Privacy Notice – Newsletter

PRIVACY NOTICE ON THE PROCESSING OF THE PERSONAL DATA

of visitors to the website www.ideagroup.it

pursuant to Articles 13 and 26 of Regulation (EU) 2016/679 (‘GDPR’) and Italian Legislative Decree 196/2003, as amended by Italian Legislative Decree 101/2018 (‘Italian Personal Data Protection Code’)

Last updated on 5 October 2026

This Privacy Notice explains how we process the personal data of individuals who visit the website https://www.ideagroup.it/ (hereinafter referred to as ‘Website’), use the contact forms available on the Website, or subscribe to the newsletter and marketing communications.

This Privacy Notice applies exclusively to the Website and not to any other websites that may be accessed via links. Separate privacy notices may be available on pages of the Website relating to specific services. The use of cookies and other tracking technologies on the Website is described in the Cookie Policy, available at https://www.ideagroupbathrooms.com/cookie-policy/.

1. Joint Controllers and contact details

Under Article 26 of the GDPR, personal data are processed jointly by:

Idea S.r.l. – Divisione Bagni
Via Marigonda, 3/1 – 31040 Gorgo al Monticano (Treviso, Italy)

Disenia S.r.l.
Via A. Carpenè, 21 – 33070 Brugnera (Pordenone, Italy)

(hereinafter jointly referred to as ‘Joint Controllers’).

The Joint Controllers have entered into an internal agreement setting out their respective responsibilities for the protection of personal data. Data subjects may request a copy of the key provisions of this agreement using the contact details provided below, and may exercise their rights against each Joint Controller individually.

Contact point for data subjects: privacy@ideagroup.it

2. Personal data processed

2.1 Browsing data

You can visit the Website without providing any personal data. Nevertheless, the IT systems and software that enable the Website to function automatically collect certain technical data as part of their normal operation. The transmission of these data is inherent in the use of Internet communication protocols. The data transmitted include the IP address of the device used, the URI/URL addresses of the resources requested, the time of the request, the numerical code indicating the status of the server’s response (success, error, etc.), and other parameters relating to the user’s operating system and IT environment.

These data are not collected for the purpose of identifying individuals. However, by their very nature, they could make it possible to identify users through processing and cross-referencing with data held by third parties. For this reason, the data are treated as personal data. The data help us check that the Website is working properly, keep it secure, compile aggregated statistics on how it is used and, if necessary, determine liability in cases of cybercrime targeting the Website.

2.2 Personal data provided voluntarily by the users

When users voluntarily send messages to the contact addresses provided on the Website or complete the forms on the Website, their contact details and any other personal data included in their messages are collected, to the extent necessary to respond to their requests. Users are advised not to include unnecessary personal data in their messages, particularly special categories of personal data as defined in Article 9 of the GDPR.

2.3 Data processing for newsletters and marketing communications

To send the newsletters and marketing communications, we process the email address and any other data provided at the time of subscription, the date on which and method by which consent was given or withdrawn, and the preferences expressed. We also process data collected through tracking pixels embedded in emails, as described in Paragraph 4.

2.4 Cookies and other tracking technologies on the Website

For information about the cookies and other tracking technologies used on the Website and how to manage your preferences, please see our Cookie Policy (https://www.ideagroupbathrooms.com/cookie-policy/).

