Privacy Policy

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”)

Last updated: July 2026

This Privacy Policy explains how LSI Lastem S.r.l. collects, uses, stores and protects the personal data of users who visit its corporate website and use the services made available through it.

LSI Lastem S.r.l. is committed to ensuring that all personal data are processed in accordance with the principles of lawfulness, fairness, transparency, data minimisation, storage limitation, integrity, confidentiality and accountability, pursuant to Regulation (EU) 2016/679 (the “GDPR”), Italian Legislative Decree No. 196/2003, as amended by Italian Legislative Decree No. 101/2018, and, where applicable, Regulation (EU) 2024/1689 (the “AI Act”).

1. DATA CONTROLLER

The Data Controller responsible for the processing of personal data is:

LSI Lastem S.r.l.

Via EX SP161 Dosso, 9
20049 Settala (MI), Italy

VAT No.: IT04407090150
Milan Economic and Administrative Register (REA): 1009921
Milan, Monza Brianza and Lodi Companies Register No. 04407090150

For any request concerning the processing of personal data, the Data Controller may be contacted using the contact details published on the corporate website.

Should a Data Protection Officer (DPO) be appointed, the relevant contact details will be published and kept up to date on the company website.

2. SCOPE

This Privacy Policy applies exclusively to the website operated by LSI Lastem S.r.l. and to the services provided through it.

It does not apply to third-party websites that may be accessed through hyperlinks on the website. Such third parties act as independent Data Controllers, and Users are advised to consult their respective privacy policies.

3. CATEGORIES OF PERSONAL DATA PROCESSED

The following categories of personal data may be processed when Users browse the website or use the services offered through it.

1. a) Browsing data

The IT systems and software procedures used to operate the website automatically collect certain data whose transmission is inherent in the use of Internet communication protocols.

These data may include, by way of example:

• IP address;
• domain name;
• URI of the requested resources;
• date and time of the request;
• HTTP method used;
• size of the file returned;
• server response code;
• browser used;
• operating system;
• browser language;
• device information;
• time spent on the website;
• browsing path.

These data are processed solely to ensure the proper operation of the website, maintain the security of IT systems, produce aggregated statistics and establish liability in the event of cybercrime.

Providing data marked as mandatory is necessary for the relevant request to be handled. Failure to provide such data will make it impossible to respond to the request.

1. b) Data provided voluntarily by the User

Users may voluntarily provide personal data by:

• completing the Contact form;
• requesting information;
• subscribing to the newsletter;
• sending communications by email on their own initiative;
• using any restricted areas of the website.

In such cases, the following data may be processed:

• first name and surname;
• email address;
• telephone number;
• company or organisation;
• job title or role;
• content of the communications sent;
• any other information voluntarily provided by the User.

1. c) Cookies and similar technologies

The website uses technical cookies and, subject to the User’s consent where required, analytics and profiling cookies.

Further information on the use of cookies is provided in the dedicated Cookie Policy.

4. PURPOSES OF PROCESSING

Personal data are processed for the following purposes.

1. a) Handling contact requests

To respond to requests submitted by Users.

1. b) Performance of contractual and pre-contractual obligations

To manage business relationships, requests for quotations, technical support and requested services.

1. c) Compliance with legal obligations

To comply with applicable European Union and national legal, tax, administrative and accounting obligations.

1. d) IT security

To protect IT infrastructure and prevent unauthorised access, fraud, cyberattacks and unlawful use of the website.

1. e) Statistical analysis

To produce aggregated statistics concerning the use of the website.

Where required by applicable law, these activities are carried out only with the Data Subject’s prior consent.

1. f) Direct marketing

To send informational, commercial or promotional communications by email, exclusively with the Data Subject’s prior consent, except in the cases permitted under Article 130 of Italian Legislative Decree No. 196/2003.

1. g) Protection of the Data Controller’s rights

To establish, exercise or defend legal claims in judicial or out-of-court proceedings.

5. LEGAL BASES FOR PROCESSING

Personal data are processed on the basis of one or more of the following legal grounds under Article 6 of the GDPR:

• the Data Subject’s consent;
• performance of a contract;
• taking steps at the Data Subject’s request prior to entering into a contract;
• compliance with a legal obligation;
• pursuit of the Data Controller’s legitimate interests, provided that such interests are not overridden by the Data Subject’s fundamental rights and freedoms;
• performance of a task carried out in the public interest, where applicable.

Any consent given may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

6. HOW PERSONAL DATA ARE PROCESSED

Personal data are processed in accordance with the principles set out in Article 5 of Regulation (EU) 2016/679 (the “GDPR”), using paper-based, electronic and digital tools, in ways strictly related to the purposes for which the data were collected and, in all cases, so as to ensure their security, confidentiality, integrity and availability.

