Cookie Policy

Personal data policy – Cookies and browsing data

This Cookie Policy has been drawn up and customised specifically for the website www.ceflaengineering.com (hereinafter the “Website”) owned by Cefla S.c. via Selice, 23/a – 40026 Imola (BO) Italy, (hereinafter the “Data Controller”).

This policy has been drawn up based on the provisions of the Data Protection Authority (Italian supervisory authority: Garante per la protezione dei dati personali). It supplements and updates other information already present on the website and/or, in combination with it, provides all the elements required by Article 13 of EU Regulation 2016/679.

1. Data processing method

Cookies

Cookies are short text strings sent to the browser during your visits to a website, stored and transmitted back to the Website upon your next visit.

Cookies allow us to collect information about your browsing experience.

Cookies can be stored permanently on your computer and have a variable duration (persistent cookies), or they may not be stored permanently on your device and be automatically deleted when the browser is closed (session cookies).

Cookies can be installed by the website you are browsing or they can be installed by other websites that provide a variety of services to that site (third-party cookies).

1. Technical cookies

Cookies in this category allow the Website to function efficiently. Those installed by the Website are listed in the table below in point 1.6.

1. Statistical cookies

The Website also uses statistical cookies either created directly by the Data Controller, or provided by third parties, as indicated in the table below in point 1.6.

• The statistical cookies created directly by the Data Controller will be used by the Data Controller to carry out statistical analyses relating to various domains, websites or apps belonging to the Company, so that the Company can perform its own statistical processing without such analyses being aimed at making commercial decisions.
• Third-party statistical cookies, when used exclusively to produce aggregate statistics, with minimisation measures suitable for significantly reducing their identifying power and without combining them with additional information held by the supplier, are treated as technical tools and do not require the user's consent. In this case, tools have been introduced to reduce their identifying power, for example by masking significant portions of the IP addresses processed. In the event that third-party statistical cookies are used, the third party has contractually committed to the Data Controller to use them exclusively for the supply of the required service, to store them separately and not to "supplement" or "cross-reference" them with other information which may be available to them.

By contrast, all analytics cookies, which do not have these characteristics, as well as those used by third parties for purposes other than the mere production of aggregate statistics, still require the user's prior consent. If these cookies are also used for individual tracking, marketing, content personalisation or integration with CRM tools purposes, they will be treated as profiling cookies.

The legal basis applicable to each cookie is specified in this document.

1. Marketing cookies

Marketing cookies are non-technical cookies that allow the Data Controller to carry out marketing activities. The Data Controller uses the marketing cookies listed in the table below in point 1.6.

1. Profiling cookies

Profiling cookies are non-technical cookies that allow the Company to provide you with customised services based on your specific requirements. The Company uses the profiling cookies listed in the table below in point 1.6.

1.6. Cookies table

For a list of active cookies, please refer to the detailed page: https://ceflaengineering.com/en/cookie-policy-scan

1. Deleting and disabling cookies

Your browser can be configured to prevent the processing of cookies, or to delete them immediately after the end of a browsing session. Below is a list of methods for disabling and deleting cookies in the main browsers:

1. Navigation data and environmental variables

The Website automatically captures some personal data relating to your browsing. This category of data includes, for example:

• the IP addresses of the computer you are using;
• the number of accesses;
• the pages used;
• the date and time of access;
• the URL your browser was at before viewing the Website;
• the type of browser you are using;
• the operating system used.

1. Data submitted voluntarily

You have the right and are free to submit data by sending emails to the addresses indicated on the Website, which the Company may acquire for the purposes indicated from time to time. In addition to the email address required to send you feedback, any other personal data contained in the relevant communication will be processed. The data collected in this way will be stored and processed exclusively for correspondence purposes, and not for any other purposes.

1. Purpose and legal basis of data processing, optional nature of consent and consequences of failure to consent

• Personal data processed with technical cookies and browsing data: The submission of personal data is a contractual obligation, as without these data, the website cannot be made fully functional in accordance with the terms and conditions of use.
• Personal data processed with statistical cookies (similarly to technical cookies): The submission of personal data is a contractual obligation, as without these data, the website cannot be made fully functional in accordance with the terms and conditions of use.
• Personal data processed with marketing cookies: The submission of personal data is purely optional. Failure to provide your data will make it impossible for the Company to carry out marketing activities. The legal basis for data processing is your consent, expressed in accordance with applicable legislation.
• Personal data processed with profiling cookies: The submission of personal data is purely optional. Failure to provide your data will prevent the Company from providing you with personalised services through profiling. The legal basis for data processing is your consent, expressed in accordance with applicable legislation.
• Personal data submitted voluntarily via email or by completing forms: The submission of personal data is purely optional. Failure to provide the required data will prevent the Company from responding to your requests. The legal basis for data processing is the legitimate interest of the Company, as the Data Controller, to respond to inquiries.

You can express your consent to the processing of personal data with non-technical cookies by clicking on a specific box displayed inside a banner.

Consent to the use of cookies and other non-technical tracking tools is obtained through a specific banner that allows the user to:

• accept all non-technical cookies;
• reject all non-technical cookies;
• analytically select individual cookie categories.

