PRIVACY AND COOKIE POLICY OF THE WEBSITE WWW.EVOPALLET.COM
Information notice pursuant to Articles 13, 14 and 26 of Regulation (EU) 2016/679 (GDPR), Article 122 of Italian Legislative Decree 196/2003 and the Italian Data Protection Authority’s Cookie Guidelines of 10/06/2021, for website users and Evopallet business contacts — Rev. 01 of 26/10/2026
PART I — PRIVACY POLICY
Joint controllers
Data are processed, as joint controllers (Art. 26 GDPR), by the two SPL group companies that design, manufacture and sell Evopallet pallets:
SPL Evopallet S.r.l. – Via A. Sacharov 15/A, 62029 Tolentino (MC), Italy – VAT No. and Tax Code: 02149230431 – SDI Code: SUBM70N – Certified e-mail (PEC): splevopallet@pec.it
S.P.L. Industries S.r.l. – C.da Rotondo no. 10, 62029 Tolentino (MC), Italy – VAT No. and Tax Code: 01679730430 – SDI Code: SUBM70N – PEC: splindustriessrl@pec.it – Tel. +39 0733 960996
Arrangement between the joint controllers (essential content): the two companies have defined their respective responsibilities in writing. A single point of contact handles data subjects’ requests on behalf of both; each company adopts appropriate security measures for the systems and staff it manages. Data subjects may in any case exercise their rights against each of the two companies (Art. 26(3) GDPR). The essential text of the arrangement is available on request.
Privacy contacts
The Privacy Officer of both companies can be reached at privacy@splindustries.it.
The joint controllers have not appointed a Data Protection Officer (DPO), as the conditions of Art. 37 of Regulation (EU) 2016/679 are not met.
Purposes and legal bases
- Replying to information requests sent via the “Request information” form, by e-mail or by phone, including sending the offers and clarifications requested. Legal basis: pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR).
- Subsequent commercial contacts about Evopallet products (presentations, news, proposals), with a single direct contact at a time and never mass mailings without consent. Legal basis: optional consent given in the form (Art. 6(1)(a) GDPR) or, for company representatives contacted for their role, the legitimate interest of the joint controllers, assessed case by case with a balancing test (LIA).
- Operation and security of the website (browsing data and technical logs, form spam protection, display of the site with typefaces provided by Google Fonts, YouTube videos embedded in the site’s pages and loaded when the page opens). Legal basis: legitimate interest of the joint controllers in the security and proper functioning of the site.
- Statistics, advertising and third-party content (Google Analytics, Google Ads, Google Maps map), activated only after consent given in the cookie banner; without consent, Google Analytics and Google Ads do not set cookies but may receive cookie-less visit signals, as described in the Cookie Policy section. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of Legislative Decree 196/2003), which can be withdrawn at any time with the “Revoke consent” button in the banner.
Data processed and source
“Request information” form: first and last name, company, e-mail, telephone (optional). Commercial contacts: name, role, company, work contact details and notes on contacts had, provided by the data subject or taken from public sources (the company’s website and social pages, business information databases, trade fairs). We do not use purchased lists or automated harvesting of addresses. Browsing: IP address, browser, device, pages visited, date and time. Cookies: as indicated in the cookie section and in the site banner.
Provision of data
Form data marked as mandatory are needed to reply: without them we cannot follow up on the request. Consent to commercial contacts and to non-technical cookies is optional and refusing it has no consequence on the reply to the request.
Retention period
Requests and commercial contacts: 24 months from the last interaction, then deleted or anonymised; if the contact becomes a customer, the customer notice applies. Consent to commercial contacts: until withdrawn and in any case no longer than 24 months from the last interaction. Objection or erasure request: name and contact detail are placed on a block list, with only the data needed not to contact the data subject again. Browsing data: for the time needed for site security, according to the hosting provider’s settings.
Recipients
Data are processed by the joint controllers’ authorised staff (Evopallet sales department) and by suppliers appointed as data processors: web agency that manages the site, hosting provider, CRM provider (cloud service for managing commercial contacts), IT service providers. For third-party content and statistics: Google (Google Analytics, Google Ads, YouTube, Google Maps, Google Fonts). Data are not disseminated and are not transferred to third parties for their own marketing purposes.
