Your cart

Privacy Policy

MANTERO SETA S.p.A.

WHY THIS INFORMATION?

This page describes how your personal data are processed. This is an information notice provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter “GDPR”).

 

INDEX
Personal data
How to purchase
Cookies
Data processing
Data protection
Purposes of the processing, legal basis and data retention
Data recipients
Data transfer
Process automation
Recognition and exercise of your rights 

 

PERSONAL DATA

  • Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural, or social identity of that natural person (Recitals 26, 27, 30 GDPR).
  • Browsing Data: The information systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. Such information is not collected in order to be associated with identified data subjects but, by its very nature, could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or the domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment.
  • Data Provided by the Data Subject: the optional, explicit, and voluntary sending of messages to the contact addresses indicated on this website and/or the completion of data collection forms entails the subsequent acquisition of the sender’s address, which is necessary to respond to requests, as well as any other personal data provided.
  • Information on the Processing of Personal Data Carried Out Through Social Media Platforms: with regard to the processing of personal data carried out by the operators of the social media platforms used by the Data Controller, please refer to the information provided by such operators through their respective privacy policies. The Data Controller processes the personal data provided by users through the dedicated social media platform pages in order to manage interactions with users (comments, public posts, etc.), in compliance with applicable legislation.
  • Specific Information Notices: specific information notices will be provided on the website pages in relation to particular services or specific data processing activities.

 

HOW TO PURCHASE PRODUCTS ON THIS WEBSITE?

Please refer to the Sales Terms and Conditions.

 

COOKIES. WHAT ARE COOKIES? WHAT ARE COOKIES USED FOR?

Cookies are small text files that the websites visited by users send to their devices, where they are stored in order to be transmitted back to the same websites upon the user’s subsequent visits. So-called “third-party” cookies, on the other hand, are set by a website other than the one the user is visiting. This occurs because each website may contain elements (images, maps, sounds, specific links to web pages hosted on other domains, etc.) that reside on servers different from that of the visited website. Cookies are used for various purposes, including the execution of computer authentication processes, session monitoring, storage of information relating to specific configurations regarding users accessing the server, storage of preferences, and others. For further information on the cookies used by this website, please refer to the cookie policy available in the website footer and at the following link https://www.mantero.com/en/pages/cookie-policy.

 

WHO IS THE DATA CONTROLLER? HOW CAN IT BE CONTACTED?
The Data Controller is MANTERO SETA S.P.A., with registered office at Via Riccardo Mantero no. 15, 22070 Grandate (CO), Italy, Tax Code/VAT No. 02387120138, acting through its legal representative pro tempore. Contact details of the Data Controller: privacy@mantero.com.

 

HAS A DATA PROTECTION OFFICER BEEN APPOINTED? WHAT ARE THEIR CONTACT DETAILS?
The Data Controller has appointed its Data Protection Officer (DPO) pursuant to Articles 37, 38, and 39 of the GDPR. The DPO may be contacted at the registered office of the Data Controller indicated above or by e-mail at: dpo.manteroseta@dpoprofessionalservice.it.

 

PURPOSES OF THE PROCESSING, LEGAL BASIS, DATA RETENTION PERIOD, AND NATURE OF THE PROVISION OF DATA

 PURPOSES OF THE PROCESSING LEGAL BASIS DATA RETENTION PERIOD NATURE OF THE PROVISION

Browsing the website: to allow users to browse this website.

The data necessary for the use of web services are also processed for the purpose of:

  • Obtaining statistical information on the use of the services (such as the most visited pages, number of visitors by time slot or daily basis, geographical areas of origin, etc.);
  • Monitoring the correct functioning of the services provided.

The data may also be used to ascertain liability in the event of hypothetical cybercrimes to the detriment of the website.

 The processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by third parties, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, taking into account the reasonable expectations of the data subject and the processing activities strictly necessary for the operation of the website and for browsing itself (Article 6(1)(f) and Recital 47 of the GDPR). For the duration of the browsing session. Please refer to the section relating to cookies. The provision of the data is necessary for browsing the website.

For the use of cookies and similar technologies, please refer to the cookies policy available in the website footer.