Closing the banner using the “X” command will maintain the default settings and, therefore, allow browsing to be continued without having to install non-technical cookies.
The preferences expressed by the user are recorded by the Data Controller and can be modified at any time through a specific command always accessible from the website, using procedures at least as straightforward as those required for granting consent.

In the absence of significant changes to the processing conditions, the banner will not be displayed again until at least 6 months have passed since the user's previous choice, unless the Data Controller is technically unable to track such timing.

1. Automated decision-making and profiling

If you consent to profiling cookies, the Data Controller can analyse your browsing preferences and interests in order to customise content, communications and promotional initiatives.

Unless expressly stated otherwise, this will not involve the adoption of decisions based solely on automated processing and such as to produce legal effects or effects similarly affecting the data subject pursuant to Art. 22 GDPR.

If you consent to profiling cookies, the Data Controller will carry out data processing including a decision-making process based solely on automated procedures, pursuant to Article 22 of GDPR. This process aims to analyse and predict your preferences and interests to provide you with a customised browsing experience and commercial communications in line with your profile.

The process is based on an algorithm that analyses the data collected through profiling cookies to target specific customer segments (clusters). The main criteria and data taken into consideration by the algorithm include:

• Behavioural data: pages visited, products and services viewed, frequency of visits, time spent on specific sections of the website.
• Interaction data: interaction with specific content (e.g., downloading brochures, watching videos), filling out contact forms.
• Inferential data: based on observed behaviours, the algorithm infers your possible professional interests or relevant business areas (e.g. "interest in the Medical sector," "interest in the Finishing sector").

The algorithm will not use special categories of data (sensitive data) pursuant to art. 9 GDPR. The underlying logic is non-discriminatory and is based exclusively on the analysis of your interactions with our website to customise our offering.

Assignment to a specific profile or segment has direct consequences on the type and frequency of communications and content shown to you. The main consequences to be expected are:

• Content customisation: displaying content, banners or recommendations on the website in line with your interests as inferred from your profile.
• Targeted commercial communications: ads relevant to your specific segment of interest.

For example, a user who frequently browses pages related to industrial packaging solutions and downloads the related catalogue will be automatically profiled as a "potential customer in the Packaging sector" and may be shown new machinery in that sector and receive dedicated discounts. These offers will not be sent to users with different profiles.

In accordance with Article 22 of GDPR, you have the right not to be subjected to such a decision and you may, at any time, exercise the following rights:

• Obtain human action from the Data Controller to revise your position.
• Express your opinion regarding profiling and automated decision-making.
• Challenge the decision made by the algorithm, requesting a revision.

To exercise these rights, contact the Data Controller using the contact details indicated in this policy. Please note that withdrawing your consent to profiling cookies (via a procedure as straightforward as granting your consent) will result in the immediate suspension of any form of automated processing described here.

1. Source from which personal data originate and categories of data

The personal data processed through the Website are collected directly from the data subject through navigation, the use of cookies and other tracking tools, as well as through the possible voluntary sending of communications or filling out of forms. The Data Controller will not process, within the scope of this Cookie Policy, data from publicly accessible sources or special categories of personal data pursuant to art. 9 of GDPR.

1. Recipients or categories of recipients of personal data

Your personal data may be received by:

• companies that offer hosting services;
• analytics, measurement, marketing automation and consent management platform providers;
• entities that provide maintenance, assistance and security services for the Website;
• group companies, where necessary for internal administrative purposes consistent with the listed ones;
• public authorities and entities authorised to receive data pursuant to legal provisions or orders from the authorities.

The identity of the suppliers who operate by using cookies or other tracking tools is shown in the cookie table or can be requested from the Data Controller.

1. Data transfer

Some suppliers listed in the cookie table or among the recipients of data may be located in countries outside the European Economic Area, including the United States. In these cases, data transfer occurs exclusively in compliance with the conditions defined by applicable legislation, i.e., on a case by case basis:

• on the basis of an adequacy decision by the European Commission; or
• failing such a decision, through appropriate safeguards pursuant to Article 46 of the GDPR, supplemented where necessary by additional measures designed to ensure a level of protection essentially equivalent to that guaranteed within the European Union.

Information regarding the specific transfer basis applicable to each foreign supplier can be requested from the Data Controller using the contact details provided in this policy. To obtain a copy of the data or the location where they are made available or of the applicable guarantees, please send your request to the addresses indicated above.

1. Data retention time

• The Data Controller will retain your personal data processed with technical cookies in order to allow users to correctly use the Website and browsing data for a period not exceeding 14 months from the date of individual collection, in accordance with the provisions of the Cookie Policy;

• The Data Controller will retain your personal data processed with statistical cookies for a period not exceeding 14 months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
• The Data Controller will retain your personal data processed with marketing cookies in order to carry out marketing activities for a period not exceeding 14 months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
• The Data Controller will retain your personal data processed with profiling cookies to make customised services available to you for a period not exceeding 12 (twelve) months from the date of individual collection, in accordance with the provisions of the Cookie Policy;
• The Data Controller will retain your personal data submitted voluntarily via email or by filling out forms and processed to respond to your inquiries for the period of time strictly necessary to achieve this purpose and, in any case, not longer than 12 (twelve) months from the date of individual collection.