Transfers outside the EU
The CRM provider and Google may also process data in the United States. The transfer takes place on the basis of the EU-US adequacy decision (EU-U.S. Data Privacy Framework) or the standard contractual clauses approved by the European Commission. No automated decision-making or profiling is carried out.
Data subject rights
Data subjects may at any time exercise, against each joint controller, the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-21 GDPR), by writing to privacy@splindustries.it. We reply within one month. Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before withdrawal. Data subjects may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Right to object (Art. 21 GDPR). Data subjects may object at any time, without giving reasons, to any commercial contact: simply reply “cancel me” to one of our e-mails or write to privacy@splindustries.it. They may also object to other processing based on legitimate interest on grounds relating to their particular situation.
Security and updates
The joint controllers and their suppliers adopt appropriate technical and organisational measures (Art. 32 GDPR), including multi-factor authentication for access, regular updates and backups. This notice may be updated: the version in force is the one published with the revision date shown above.
PART II — COOKIE POLICY
What cookies are and how we use them
Cookies are small text files that the site saves on the user’s device; similar tools (pixels, scripts, local storage) work in the same way and are treated as cookies. We use:
technical cookies, necessary for the operation and security of the site: they do not require consent (Art. 122(1) of Legislative Decree 196/2003);
third-party cookies and tools (statistics, advertising, maps): they are activated only after consent given in the banner. If the user chooses “No”, only technical cookies remain active and the map is replaced by an information box. YouTube videos embedded in the site’s pages and Google Fonts typefaces are instead loaded when the page opens (see table and notes).
Cookie list
| Cookie | Provider | Duration | Consent | Purpose |
|---|---|---|---|---|
| Technical cookies (always active) | ||||
| cookie_notice_accepted | SPL Evopallet | 1 month | Not required | Stores the user’s cookie choices. |
| pll_language | SPL Evopallet (Polylang) | 1 year | Not required | Remembers the chosen language (Italian/English/German). |
| Analytics cookies (with consent only; without consent no cookies) | ||||
| _ga, _ga_* | Google (Google Analytics 4) | 13 months | Required | Aggregate visit statistics (pages viewed, origin, device). |
| Marketing cookies (with consent only) | ||||
| _gcl_au and doubleclick.net cookies | Google (Google Ads) | 90 days | Required | Measures visits and contact requests coming from Google ads. |
| Third-party content | ||||
| YouTube cookies | Google (YouTube) | As per Google | Loaded when the page opens | Playback of the videos embedded in the site. The video is loaded from YouTube’s servers when the page opens, even before the user’s choice, and may result in cookies being set and the IP address being transmitted to Google. |
| Google Maps cookies | Google (Maps) | As per Google | Required | Display of the map on the Contacts page. Before consent, an information box is shown in place of the map. |
The “Request information” form uses an anti-spam check with a maths question, without third-party cookies. The typefaces (Google Fonts) are loaded from Google’s servers on every visit: this involves the transmission of the IP address and technical browser data to Google, regardless of the choice made on cookies. The list is updated whenever the site changes; cookie names may vary at the discretion of third-party providers.
Consent, choice and withdrawal
On first access the banner lets the user accept (“Ok”) or refuse (“No”) non-technical cookies; there are no separate categories and non-technical cookies are disabled by default. The choice is remembered for 1 month and the banner is not shown again before then. Users can change their mind at any time with the “Revoke consent” button shown on all pages after the choice. You can also block or delete cookies in your browser settings (Chrome, Edge, Firefox, Safari): in that case some site functions may not work.
Third-party providers and transfers outside the EU
Third-party cookies are managed by Google Ireland Ltd and Google LLC (Analytics, Ads, YouTube, Maps, Fonts).
Google may also process data in the United States, on the basis of the EU-US adequacy decision (EU-U.S. Data Privacy Framework) or the standard contractual clauses. Google’s notice: policies.google.com/privacy. The site uses Google Analytics and Google Ads with Google’s consent mode (Consent Mode): if the user does not give consent, no cookies are set, but Google may receive cookie-less visit signals (page visited, browser type and IP address, which according to Google is not stored to identify the user), used only for aggregate statistics. We do not carry out profiling with data collected through cookies, except for the measurement of advertising conversions described above, active only with consent.