Light Metal Carpentry

1. Data Controller

The Data Controller for personal data collected through the website www.lafre.it is:
LAFRE srl

Registered office: Via Penella 43, 25079 Vobarno (BS), Italy
VAT Number / Tax Code: 02119670988
Phone: +39 0365 599327
Email: info@lafre.it
Website: www.lafre.it

For any questions regarding the processing of personal data, the data subject may contact the Controller at the above details.

2. Personal Data Collected

2.1 Browsing data

The computer systems and software procedures used to operate this website automatically acquire certain personal data during normal operation. This information is not collected for the purpose of being associated with identified individuals, but could, through processing and association with data held by third parties, allow users to be identified. This category includes:

• IP address of the device used
• Browser type and operating system
• Date and time of visit
• Pages visited and browsing path
• Referring website (referrer)

2.2 Data voluntairly provided by the user

The optional, explicit, and voluntary sending of messages to the contact addresses listed on the website (email, phone, contact forms) results in the acquisition of the sender’s data necessary to respond, which may include:

• First and last name
• Email address
• Phone number
• Company name and VAT number (for B2B clients/suppliers)
• Any data freely included by the user in the message

2.3 Cookies

The website www.lafre.it uses technical cookies necessary for the correct functioning of its pages. Subject to the user’s consent, analytical and profiling cookies, including third-party cookies, may also be used to improve the browsing experience, analyse traffic, and display personalised content. For detailed information, please refer to the Cookie Policy available on the website.

3. Purposes and Legal Bases of Processing

Personal data are processed for the following purposes:

3.1 Handling contact requests and quotations

Legal basis: performance of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR). Data are processed to respond to requests for information, quotations, and consultations submitted via the website or company contacts.

3.2 Contract performance

Legal basis: performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR). Data of clients and suppliers are processed to manage orders, supplies, and all contractual obligations related to the sheet metal processing services offered by LAFRE srl.

3.3 Tax and accounting compliance

Legal basis: legal obligation (Art. 6(1)(c) GDPR). Data are processed to fulfil obligations under applicable tax, accounting, and civil law (e.g. issuing invoices, bookkeeping).

3.4 Website statical analysis

Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR), or the user’s consent (Art. 6(1)(a) GDPR) in the case of profiling cookies. Browsing data are used for aggregate statistical purposes to improve the website and services offered.

3.5 Marketing and commercial communications

Legal basis: explicit consent of the data subject (Art. 6(1)(a) GDPR). Only with explicit prior consent may data be used to send commercial communications, newsletters, and updates on LAFRE srl’s services. Consent may be withdrawn at any time.

4. Methods of Processing

Personal data are processed using electronic and telematic tools, with organisational procedures and logic strictly related to the stated purposes. Data are processed exclusively by authorised personnel duly instructed by the Controller. Appropriate technical and organisational security measures are in place to protect data against unauthorised access, loss, destruction, or unlawful disclosure.

5. Data Retention

Personal data are retained for no longer than necessary to fulfil the purposes for which they were collected, and specifically:

• Browsing data: maximum 12 months from collection
• Contact request data without subsequent contract: maximum 24 months from the last communication
• Data relating to executed contracts: 10 years from the conclusion of the contract, in compliance with applicable tax and civil law obligations
• Data processed on the basis of consent for marketing: until consent is withdrawn

Upon expiry of the above periods, data will be permanently deleted or irreversibly anonymised.

6. Recipients of Data

Personal data may be shared with:

• Providers of IT and website hosting services, acting as Data Processors pursuant to Art. 28 GDPR
• Tax, accounting, and legal consultants within the scope of their professional mandates
• Banking institutions for payment management
• Public, judicial, or supervisory authorities, where required by law

Data are not sold or transferred to third parties for their own purposes.

The website uses third-party services that may collect data, including Google Analytics for traffic analysis. For any transfers of data to non-EU countries in connection with such services, the Controller ensures that appropriate safeguards under the GDPR are applied (e.g. European Commission adequacy decisions, Standard Contractual Clauses).

7. Rights of Data Subjects

As a data subject, under Articles 15–22 of the GDPR, you have the right to:

• Access (Art. 15): obtain confirmation as to whether personal data concerning you are being processed and, if so, access to that data
• Rectification (Art. 16): obtain rectification of inaccurate personal data or completion of incomplete data
• Erasure (Art. 17): obtain the erasure of personal data (“right to be forgotten”), in the cases provided for by applicable law
• Restriction (Art. 18): obtain restriction of processing where the conditions set out in the applicable law are met
• Data portability (Art. 20): receive personal data provided to the Controller in a structured format and transmit them to another controller
• Objection (Art. 21): object at any time to the processing of personal data for reasons related to your particular situation, or for direct marketing purposes
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise your rights, please contact the Data Controller at:

• Email: info@lafre.it
• Post: LAFRE srl – Via Penella 43, 25079 Vobarno (BS), Italy

The Controller will respond to your request within 30 days of receipt. In the case of particularly complex or numerous requests, this period may be extended by a further 60 days, with prior notice to the data subject.

8. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. In Italy, the competent authority is:

Garante per la Protezione dei Dati Personali (Italian Data Protection Authority)

Piazza Venezia n. 11 – 00187 Rome, Italy
Tel. +39 06 69677 1  |  Fax +39 06 69677 785
Email: garante@gpdp.it  |  PEC: garante@pec.gpdp.it
Website: www.garanteprivacy.it

You may also lodge a complaint with the supervisory authority of the EU Member State where you habitually reside or work, or where the alleged infringement took place.

9. Updates to rhis Privacy Policy

This Privacy Policy may be updated from time to time, including as a result of changes in applicable law. We therefore invite you to check this page periodically. In the event of material changes, the Controller will provide appropriate notice.

Last updated: 17 June 2026