Privacy policy.

01. Who processes your data

The data controller is MIGAL S.R.L., with its registered office at: Via Serafino Pionati, 12 — 83100 Avellino (AV), Italy. VAT number 02547690640, tax code 02547690640. Operating address: Via Consolazione, 18, 83029 Solofra (AV), Italia.

For information or to exercise your rights, write to info@conceriamigal.it. Certified email (PEC): migal@arubapec.it.

02. What data we collect

Contact enquiries: your full name, email address, subject and message, plus your company and telephone number only if you provide them. The email records the version of the privacy notice you acknowledged. We do not request identity documents, payment details or special categories of personal data. Please do not include sensitive information in your message.

Browsing and security: the server receives your IP address, date and time, requested resource, technical browser information and response codes. The application’s abuse-prevention system stores only pseudonymised identifiers derived from IP addresses and, for sending limits, email addresses, together with timestamps and random tokens. Message content is not saved in the website database. The hosting provider may process separate technical logs.

Cookies: the form uses an essential session cookie for security and submission confirmation. No analytics, advertising, fingerprinting or third-party CAPTCHA is integrated. See our cookie policy.

03. Why we use your data

Responding to enquiries and developing proposals

For enquiries from a prospective customer who is an individual, necessary processing is based on pre-contractual steps requested by that person (Article 6(1)(b) GDPR). For company representatives and general business enquiries, it is based on the controller’s legitimate interest in handling communications (Article 6(1)(f)), subject to balancing that interest against the individual’s rights and reasonable expectations.

Protecting the website and preventing abuse

Validation, submission limits and spam prevention serve the legitimate interest in keeping the service secure and available (Article 6(1)(f) GDPR). An automatic form restriction does not prevent you from contacting us by email or phone.

Meeting obligations and protecting rights

Where necessary, relevant data is processed to meet legal obligations (Article 6(1)(c) GDPR) or to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).

The checkbox on the form acknowledges that you have read this notice. It is not marketing consent. We do not use these contacts for newsletters or advertising.

04. Is providing data mandatory?

You can browse the website without completing the form. Fields marked * are needed to handle your enquiry; the form cannot be submitted without them. Your company and phone number are optional. You may instead use our direct contact details; this privacy notice also applies to those enquiries.

05. How and for how long

Data is handled using IT systems, with access limited to authorised people. Form submissions are forwarded to the company mailbox over an encrypted SMTP connection. The website does not keep copies of messages in its database.

• Enquiries that do not lead to a contractual relationship: for the time necessary to handle and follow up the enquiry, subject to legal obligations or the need to protect rights.
• Enquiries that lead to a contract: relevant data becomes part of managing that relationship, subject to the retention periods for the related records and the applicable privacy notice.
• Form abuse-prevention records: valid for up to one hour. Expired records are deleted on the next visit to the form or by scheduled cleanup. They do not contain the message, name, or unencrypted IP/email addresses.
• Session cookie: for the browser session. Session restoration may retain it longer. Form security tokens expire after one hour.

Retention and deletion must also cover copies held in mailboxes and backups. The application cannot delete data held by external providers.

06. Who can access the data

Data is accessible to authorised people handling enquiries and to providers needed to operate the service, in their respective roles. Where acting on the controller’s behalf, providers must be appointed as processors under Article 28 GDPR. We do not sell or publicly disclose personal data.

Email services

Aruba S.p.A.

Data may be shared with advisers or authorities where necessary to meet legal obligations or protect rights, within the applicable limits.

07. Where data is processed

Any transfers outside the European Economic Area must meet the conditions in Chapter V GDPR. These may include an applicable adequacy decision or standard contractual clauses, together with the necessary assessments and safeguards.

08. Your rights

Where the legal conditions apply, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests. If processing were based on consent, you could withdraw it without affecting the lawfulness of earlier processing.

Write to info@conceriamigal.it. We normally respond within one month. If an extension permitted by law is needed, we will explain the reasons and timeframe. Requests are normally free of charge, and any identity checks are proportionate.

You may lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority, and seek a judicial remedy.

09. Automated decisions and updates

We do not carry out profiling or solely automated decisions that produce legal or similarly significant effects. Spam checks protect the form while leaving direct contact channels available. We will update this notice when services, purposes or processing activities change and show the date of the revised version.