and a copy, rectification, erasure, restriction of processing and, for data provided with consent or for a requested service and processed by automated means, data portability (Articles 15 to 20 GDPR). They can object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (Art. 21 GDPR) and withdraw consent to statistics and to the newsletter, without affecting earlier processing.
Requests are sent to privacy@luce5.it or by post to the registered office and are free of charge. Luce5 replies within one month, which may be extended by two months in complex cases (Art. 12 GDPR). Anyone who believes that the processing infringes the GDPR can lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where they live or work, or bring proceedings before the courts (Articles 77 and 79 GDPR).
Luce5 does not take decisions based solely on automated processing, including profiling.
10. Other notices and updates
Other Luce5 notices: for job applicants, the privacy notice for job applicants (in Italian); for whistleblowing reports, the information and notice on the Whistleblowing page; for customers, suppliers and other business contacts, the dedicated notice, available on request at privacy@luce5.it.
Luce5 updates this notice when the processing changes. If the cookies that require consent change, the banner is shown again.
Last update
20/10/2026
Login
