Privacy Policy

Information on the processing of personal data – art. 13 of Regulation (EU) 679/2016 ("GDPR")

This Privacy Policy describes how Atala S.p.A. processes personal data of users ("Users") who visit the website www.atala.it (the "Site").

Data Controller and Contact Details

Atala S.p.A., Via della Guerrina 108, 20900 Monza (MB), Italy – VAT: 02651030278
Email: marketing01@atala.it
Postal address: Via della Guerrina 108, 20900 Monza (MB), Italy

Categories of Personal Data

• Browsing data (e.g., IP address, device and browser type, pages visited, date/time of access, session duration, referral URL), collected through technical logs and cookies necessary for Site operation.
• Voluntarily provided data (e.g., name, surname, email, country, city, phone, purchase details, product serials) when Users complete forms (contact, warranty/registration, newsletter, dealer requests, test-ride).
• Communication content (messages sent via forms or email) and support metadata (ticket ID, timestamps).
• Marketing/analytics data where consented (e.g., preferences, campaign source, interactions with newsletters).

Purposes and Legal Bases for Processing

We process personal data for the following purposes and under the legal bases indicated by the GDPR:

• Site operation & security (load balancing, fraud prevention, diagnostics): legitimate interest (art. 6(1)(f)).
• Responding to enquiries sent via contact forms or email: pre-contractual measures / contract performance (art. 6(1)(b)) or legitimate interest (art. 6(1)(f)).
• Product registration, warranty handling, after-sales support: contract performance (art. 6(1)(b)) and legal obligations (art. 6(1)(c)).
• Newsletter / marketing communications: consent (art. 6(1)(a)). Users may withdraw consent at any time.
• Statistical analytics and performance measurement (on aggregated or pseudonymised data): consent for non-essential cookies (art. 6(1)(a)) or legitimate interest where permitted and proportionate (art. 6(1)(f)).
• Compliance with legal obligations (e.g., accounting, product safety): legal obligation (art. 6(1)(c)).
• Defense of rights in or out of court: legitimate interest (art. 6(1)(f)).

Cookies and Similar Technologies

The Site uses technical cookies (strictly necessary) and, subject to consent, analytical/marketing cookies. Full details are available in our Cookie Policy and in the cookie banner where you can manage preferences at any time.

Categories of Recipients

• Internal personnel duly authorised and trained for data processing.
• Service providers / processors (e.g., hosting, CRM, marketing automation, analytics, customer support, logistics) engaged under art. 28 GDPR.
• Dealers / authorised service centres for warranty and after-sales activities where applicable.
• Public authorities and legal consultants where required by law or for the defence of rights.

International Data Transfers

Data are primarily processed within the European Union. Where transfers outside the EEA occur, Atala ensures appropriate safeguards under arts. 44–49 GDPR (e.g., adequacy decisions, Standard Contractual Clauses, supplementary measures).

Data Retention

• Browsing logs: for security/diagnostics, typically a short period compatible with operations (e.g., 7–30 days) unless extended for investigations.
• Warranty and service data: for the duration of the contractual relationship and statutory limitation periods.
• Accounting/legal data: as required by applicable law (e.g., 10 years in Italy for certain records).
• Marketing data: until consent withdrawal or periodic re-consent per industry best practice.

Nature of Provision

Providing data for contractual and support purposes is necessary to deliver requested services; refusal may prevent fulfilment. Providing data for marketing/analytics is optional and subject to consent.

User Rights

Users may exercise the rights provided by arts. 15–22 GDPR, including:

• Access to personal data and information on processing;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten");
• Restriction of processing in the cases provided by law;
• Portability of data provided on the basis of consent/contract and processed by automated means;
• Objection to processing based on legitimate interest, including profiling; and withdrawal of consent at any time for consent-based processing, without affecting lawfulness before withdrawal.

Requests can be sent to: marketing01@atala.it. Users also have the right to lodge a complaint with the competent Supervisory Authority.

Minors

The Site and services are intended for general audiences. Where consent is required and the user is a minor, consent must be given or authorised by the holder of parental responsibility in accordance with applicable law.

Automated Decision-Making

No decisions producing legal effects based solely on automated processing, including profiling, are taken.

Policy Updates

We may update this Privacy Policy to reflect changes in processing activities or legal requirements. The latest version is published on this page.

Contacts

To exercise your rights or for any privacy question:

Email: marketing01@atala.it
Postal: Via della Guerrina 108, 20900 Monza (MB), Italy

Information updated on January 12, 2026