1. Data controller
The data controller is SRAGROUP S.r.l., registered office at Via Fabio Filzi 27, 20124 Milano (MI), VAT No. 12345678903.
For any request about personal data you can write to info@sragroup.it.
2. Data we process
Browsing data: the servers hosting the website automatically log IP address, date and time, requested page and browser type to keep the service running and secure.
Data provided through the request form: chosen division, project details (type, area or power, location, timeline), first name, last name, company, role, email, phone, message and any attachment.
Proof of consent: together with the request we record date and time, page and language of submission, IP address and the choices made on privacy and marketing communications.
3. Purposes and legal basis
Answering information and quote requests and managing the resulting business contacts: pre-contractual measures (Art. 6(1)(b) GDPR).
Protecting the form from abuse and automated submissions, using technical checks that rely on no cookies or external services: the controller's legitimate interest (Art. 6(1)(f) GDPR).
Sending marketing communications and updates, only if you gave the optional consent in the form: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Complying with legal, tax and accounting obligations: legal obligation (Art. 6(1)(c) GDPR).
4. Whether providing data is required
Fields marked as required are needed to answer your request: without them we cannot follow up.
Consent to marketing communications is optional, and refusing it has no effect on how your request is handled.
5. How data is processed
Requests are stored in SRAGROUP's internal management system, hosted on our hosting provider's servers, and only authorised staff of the relevant division can access them with personal credentials.
We apply appropriate technical and organisational measures: encrypted connection (HTTPS), protected passwords, logged access and attachments that are not publicly accessible.
6. Retention period
Requests and their attachments: 24 months from the last contact; if the request leads to a contract, 10 years as required by civil and tax law.
Data for marketing purposes: until consent is withdrawn.
Browsing data: as long as needed for the security of the service and no longer than 12 months, unless required to investigate offences.
You can ask for earlier deletion of your data at any time.
7. Recipients
Data is processed by authorised SRAGROUP staff and may be shared with the providers that support us as processors (Art. 28 GDPR): hosting of the website and management system, email service and IT support.
To display its typefaces the website uses Google Fonts, which receives the visitor's IP address. The Google Maps map on the Contact page loads only after your consent or your click.
Data is not disclosed to the public or sold to third parties.
8. Transfers outside the European Union
Using Google services may involve transferring data to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission (Art. 45 GDPR).
9. Your rights
You can exercise at any time your rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 GDPR) and withdraw consent, without affecting the lawfulness of earlier processing, by writing to info@sragroup.it.
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
10. Changes
This notice may be updated; the date of the last update is shown at the top of the page.