The Data Controller implements appropriate technical and organisational measures pursuant to Article 32 of the GDPR to prevent:

• unauthorised access;
• loss, destruction or alteration of data;
• unlawful or unauthorised use;
• accidental or unlawful disclosure of information.

Security measures are periodically reviewed and updated in light of technological developments, identified risks and applicable legal requirements.

7. SECURITY MEASURES

LSI Lastem S.r.l. applies a personal data protection framework based on the principles of “privacy by design” and “privacy by default”, with the aim of ensuring that only the data necessary for the stated purposes are processed.

The main measures adopted include:

• authentication and access management;
• regular backups;
• antivirus and anti-malware protection;
• firewalls and security-monitoring tools;
• encryption of data, where appropriate;
• logging of administrative access;
• procedures for managing security incidents and personal data breaches;
• periodic training for personnel authorised to process personal data.

Access to personal data is permitted exclusively to authorised persons acting on the basis of documented instructions issued by the Data Controller.

8. PARTIES THAT MAY PROCESS PERSONAL DATA

Personal data may be processed by:

• authorised employees;
• contractors and collaborators;
• professional advisers;
• IT service providers;
• hosting providers;
• maintenance service providers;
• tax and legal advisers;
• cloud service providers;
• public bodies or competent authorities, where required by law.

Depending on the circumstances, these parties act as:

• persons authorised to process personal data;
• Data Processors pursuant to Article 28 of the GDPR;
• independent Data Controllers.

An up-to-date list of Data Processors may be requested from the Data Controller.

9. RECIPIENTS OF PERSONAL DATA

Personal data will not be made publicly available.

They may be disclosed only to parties that need to receive them for the purposes described in this Privacy Policy, including:

• judicial authorities;
• administrative authorities;
• law-enforcement agencies;
• public bodies;
• supervisory bodies;
• appointed professionals;
• companies belonging to the same corporate group, where necessary;
• IT service providers.

Any disclosure is made in accordance with the principles of necessity, data minimisation and proportionality.

10. TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES

Where the provision of website services requires personal data to be transferred to countries outside the European Economic Area (EEA), such transfers will take place exclusively in accordance with Articles 44–49 of the GDPR.

In particular, a transfer may be based on:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses (SCCs);
• Binding Corporate Rules, where applicable;
• one of the derogations provided for under Article 49 of the GDPR.

For transfers to organisations established in the United States, the Data Controller gives preference, where applicable, to providers participating in the EU–U.S. Data Privacy Framework.

Users may obtain further information about the safeguards adopted by contacting the Data Controller.

A list of the recipients and the safeguards applied is available upon request.

11. DATA RETENTION PERIODS

Personal data are retained for no longer than is necessary to fulfil the purposes for which they were collected.

Unless different statutory retention obligations apply, the following indicative retention periods are used:

Data category	Retention period
Contact requests	Up to 12 months
Quotations	Up to 12 months
Customer data	For the duration of the contractual relationship and for 10 years thereafter
Administrative and tax data	10 years
Newsletter data	Until consent is withdrawn
Security logs	Up to 12 months, unless required for investigative purposes
Cookies	As specified in the Cookie Policy

At the end of the applicable retention period, personal data will be deleted or anonymised, unless further retention is required by law.

12. THIRD-PARTY SERVICES

Third-party services may be used to operate the website.

The use of such services may involve the processing of personal data by the relevant providers, which act either as independent Data Controllers or as Data Processors.

By way of example, the website may use:

• Google Analytics 4, used only with the User’s prior consent through a Consent Management Platform (CMP), with IP address anonymisation and without sharing data for advertising purposes, where so configured;
• Google Fonts loaded from Google servers;
• Google Maps;
• YouTube;
• LinkedIn;
• Meta Platforms;
• X (Twitter);
• WPML;
• chatbot services: Dialogflow, Stripe, WooCommerce and Matomo;
• hosting services;
• Content Delivery Networks (CDNs);
• security tools;
• newsletter management platforms.

For each service, Users should refer to the relevant privacy policy published by the respective provider.

13. COOKIES AND TRACKING TECHNOLOGIES

The website uses technical cookies that are necessary for its proper operation.

Non-anonymised analytics, profiling or marketing cookies are installed only with the User’s prior consent, given through the relevant banner in accordance with the Guidelines issued by the Italian Data Protection Authority on 10 June 2021.

Users may change their cookie preferences at any time through the relevant Consent Management Platform (CMP), where available.

A complete list of the cookies used is available in the Cookie Policy.

