Privacy Policy
Information on the Processing of Personal Data Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Last updated: 16 October 2026
This Privacy Policy explains how Luben Glass Srl processes the personal data of individuals who browse the website https://lubenglass.eu/, submit contact requests, use any restricted-access services or choose to receive marketing communications. Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree No. 196/2003, as subsequently amended, and other applicable provisions.
1. Data Controller
The Data Controller is:
Luben Glass Srl
Via Antonio Meucci, 23
26010 Offanengo (CR) – Italy
VAT No.: IT 00792980195
Telephone: +39 0373 244396
Fax: +39 0373 244401
Email: info@lubenglass.it
Website: lubenglass.eu
For information about the processing of personal data or to exercise the rights described below, you may contact the Data Controller at the email address provided. If a Data Protection Officer (DPO) has been appointed, their contact details must be made available to data subjects.
2. Categories of Personal Data Processed
2.1. Browsing data
While you browse the website, its IT systems may collect technical data that is inherently transmitted when using the Internet, such as IP addresses, dates and times of access, requested pages, browser and device information, system logs and technical error data. These data may be necessary for the operation and security of the website.
2.2. Data provided directly
When a user contacts Luben Glass Srl through forms, email or other channels, the following data may be processed: first name, surname, email address, telephone number, company, professional role, contents of the request and any other information voluntarily provided.
2.3. Data relating to any restricted area
If a user requests or uses an account, the following data may be processed: identification and professional details, email address, account management information, authentication credentials (handled using appropriate security measures) and technical access records.
2.4. Marketing communication preferences
If a user subscribes to newsletters or other promotional communications, the Data Controller may process contact details, stated preferences and information necessary to document consent and any subsequent withdrawal of consent.
3. Purposes and Legal Bases of Processing
3.1. Website operation and security
Technical data is processed to ensure that pages and services function correctly, manage security, prevent misuse and resolve technical issues. Legal basis: the Data Controller’s legitimate interest (Article 6(1)(f) GDPR), within the limits permitted by applicable law.
3.2. Responding to contact requests
Data provided by users is used to answer questions, handle requests for information and quotations, and provide sales or technical assistance. Legal basis: taking pre-contractual steps at the request of the data subject (Article 6(1)(b) GDPR), where applicable; otherwise, the legitimate interest in handling communications received (Article 6(1)(f) GDPR).
3.3. Registration and management of the restricted area
Where available, the restricted area requires the processing of data necessary to assess access requests, create and manage accounts, provide access to content and protect restricted resources. Legal basis: taking pre-contractual steps or performing a contract, where applicable (Article 6(1)(b) GDPR), and the legitimate interest in security and access control (Article 6(1)(f) GDPR).
3.4. Promotional communications
With the data subject’s consent, contact details may be used to send newsletters, information about products and services, updates, invitations to events and other marketing communications. Legal basis: consent (Article 6(1)(a) GDPR), in compliance with Article 130 of Italian Legislative Decree No. 196/2003. Subscribing is optional and consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. Any specific statutory exceptions for communications to existing customers remain applicable.
3.5. Legal obligations and protection of rights
Data may be processed to comply with legal obligations (Article 6(1)(c) GDPR) and, where necessary, to establish, exercise or defend legal claims on the basis of the Data Controller’s legitimate interest (Article 6(1)(f) GDPR), where applicable.
4. Processing Methods and Security Measures
Personal data is processed using IT and electronic tools and, where necessary, paper-based systems, with technical and organisational measures appropriate to the risks, in accordance with Article 32 GDPR. Access to data is restricted to authorised persons and service providers who need to process it for legitimate purposes. The principles of lawfulness, fairness, transparency, data minimisation, purpose and storage limitation, integrity and confidentiality apply.
5. Whether Providing Data Is Mandatory
Providing the data marked as necessary in contact forms and registration procedures is required to handle the request or provide the service; failure to provide such data may prevent the request from being processed. Providing data for promotional purposes and giving the related consent are optional: refusing consent does not prevent users from browsing the website or submitting requests for information.
