How we process personal data

Last updated: 22 July 2026

This notice describes how WDR S.r.l.s. processes the personal data of users who visit this website or use its contact form, in accordance with Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation concerning personal data protection and tracking technologies.

1. Data Controller

The Data Controller is:

WDR S.r.l.s.
Via A. Diaz 5
35031 Abano Terme (PD), Italy
Email: info@wdritaly.com

Any request concerning the processing of personal data or the exercise of data protection rights may be sent to the email address indicated above.

2. Personal data processed

The following categories of personal data may be processed through the website.

2.1 Browsing and technical data

During their normal operation, the IT systems and procedures used to operate the website automatically collect certain technical data, including:

• IP address;

• date and time of the request;

• page or resource requested;

• address of the referring page;

• browser type and operating system;

• information about the device used;

• server response codes;

• technical data required for the security and proper operation of the website.

These data are generally processed automatically and are not used by the Data Controller to directly identify the user, except where necessary to ensure website security, establish liability or comply with legal obligations.

2.2 Data submitted through the contact form or by email

When a user submits the contact form or writes to the Data Controller’s email address, the following data may be processed:

• first name and surname;

• email address;

• telephone number or company name, where provided;

• content of the request;

• any other information or documents voluntarily submitted by the user.

Users are asked not to include special categories of personal data in their messages, such as information concerning health, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, unless this is strictly necessary.

2.3 Statistical data collected through Google Analytics

Subject to the user’s consent, the website uses Google Analytics 4 to obtain statistical information about website usage, including:

• pages visited;

• session duration and activity;

• interactions with website pages;

• approximate source of the visit;

• device type, browser and operating system;

• online identifiers associated with analytics cookies.

The Data Controller does not use Google Analytics for remarketing, advertising profiling or ad personalisation and does not knowingly send directly identifying information to Google, such as names, email addresses or telephone numbers.

Google Analytics is managed through Google Tag Manager.

3. Purposes and legal bases of processing

3.1 Website operation and security

Technical and browsing data are processed in order to:

• ensure the proper display and operation of the website;

• protect the security of systems;

• prevent abuse, fraud, unauthorised access and cyberattacks;

• diagnose technical problems;

• establish liability in the event of unlawful online activity.

The legal basis is the Data Controller’s legitimate interest in maintaining the security and proper operation of the website, pursuant to Article 6(1)(f) of the GDPR, as well as compliance with any applicable legal obligations.

3.2 Managing contact requests

Data provided by users are processed in order to:

• receive and manage requests;

• respond to users’ questions;

• provide information about the Data Controller’s services;

• prepare quotations where requested;

• carry out pre-contractual activities requested by the user;

• retain correspondence where necessary to protect the Data Controller’s rights.

The legal basis is the performance of pre-contractual measures taken at the data subject’s request or the performance of a contract, pursuant to Article 6(1)(b) of the GDPR.

For general enquiries that do not concern a contractual relationship, processing is based on the Data Controller’s legitimate interest in managing incoming communications, pursuant to Article 6(1)(f) of the GDPR.

3.3 Compliance with legal obligations

Data may be processed to comply with obligations imposed by law, regulations, tax or accounting legislation, or instructions issued by competent authorities.

The legal basis is compliance with a legal obligation, pursuant to Article 6(1)(c) of the GDPR.

3.4 Website usage statistics

Google Analytics is used to understand, in statistical form, how users interact with the website and to improve its content, structure and performance.

The processing and activation of the relevant cookies take place only after obtaining the user’s consent, pursuant to Article 6(1)(a) of the GDPR.

Consent is optional and may be refused or withdrawn at any time without affecting the user’s ability to browse the website or use the contact form.

4. Provision of data

Providing the data marked as mandatory in the contact form is necessary to allow the Data Controller to receive and manage the request.

Failure to provide such data may make it impossible to submit the form or receive a response from the Data Controller.

The provision of any additional information included in the message is optional.

Consent to analytics cookies is always optional.

5. Cookies and other tracking technologies

The website may use technical cookies and, subject to consent, analytics cookies.

5.1 Technical cookies

Technical cookies are used exclusively to ensure the proper operation of the website, retain users’ preferences, manage cookie consent and protect browsing security.

These cookies do not require the user’s consent.

5.2 Google Tag Manager

The website uses Google Tag Manager, a service provided by Google Ireland Limited that allows technical and analytics tags to be managed on website pages.

Google Tag Manager is configured so that Google Analytics tags are not activated before the user has given consent.

5.3 Google Analytics 4

Subject to consent, the website uses Google Analytics 4, provided by Google Ireland Limited, to collect aggregated statistics concerning website usage.