 For marketing and profiling cookies the processing is based on the data subject’s consent to the processing of personal data (Article 6(1)(a) and Recitals 42 and 43 of the GDPR).
Consent is given through the website’s banner and cookies policy.		 For cookies please refer to the cookie policy available in the website footer. Please refer to the cookie policy available in the website footer.

In addition to what is specified for browsing, personal data will be processed for the following purposes:

PURPOSES OF THE PROCESSING LEGAL BASIS DATA RETENTION PERIOD NATURE OF THE PROVISION
A) Contacts, information request and customer care: through the contact details provided or by filling in the specific form available on our website, we will collect and respond to your requests and provide you with assistance for any needs related to the use of this e-commerce platform, the purchase of our products, and the use of our services. The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the same (Article 6(1)(b) of the GDPR). The data will be retained for 30 days. The provision of data is necessary.
Failure to provide the data will result in the inability to obtain the requested information and to make use of the services of the data controller.
B) Registration on the Mantero 1902 website: creation and deletion of the e-commerce account and technical support assistance for the use of services reserved for registered users. The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the same (Article 6(1)(b) of the GDPR). Until the account is deactivated. The data subject may request the deletion of their account at any time by contacting the Controller using the contact details provided in this privacy notice. The provision of data is necessary in order to use the services of the Data Controller. Failure to provide the required data will result in the inability to register and make use of such services.
C) Direct marketing, for the sending of advertising or direct sales material or for carrying out market research, surveys, satisfaction analysis, or commercial and promotional communications, newsletters, by means of automated systems (e-mail, fax, SMS-type messages, instant messaging, chat, chatbots, video messages, direct messaging via social networks or other means) and by traditional methods (telephone and postal mail).
In order to compare and, where appropriate, improve the results of automated communications, the Data Controller uses reporting systems. Through such reports, the Data Controller may obtain information such as, by way of example: the number of readers, openings, unique clickers and clicks; the devices and operating systems used to view the communications; details regarding the activity of individual users; details of e-mails sent, delivered or not delivered, and forwarded e-mails.
All such data are used for the purpose of comparing and, where appropriate, improving the results of the communications.		 The processing is based on the consent to the processing of personal data (C42, C43) (Article 6(1)(a) of the GDPR). Until the account is deactivated. The account may also be automatically deleted by the platform used (Mailchimp) in the event of prolonged inactivity, in accordance with its applicable technical policies. The provision of data is optional.
Failure to provide the required data will result in the inability to receive marketing communications, without prejudice to the other purposes.
The sending of direct marketing communications by telephone and postal mail will take place in compliance with the regulations concerning the Public Register of Objections.
D) Profiling: to enable the Data Controller to create customer profiles and to analyse your habits, behaviours and consumption choices in order to improve the commercial offering and the services provided. The processing is based on the consent to the processing of personal data (C42, C43) (Article 6(1)(a) of the GDPR). Until the consent is withdrawn and, in any case, for a maximum period of 5 years. Thereafter, unless new consent is provided, the data will be anonymised. The provision of data is optional. Failure to provide the required data will result in the inability to carry out analyses and send targeted communications, without prejudice to the other purposes.
E) Online purchases and related administrative and accounting activities (e.g. order management, invoicing, payments, shipment fulfilment and handling of any returns, management of any credits, and fulfilment of related pre-contractual and contractual obligations). The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the request of the same (Article 6(1)(b) of the GDPR). 10 years from the purchase for administrative and accounting purposes. The provision of data is necessary. Failure to provide the required data will result in the inability to enter into and perform the contract for the purchase of goods offered by the Data Controller.