14. USE OF ARTIFICIAL INTELLIGENCE SYSTEMS (REGULATION (EU) 2024/1689 – AI ACT)

LSI Lastem S.r.l. may use Artificial Intelligence (“AI”) systems in connection with its activities and the services offered through the website, in accordance with applicable personal data protection law and, where applicable, Regulation (EU) 2024/1689 on artificial intelligence.

Any use of AI systems is governed by the principles of:

• transparency;
• human oversight;
• security;
• reliability;
• proportionality;
• non-discrimination;
• protection of personal data.

Where a User interacts directly with an AI system, such as a chatbot, virtual assistant, support system or other automated service, this will be clearly disclosed in accordance with Article 50 of Regulation (EU) 2024/1689.

Any systems used are not intended to make autonomous decisions that produce legal effects concerning Data Subjects or similarly significantly affect them, unless specific information is provided and Article 22 of the GDPR is complied with.

LSI Lastem S.r.l. adopts appropriate organisational and technical measures to ensure that any AI systems are used safely, under appropriate control and in accordance with applicable law.

15. AUTOMATED DECISION-MAKING AND PROFILING

The Data Controller does not carry out solely automated decision-making, including profiling, that produces legal effects concerning the Data Subject or similarly significantly affects them, except as may be described in specific privacy information relating to individual services.

Should such processing be introduced in the future, Data Subjects will be informed in advance and may exercise the rights provided for under Articles 21 and 22 of the GDPR.

16. DATA SUBJECT RIGHTS

Where provided for by law, Data Subjects may exercise the rights granted under Articles 15–22 of the GDPR.

In particular, they have the right to:

• obtain confirmation as to whether personal data concerning them are being processed;
• access their personal data;
• obtain the rectification of inaccurate personal data;
• have incomplete personal data completed;
• obtain the erasure of personal data (the “right to be forgotten”);
• obtain restriction of processing;
• object to processing in the cases provided for by law;
• receive their personal data in a structured, commonly used and machine-readable format (data portability);
• withdraw consent previously given, without affecting the lawfulness of processing carried out before its withdrawal;
• not be subject to a decision based solely on automated processing in the circumstances provided for under Article 22 of the GDPR.

17. HOW TO EXERCISE DATA SUBJECT RIGHTS

Data Subjects may exercise their rights by submitting a request to the Data Controller using the contact details provided in this Privacy Policy.

Requests will be handled free of charge, except in the circumstances provided for under Article 12 of the GDPR, and a response will be provided within one month of receipt. This period may be extended where permitted by law.

The Data Controller may request additional information necessary to verify the identity of the person making the request.

18. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY

Where a Data Subject considers that the processing of their personal data infringes applicable law, they have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) pursuant to Article 77 of the GDPR, or to bring proceedings before the competent courts.

Further information is available on the Authority’s official website: www.garanteprivacy.it.

19. SYSTEM LOGS

For operational, security and maintenance purposes, the website and any third-party services may automatically collect system logs containing technical information such as:

• IP address;
• date and time of connection;
• device identifiers;
• security events;
• application errors.

This information is processed solely for IT security, abuse prevention and system maintenance purposes.

20. CHANGES TO THIS PRIVACY POLICY

LSI Lastem S.r.l. reserves the right to amend or update this Privacy Policy at any time, including as a result of:

• changes in legislation;
• decisions or measures adopted by the Italian Data Protection Authority;
• guidance issued by the European Data Protection Board (EDPB);
• developments in the services offered;
• the introduction of new technological tools or Artificial Intelligence systems.

The updated version will be published on the website together with the date on which it was last updated.

Where changes affect processing based on consent, consent will be requested again where required by law.

21. DEFINITIONS

For the purposes of this Privacy Policy, the definitions set out in Regulation (EU) 2016/679 (the GDPR) and, where applicable, Regulation (EU) 2024/1689 (the AI Act) apply.

In particular:

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data.
• Data Subject: the natural person to whom the personal data relate.
• Data Controller: the person or entity that determines the purposes and means of processing.
• Data Processor: the person or entity that processes personal data on behalf of the Data Controller.
• Artificial Intelligence system: a system as defined in Article 3 of Regulation (EU) 2024/1689.

22. LEGAL REFERENCES

This Privacy Policy has been prepared in accordance with:

• Regulation (EU) 2016/679 (the “GDPR”);
• Regulation (EU) 2024/1689 (the “AI Act”);
• Directive 2002/58/EC (the “ePrivacy Directive”), as implemented in Italian law;
• Italian Legislative Decree No. 196 of 30 June 2003 (the “Personal Data Protection Code”), as amended by Italian Legislative Decree No. 101/2018;
• decisions and guidelines issued by the Italian Data Protection Authority;
• guidance and guidelines issued by the European Data Protection Board (EDPB).