3. Purposes of processing, legal bases and retention periods

Purpose of processing	Legal basis	Retention period
a) Website browsing, operation and security; aggregated statistics on Website usage.	The Joint Controllers’ legitimate interest in maintaining the proper operation and security of the Website (Article 6(1)(f) of the GDPR).	7 days, unless otherwise requested by the judicial authorities in connection with criminal investigations.
b) Responding to enquiries and providing the requested information.	Taking steps at the data subject’s request prior to entering into a contract (Article 6(1)(b) of the GDPR).	For the period necessary to deal with the request and for a further 12 months.
c) Administrative and accounting purposes, including compliance with applicable laws, regulations and European Union requirements.	Compliance with a legal obligation (Article 6(1)(c) of the GDPR).	For the duration of the contractual relationship and for a further period of 10 years following its termination (Articles 2220 and 2946 of the Italian Civil Code).
d) Direct marketing: sending newsletters, promotional communications about products and services, and invitations to corporate events and webinars, as well as conducting market research and statistical analysis, by automated means (email, SMS and MMS) or traditional methods, such as telephone calls with an operator.	Consent given by the data subject (Article 6(1)(a) of the GDPR; Articles 130(1) and (2) of the Italian Personal Data Protection Code). Consent is optional, and may be withdrawn at any time. The Joint Controllers rely on a single consent for the marketing purposes set out herein, in accordance with the Italian Data Protection Authority’s Guidelines on Promotional Activities and the Prevention of Spam of 4 July 2013.	Until such consent is withdrawn.
e) Tracking email opens using tracking pixels, to measure the effectiveness of the communications described in section (d) and adjust their content and frequency according to the recipient’s level of interest (see Paragraph 4).	Consent given by the data subject (Article 122 of the Italian Personal Data Protection Code; Article 6(1)(a) of the GDPR). Consent is requested together with the consent referred to in section (d), as permitted by the Italian Data Protection Authority’s Guidelines of 17 April 2026, but may be withdrawn separately.	Records of email opens and interactions by individual recipients are retained for 545 days from the date of detection.
f) Records of the data subject’s preferences (consents, withdrawals and objections).	Compliance with a legal obligation: proof of consent (Articles 6(1)(c) and 7(1) of the GDPR).	For as long as the data are processed and for 5 years after consent is withdrawn.
g) Establishing, exercising or defending the Joint Controllers’ rights in Court proceedings, where necessary.	The Joint Controllers’ legitimate interest in protecting their rights (Article 6(1)(f) of the GDPR).	Throughout the legal proceedings, until the time limit for any appeal has expired.

Once the retention periods set out above have elapsed, the data will be deleted or anonymised, subject to the technical timeframes required for deletion and backup procedures.

4. Tracking pixels in email communications

4.1 What are tracking pixels and what information do they collect

The newsletters and promotional emails sent by the Joint Controllers contain tracking pixels. These are very small images, generally transparent and therefore invisible to the recipient, which are hosted on a remote server rather than contained in the email itself. When the recipient opens the email and their email client downloads the images, the recipient’s device sends a request to the remote server, thereby recording the opening of the message.

Each tracking pixel is associated with a specific recipient and allows the following information to be collected:

whether and when (date and time) the email was opened, and how many times it was opened;
the device’s IP address, which can be used to estimate the recipient’s geographical location;
the type of device, operating system and email client used;
technical identifiers relating to the recipient and the email sent;
clicks on links contained in the email, recorded through link-tracking technology.

The tracking pixel does not provide access to the contents of the recipient’s email inbox or any of their other messages.

4.2 Why are tracking pixels used

The information collected through tracking pixels is used to:

check that communications have been delivered and measure their effectiveness (open and engagement rates);
improve the relevance, readability and presentation of messages;
tailor the frequency of emails to the recipient’s level of interest, including discontinuing email communications altogether for recipients who have not opened any communications for a prolonged period.

The information collected is not used to create individual commercial profiles.

4.3 Legal basis: consent

Tracking pixels can be used only if the recipient has given their consent (Article 122 of the Italian Personal Data Protection Code). In accordance with the Italian Data Protection Authority’s Guidelines of 17 April 2026 on tracking pixels in email communications, consent is requested only once, at the time of subscription, together with consent to receive promotional communications. Consent is entirely voluntary. Recipients who do not give their consent will not receive promotional communications, and their decision will not have any other consequences.

4.4 How to withdraw consent, including consent to tracking only

Every email contains a ‘Manage your Preferences’ link in the footer, which takes the recipient to a dedicated page where they can, at any time and free of charge:

unsubscribe from all communications (withdraw consent in full);
disable tracking only, while continuing to receive communications without tracking pixels (withdraw consent in part).

Alternatively, recipients may submit their request by email to privacy@ideagroup.it. Recipients who refuse or disable tracking will continue to receive communications and have unrestricted access to the Website and its services. The Joint Controllers keep a record of these choices so that they can be respected and documented. Withdrawing consent does not affect the lawfulness of any processing carried out prior to withdrawal.

Recipients can also change their email settings to prevent images from downloading automatically. However, this will block all images, including tracking pixels, rather than allowing tracking pixels to be disabled separately.

4.5 Circumstances in which consent is not required

The Italian Data Protection Authority’s Guidelines allow tracking pixels to be used without consent where their sole purpose is to generate anonymous, aggregate statistics on email opens, provided that the same pixel is used for all recipients of the same communication and technical data are anonymised; where they are used for security measures relating to user authentication; or where they are used in service communications that the Joint Controllers are required to send. Service communications sent by the Joint Controllers, such as replies to contact requests, do not contain tracking pixels.

4.6 Subscribers already on the mailing list

Users subscribed to the newsletter as at the date this privacy notice is updated will be informed of the use of tracking pixels in the first subsequent communication, which will provide details of how to disable tracking or unsubscribe.