F) Customer satisfaction: sending of surveys to assess the level of customer satisfaction in order to improve the offering of products and services (no marketing). The processing is necessary for the pursuit of the legitimate interests of the Data Controller – Article 6(1)(f) and Recital 47 of the GDPR: the administration of surveys to assess satisfaction with the services provided, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking into account the reasonable expectations of the data subject based on their relationship (as a customer) with the Data Controller. Until objection is raised. The provision of data is necessary for the performance of the contractual relationship and for the pursuit of the legitimate interests of the Data Controller; however, you may object at any time to the processing of personal data for this specific purpose, without any negative consequences with regard to the contract and its performance, as well as to the other purposes indicated.
G) Soft spam: commercial and/or promotional information activities, newsletters sent by e-mail to the e-mail address provided by you at the time of sale, relating to the same category of products and/or services similar to the product/service purchased – Article 130, paragraph 4 of Legislative Decree no. 196/2003 / legitimate interest (Article 6(1)(f) of the GDPR), unless objection is raised. The processing is necessary for the pursuit of the legitimate interest of the Data Controller in sending commercial and promotional communications by e-mail to the e-mail address provided at the time of sale, relating to the same category of products and/or services (Soft Spam) similar to the product/service purchased, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking into account the reasonable expectations of the data subject (as a customer) based on their relationship with the Data Controller (Article 6(1)(f) and Recital 47 of the GDPR). Until objection is raised. The provision of data is necessary at the time of sale and, subsequently, for the sending of so-called soft spam communications. As the data subject, you have the right to object at any time to the processing of personal data for the stated purpose and you will no longer receive such communications. Any objection, even if raised after the receipt of such e-mail communications, will not affect the contract, nor the other purposes indicated.
H) Prevention and management of disputes and other legal matters, as well as defence in legal proceedings. The processing is necessary for the pursuit of the legitimate interest of the Data Controller in protecting its own rights, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (Article 6(1)(f) and Recitals 47–50 of the GDPR). Unless an objection is raised, for the time necessary for defence in legal proceedings and, thereafter, for a period of 10 years. The provision of data is necessary.
Any refusal must be balanced against the legitimate interest of the Data Controller as indicated in the purposes of this section.
I) Management of requests relating to the protection of personal data and requests from other data subjects, pursuant to articles 15 et seq. of the GDPR (data subject rights). The processing is necessary to comply with a legal obligation to which the Data Controller is subject (C45), pursuant to Article 6(1)(c) of the GDPR. 5 years from the closure of the request, unless disputes arise. The provision of personal data is necessary, as it is essential in order to fulfil legal obligations (handling of your request within the statutory time limits).
L) “Work with us” area: staff selection; performance of recruitment and selection activities for the purpose of the potential establishment of an employment relationship, including for possible positions different from those for which the data subject has submitted an unsolicited application; retention of personal data also for future recruitment activities; management of applications submitted in response to job offers published on the organisation’s website; interviews and any video interviews (processing of image and/or audio data). The processing of personal data is necessary for the performance of pre-contractual measures, also taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR.
With regard to the processing of special categories of data, reference is made to General Authorisation No. 1/2016 issued by the Italian Data Protection Authority and to the applicable legislation on mandatory employment.		 As a general rule, the data collected during the recruitment process will be deleted as soon as it becomes clear that no offer of employment will be made or that the offer will not be accepted by the candidate. In any event, the maximum retention period shall be 36 months. The provision of personal data is necessary for the processing of data for recruitment purposes. Failure to provide the required personal data will result in the inability to apply.