The data processed through cookies are stored for a period of time corresponding to the technical duration of each cookie, as specifically indicated in the table above.

If processing of data collected via cookies continues beyond the cookie's technical lifespan, the relevant retention period is indicated, for each identified purpose, either in this policy or in the Website's general privacy notice.

In the event of a conflict between the cookie table and the general descriptions contained in this policy, the specific information provided in the table shall prevail, without prejudice to the Data Controller's obligation to keep all information constantly aligned and updated.

The Data Controller reserves the right, in any case, to ask you to renew your consent to data processing and/or to verify any consent that you may have already expressed.

1. Right to object

As the data subject you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data pursuant to points e) or f) of Article 6, paragraph 1 of GDPR, including profiling when based on those provisions.

The Company shall then no longer process your personal data unless the Company can demonstrate compelling legitimate grounds for data processing which override your interests, rights and freedoms as the data subject or for the establishment, enforcement or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data related to you for such purposes, which includes profiling to the extent that it is related to such direct marketing purposes.

Where the data subject objects to processing for direct marketing purposes, their personal data shall no longer be processed for such purposes.

You may object to the processing of personal data for direct marketing purposes even only partially, e.g. by objecting to the sending of promotional communications via automated and/or digital tools, or to the sending of hard copy communications and/or to telephone communications.
If your personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89, paragraph 1 of the GDPR, you have the right, on grounds relating to your particular situation, to object to processing of your personal data, unless such processing is necessary for the performance of a task for reasons of public interest.

1. Other rights

The Company would also like to inform you of the existence of the following rights applicable to you:

• Right of access: you have the right to obtain confirmation from the Company as to whether or not any of your personal data are being processed. In this case, you have the right to access your personal data and specific information, pursuant to Article 15 of GDPR;
• Right to rectification: you have the right to obtain from the Company without undue delay the rectification of any inaccurate personal data related to you. In consideration of the purposes of data processing, you have the right to obtain the integration of incomplete personal data, including by providing a supplementary statement, pursuant to Article 16 of GDPR;
• Right to erasure ("right to be forgotten"): you have the right to obtain from the Data Controller without undue delay the deletion of inaccurate personal data. The Company has the obligation to delete personal data without undue delay if the grounds listed in Article 17 of GDPR apply;
• Right to restriction of processing: you have the right to obtain from the Company restriction of data processing, if the grounds listed in Article 18 of GDPR apply;
• Right to data portability: you have the right to receive the personal data related to you and submitted to the Company in a structured, commonly used and machine-readable format, as well as the right to transmit such data to another Data controller without hindrance from the Company, in the cases and under the conditions specified in Article 20 of GDPR;
• Right to object to commercial communications: you have the right to object at any time, free of charge, to receiving commercial communications from the Company;
• Right to lodge a complaint with a Supervisory Authority: you have the right to lodge a complaint with the Data Protection Authority to report a violation of personal data protection regulations, pursuant to Article 77 of GDPR.
• Right to withdraw consent (Cookies): Where the processing of personal data is based on consent, the Data subject has the right to withdraw it at any time, without affecting the lawfulness of any processing carried out before such withdrawal. Consent may be withdrawn according to a procedure that must be as straightforward as the consent granting procedure, using the cookie preferences management panel accessible at any time from the Website. The right to object still applies to cases where data processing has a different legal basis, according to which the right to object is provided for by the applicable legislation.

1. How to exercise your rights

You may exercise the rights indicated in the Cookie Policy by addressing your request directly to the Company at the email address privacy@cefla.it or by registered mail with return receipt to A/R all’indirizzo via Selice Provinciale 23/a, 40026 Imola.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) using the methods provided on the official website and the contact details available at https://www.garanteprivacy.it/home/footer/contatti.

1. Accessibility

The Cookie Policy can be viewed at https://ceflaengineering.com/en/cookie-policy and at the Company’s premises. If you expressly request it, the Company may provide information orally by telephone, by calling 0542-653111, subject to caller identity verification.

1. Changes

The Company may edit its Cookie Policy, also to comply with national and/or European Union legislation or technological innovations. Any new versions of the Cookie Policy will be posted on the Website. You are therefore requested to periodically check the Cookie Policy. Any changes will be notified to you via a pop-up on the Website or through different methods and/or IT tools. If the Company substantially modifies its Cookie Policy, introducing new processing purposes and/or categories of personal data processed, or changing third parties, the Company itself will provide to you the relevant information, in order to obtain from you the necessary consent, via a specific banner. If it is impossible for the Company to verify that cookies have been stored on your device, if e.g. if you have deleted installed cookies, during your subsequent visit to the Website the Company will inform you, in order to obtain from you the necessary consent via a specific banner. If at least 6 (six) months have passed since the previous banner published on the Website, the Company will provide to you the required information, in order to obtain from you the necessary consents, via a specific banner.

Imola, 01/07/2026