6. Recipients of Personal Data
Personal data may be processed by authorised personnel and disclosed, within the limits of the purposes described above, to categories of recipients such as:
- hosting and IT infrastructure providers;
- website development, maintenance and support providers;
- email, contact management, CRM or newsletter service providers, if actually used;
- consultants and professionals engaged to provide technical, administrative or legal services;
- distributors or sales representatives, where necessary to handle a user’s request;
- public authorities or other parties to whom disclosure is required by law.
Where service providers process data on behalf of the Data Controller, they are appointed as Data Processors pursuant to Article 28 GDPR, where required. Other recipients may act as independent controllers in accordance with applicable law. Personal data is not indiscriminately disclosed to the public.
7. Transfers of Data Outside the European Economic Area
In connection with international business relationships or the use of technology services, certain processing activities may involve transferring personal data to countries outside the European Economic Area. In such cases, the Data Controller must comply with Chapter V GDPR, relying, as appropriate, on an adequacy decision or the safeguards provided for in Article 46 GDPR, including Standard Contractual Clauses and any necessary supplementary measures. Information about transfers actually carried out and the safeguards adopted may be requested by emailing info@lubenglass.it.
8. Data Retention Periods
Personal data is retained for as long as necessary to fulfil the purposes for which it was collected and, where applicable, for any additional periods required by law. In particular:
- Technical data and logs: for as long as necessary for operational and security purposes, in accordance with the retention policies actually adopted.
- Contact requests: for as long as necessary to handle the request and any subsequent dealings, taking into account the nature of the contact and any need to protect legal rights.
- Restricted area: for the lifetime of the account and subsequently for as long as necessary to complete its closure, ensure security or comply with applicable obligations.
- Promotional communications: until consent is withdrawn or the end of the retention period determined and applied by the Data Controller in relation to the purpose.
- Administrative and contractual records: for the periods set by applicable law, ordinarily ten years for accounting records where required.
Once the applicable retention periods have expired, data is deleted or anonymised, unless further retention is necessary to comply with legal obligations or protect legal rights.
9. Cookies and Tracking Technologies
The website may use cookies or similar technologies. Technical cookies are necessary for the operation of requested features and do not require prior consent. However, the use of non-exempt analytics cookies and profiling or marketing cookies, if present, requires valid consent to be obtained before they are activated.
Users may manage their preferences through any consent management tools available on the website. For details of the cookies actually installed, their providers, purposes, durations and how to change preferences, please consult the website’s Cookie Policy once published.
10. External Links and Third-Party Services
The website may contain links to websites or platforms operated by third parties. Accessing those services may involve the processing of personal data by their respective operators acting as independent data controllers. Users are encouraged to read the relevant privacy notices. The same applies to any use of external messaging tools.
11. Rights of Data Subjects
In the cases and within the limits provided for in Articles 15–22 GDPR, data subjects have the right to:
- obtain access to their personal data;
- request the rectification of inaccurate data or completion of incomplete data;
- request the erasure of their data where the relevant conditions are met;
- obtain restriction of processing in the cases provided for by law;
- obtain data portability, where applicable;
- object to processing based on legitimate interests and, at any time, to direct marketing;
- withdraw consent without retroactively affecting the lawfulness of prior processing;
- benefit from the safeguards provided by Article 22 GDPR in relation to decisions based solely on automated processing.
Requests may be sent to info@lubenglass.it. As a rule, the Data Controller responds within one month of receipt, without prejudice to any extensions permitted by Article 12 GDPR. Exercising these rights is free of charge, subject to the exceptions provided for by law.
12. Right to Lodge a Complaint with a Supervisory Authority
If data subjects believe that the processing of their personal data violates applicable law, they may lodge a complaint with a competent supervisory authority pursuant to Article 77 GDPR. In Italy, the competent authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it. The right to seek a judicial remedy remains unaffected.
13. Children’s Personal Data
The website is primarily intended for business and professional users and is not designed to intentionally collect personal data from children. If the Data Controller becomes aware of processing that does not comply with applicable law, it will take the necessary measures, including deleting the data where required.
14. Updates to This Privacy Policy
The Data Controller may update this Privacy Policy to reflect changes in laws, organisational practices or technologies, as well as changes in the processing activities carried out. Updates will be published on this page with the revision date. Where necessary, additional information will be provided or fresh consent will be obtained.