TO WHOM WILL PERSONAL DATA BE DISCLOSED?
Your personal data will be disclosed, also on the basis of the purposes set out in specific sections, to parties who will process the data as independent Data Controllers or as Data Processors (Article 28 of the GDPR), and will be processed by natural persons (Article 29 of the GDPR) acting under the authority of the Data Controller and/or the Data Processors, on the basis of specific instructions provided regarding the purposes and methods of the processing, for specific purposes depending on the relevant area.
The data will be disclosed to recipients belonging to the following categories:
  • Parties providing services for the management of the website and communication networks, including e-mail services, hosting and website management, newsletter systems, etc.;
  • Parties supporting the Data Controller in the management of marketing activities;
  • Freelancers, firms or companies in the context of assistance and consultancy relationships;
  • Parties providing services for the management of the activities referred to in the purposes above (communication providers, press agencies, websites, etc.);
  • Commercial partners of the Data Controller, entities belonging to the distribution network, and service and logistics companies, couriers;
  • Competent authorities, upon request, for compliance with legal obligations and/or provisions issued by public authorities.

The list of Data Processors is constantly updated and is available upon request by writing to privacy@mantero.com.


DATA TRANSFERS
WILL THE DATA PROVIDED BE TRANSFERRED OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)?
The personal data provided for the purposes outlined above may be transferred abroad to countries outside the EEA in compliance with the limits and conditions set forth in Articles 44 et seq. of the GDPR.
In particular, the Data Controller has chosen to rely on service providers that offer adequate safeguards, specifically Shopify. For further information, please refer to: https://www.shopify.com/it/legal/termini.
With regard to payments, the personal data provided by you on the relevant platforms may be transferred abroad to countries outside the EEA, in compliance with the limits and conditions set forth in Articles 44 et seq. of the GDPR. The Data Controller has chosen to rely on service providers that offer adequate safeguards, specifically PayPal, Klarna, and Scalapay. For further information, please refer to https://www.paypal.com/it/legalhub/paypal/useragreement-full; 
https://www.klarna.com/it/legal/; https://www.scalapay.com/terms-and-conditions?country=IT.
With regard to the newsletter platform used by the Data Controller, known as “Mailchimp”, it should be noted that its provider, The Rocket Science Group / Intuit (USA), provides adequate safeguards. Specifically, this provider has adhered to the Data Privacy Framework, an adequacy decision that allows personal data to be transferred safely from the European Economic Area to participating U.S. companies without the need for additional data protection safeguards (Article 45 of the GDPR). For further information, please refer to: https://www.intuit.com/privacy/statement/.
You may obtain a copy of the safeguards applied to the data transfer by contacting the Data Controller at the following e-mail address: privacy@mantero.com.

IS THERE AN AUTOMATED DECISION-MAKING PROCESS?
Personal data will be processed in paper, manual, electronic and automated form. In particular, subject to your specific consent, the data will be processed in an automated manner — through data comparison systems — in order to improve the Data Controller’s commercial offering and services, by creating the data subject’s profile and analysing their habits and consumption choices, with the aim of presenting proposals and offers that are aligned with your preferences (profiling).
For further details, you may contact the Data Controller at the following e-mail address: privacy@mantero.com.

WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?
You may exercise your rights as set forth in Articles 15 et seq. of the GDPR by contacting the DPO/Data Protection Officer at the following e-mail address: dpo.manteroseta@dpoprofessionalservice.it or by contacting the Data Controller at privacy@mantero.com or through the other contact details indicated above.
At any time, you have the right to request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17), and restriction of processing (Article 18). The Data Controller shall communicate (Article 19) to each of the recipients to whom the personal data have been disclosed any rectification or erasure of personal data or restriction of processing carried out in
accordance with Articles 16, 17(1) and 18 of the GDPR. The Data Controller shall inform the data subject of those recipients if the data subject so requests.
Furthermore, in the cases provided for the forms available in specific sections, you have the right to data portability (Article 20); in such case, your data will be provided in a structured, commonly used and machine-readable format. You also have the right to object (Article 21), at any time, to the processing of personal data based on legitimate interest, and—where processing is based on such legal ground—you may request information regarding the balancing test carried out by the Data Controller.
In addition, you have the right to withdraw any consent given, without prejudice to the lawfulness of processing based on consent prior to its withdrawal.
  • To stop receiving automated direct marketing communications (e-mail, fax, SMS-type messages, instant messaging, chat, chatbots, video messages, direct messaging via social networks or other means), you may send an e-mail at any time to privacy@mantero.com with the subject line “no automated marketing”, or use the automatic unsubscribe systems provided for e-mails only.
  • To stop receiving traditional direct marketing communications (calls with an operator and postal mail), you may send an e-mail at any time to privacy@mantero.com “no traditional marketing”.
  • To stop receiving any marketing communications, you may send an e-mail at any time to privacy@mantero.com with the subject line “no marketing”.
  • You may also withdraw your consent to profiling at any time by sending an e-mail to privacy@mantero.com with the subject line “no profiling”.
Please also refer to the specific privacy notices relating to processing activities carried out in specific sections. If you believe that the processing of your personal data by the Data Controller is in breach of the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (https://www.garanteprivacy.it/), or to bring an action before the competent judicial authorities.

CHANGES TO THIS PRIVACY NOTICE
The Data Controller reserves the right to amend, update, add to or remove parts of this privacy notice. In order to facilitate the review and any amendments to the text, this privacy notice shall indicate the date of the last update.

 

Last updated: 14 April 2026

Thanks for subscribing