Google Analytics may use the following cookies in particular:

Cookie	Provider	Purpose	Standard duration
_ga	Google Analytics	Distinguishes website users through a randomly generated identifier	Up to 2 years
_ga_<ID>	Google Analytics	Retains information about the user’s session	Up to 2 years

The actual duration may be reduced by browser settings, configurations adopted by the Data Controller or restrictions applied by the user’s device.

User-level and event-level data stored in the Google Analytics property are retained for a maximum period of 14 months, without prejudice to aggregated statistical data available in the service’s standard reports.

5.4 Managing and withdrawing consent

When users first access the website, they are shown a consent panel allowing them to:

• accept analytics cookies;

• reject non-essential cookies;

• select the authorised cookie categories;

• subsequently change or withdraw their preferences.

If consent is refused, Google Analytics tags are not activated.

Users may also delete cookies already stored on their devices through their browser settings. Disabling technical cookies may affect certain essential website functions.

6. Processing methods and security measures

Personal data are processed using IT systems and, where necessary, manually.

The Data Controller adopts appropriate technical and organisational measures to protect personal data against:

• unauthorised access;

• loss;

• destruction;

• alteration;

• unlawful disclosure;

• processing that is incompatible with the stated purposes.

Access to personal data is restricted to individuals who require it to perform their duties and who are authorised or contractually bound by confidentiality obligations.

7. Retention periods

Personal data are retained for periods proportionate to the purposes for which they were collected.

In particular:

• technical data and server logs are normally retained for no longer than 30 days, unless they are required for security purposes, the investigation of cybersecurity incidents or requests from public authorities;

• requests received through the contact form or by email are retained for a maximum of 24 months from the closure of the request;

• where a request results in a contractual relationship, the data may be retained for the period necessary to manage that relationship and subsequently for the periods required by civil, tax and accounting legislation;

• data required to manage disputes or protect a legal right may be retained until the relevant proceedings have ended and the applicable limitation periods have expired;

• user-level and event-level data collected through Google Analytics are retained for a maximum of 14 months;

• Google Analytics cookies may have a standard maximum duration of 2 years, unless deleted earlier or configured differently.

At the end of the applicable retention periods, the data are deleted, anonymised or retained only where required by law.

8. Recipients and service providers

Personal data may be processed by or made available to:

• the Data Controller’s authorised personnel and collaborators;

• technical consultants responsible for website maintenance and security;

• OVHcloud, as the hosting infrastructure provider;

• Google Ireland Limited, as the provider of Google Analytics and Google Tag Manager;

• IT and email service providers used by the Data Controller;

• administrative, tax or legal advisers, where necessary;

• judicial, administrative or law enforcement authorities where required by law.

Service providers processing personal data on behalf of the Data Controller are appointed as data processors where required under Article 28 of the GDPR.

Personal data are not publicly disclosed, published, transferred or sold to third parties for commercial purposes.

9. Transfers outside the European Economic Area

The website is hosted using OVHcloud services. Where available, the Data Controller selects infrastructure and hosting locations situated within the European Economic Area.

The use of Google services may involve the processing or transfer of personal data to the United States or other countries outside the European Economic Area.

Where international transfers take place, they are carried out on the basis of one of the safeguards provided for by the GDPR, including:

• an adequacy decision adopted by the European Commission;

• the EU–US Data Privacy Framework, where applicable to the recipient;

• standard contractual clauses approved by the European Commission;

• other safeguards permitted under applicable law.

Users may request further information about the safeguards applied by writing to info@wdritaly.com.

10. Automated decision-making and profiling

The Data Controller does not use personal data collected through the website to make decisions based solely on automated processing that produce legal effects or similarly significant consequences for users.

The website does not carry out commercial or advertising profiling activities.

11. Data subject rights

In the circumstances provided for by the GDPR, data subjects may exercise the following rights:

• obtain confirmation as to whether personal data concerning them are being processed;

• access their personal data;

• request the correction of inaccurate data or the completion of incomplete data;

• request the deletion of their data;

• request the restriction of processing;

• receive their data in a structured, commonly used and machine-readable format and, where applicable, transmit those data to another controller;

• object to processing based on legitimate interests;

• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;

• lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.

To exercise their rights, data subjects may write to:

info@wdritaly.com

The Data Controller may request information strictly necessary to verify the identity of the person making the request and prevent the unauthorised disclosure of personal data.

12. Links to external websites

The website may contain links to websites operated by third parties.

The Data Controller does not control how those websites process personal data. Users are therefore advised to read the privacy notices of external websites before providing any personal information.

13. Amendments to this notice

The Data Controller may update this notice to reflect changes in the law, technology or organisation, or the introduction of new services.

The updated version will be published on this page together with the date of the latest update.

In the event of significant changes, the Data Controller may provide a specific notice through the website.