4.7 Parties involved and data protection measures

The sending of communications and management of tracking pixels are handled by the MAGNEWS platform, which acts as a data processor under Article 28 of the GDPR and follows the Joint Controllers’ instructions.

The Joint Controllers incorporate data protection by design and by default into their processing activities (Article 25 of the GDPR). Each tracking pixel is associated with a non-intelligible, non-sequential identifier. The association between the identifier and the email address is maintained in an internal database, and the email address is not included in the request generated upon loading the pixel.

5. Nature of the data provision

Browsing data: these data must be collected to ensure that Internet communication protocols work correctly.
Contact form data: providing these data is optional, but any fields marked as required must be completed to enable us to respond. Without this information, we will be unable to reply to your enquiry.
Direct marketing and tracking pixels: consent is optional. If users do not give their consent or subsequently withdraw it, they will simply stop receiving marketing communications or will no longer be tracked. This will not affect their ability to browse the Website, receive responses to their enquiries or access any other services.

6. Processing methods

Personal data are processed predominantly using automated means by duly authorised and trained personnel. Processing is carried out for the period necessary to fulfil the purposes for which the data were collected and in accordance with the principles of lawfulness, purpose limitation and data minimisation, as set out in Article 5 of the GDPR. Technical and organisational security measures are adopted to safeguard personal data against loss, unlawful or improper processing, and unauthorised access.

7. Recipients of personal data

Personal data are not made publicly available. They may, however, be disclosed to the following categories of recipients:

providers of services for the management of information systems and telecommunications networks, including email services;
providers of website hosting, development and maintenance services;
providers of email distribution and marketing platforms, including the associated tracking technology;
professional firms and companies providing consultancy and support services;
the competent authorities, upon request or where required by law.

These parties act either as Data Processors (Article 28 of the GDPR) or, where they independently decide how and why personal data are processed, as independent data controllers. To request an up-to-date list of data processors, please contact privacy@ideagroup.it.

8. Transfers of personal data to countries outside the European Economic Area

Personal data are stored on servers within the European Union. If any service providers process data in countries outside the European Economic Area, transfers are made only to countries covered by an adequacy decision issued by the European Commission (Article 45 of the GDPR), or where appropriate safeguards are in place, such as the standard contractual clauses approved by the European Commission (Article 46 of the GDPR). To obtain further information about these transfers or a copy of the safeguards in place, data subjects may contact privacy@ideagroup.it.

9. Automated decision-making and profiling

The Joint Controllers do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or similarly significantly affect them (Article 22 of the GDPR). Information collected through tracking pixels is used exclusively for the purposes set out in Paragraph 4.2.

10. Minors

The Website and the Joint Controllers’ services are not intended for people under the age of 16, and the Joint Controllers do not knowingly collect personal data relating to minors. If personal data relating to minors are inadvertently collected, they will be deleted promptly, including upon request by a person exercising parental responsibility.

11. Rights of the data subject

The data subject may exercise the following rights at any time by submitting a request to privacy@ideagroup.it:

access to their personal data and to information concerning its processing (Article 15 of the GDPR);
rectification of inaccurate or incomplete personal data (Article 16 of the GDPR);
erasure of personal data in the cases provided for by law (Article 17 of the GDPR);
restriction of processing in the cases provided for by law (Article 18 of the GDPR);
data portability, including the right to receive personal data in a structured, commonly used and machine-readable format or to request its transmission to another data controller (Article 20 of the GDPR);
objection to processing based on legitimate interests and, at any time and without the need to provide reasons, to processing for direct marketing purposes, including where the objection relates exclusively to automated methods or exclusively to traditional methods of communication (Article 21 of the GDPR);
withdrawal of consent, either in full or solely in relation to tracking pixels (Article 7(3) of the GDPR), in accordance with the procedure set out in Paragraph 4.4. Such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal.

The Joint Controllers shall respond without undue delay and, in any event, within one month of receipt of the request. This period may be extended by a further two months where necessary, in view of the complexity and number of requests. The data subject shall be informed of any such extension (Article 12(3) of the GDPR). Exercising these rights is free of charge.

Any data subject who believes that the processing of their personal data infringes applicable data protection laws has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) under Article 77 of the GDPR, following the procedure outlined at www.garanteprivacy.it, or to seek a judicial remedy under Article 79 of the GDPR.

12. Updates to this Privacy Notice

This Privacy Notice may be revised from time to time. The date of the most recent update is shown at the beginning of the Notice. Any significant changes will be announced on the Website and, where relevant, notified by email to newsletter subscribers.