Privacy Notice for website browsing

Pursuant to Articles 13 and 14 of EU Regulation 2016/679

Date of last update: 9 July 2026

By means of this document, M4SS S.r.l., with registered office in Reggio Emilia, via dello Statuto n. 1/A, tax code and VAT number: 02772290355, represented by its legal representative, and owner of the website www.m4ss.net (hereinafter, the "Website"), informs the data subject (User) that their personal data, relating to navigation on the Website, whether accessed directly from the homepage or through subpages, as well as relating to the services or products offered, will be processed with the utmost care and by means of tools suitable to ensure adequate security. It is specified that this notice, in accordance with Articles 13 and 14 of EU Regulation 2016/679 on the protection of personal data (also "General Data Protection Regulation" or GDPR) and with Legislative Decree 196/2003 ("Code on the protection of personal data"), is not to be considered valid for other and external websites that may be consulted through the links contained therein.

  1. Data Controller

    The Data Controller is M4SS S.r.l., with registered office in Reggio Emilia, via dello Statuto n. 1/A, tax code and VAT number: 02772290355, e-mail: privacy@m4ss.net, which has appointed its own Data Protection Officer (DPO), who can be contacted at the registered office of M4SS S.r.l. and at the following e-mail address: dpo@m4ss.net.

  2. Purposes and legal basis of data processing

    The processing of User data is aimed at:

    1. receiving, managing and responding to requests sent by e-mail, or through the contact forms contained in this Website; the legal basis is the performance of a contract to which the User is a party, or pre-contractual measures adopted at their request;

    2. complying with all obligations incumbent upon the Data Controller under current legislation; the legal basis is the fulfilment of a legal obligation to which the Data Controller is subject;

    3. defending a right in legal proceedings; the legal basis is the pursuit of the Data Controller's legitimate interest;

    4. enabling, at the User's request, the playback of video content embedded in the Website through the YouTube player; the legal basis is the User's consent, expressed through the voluntary action of loading the video.

  3. Types and sources of data processed

    1. Data derived from the User's navigation.
      These data, through the normal operation of the Website, are acquired and transmitted implicitly in the use of Internet communication protocols. This is information that is not collected in order to be associated with identified data subjects, but, by its very nature, through processing with data held by third parties, could allow Users to be identified.
      This category of data includes IP addresses or domain names of computers used by Users connecting to the Website, URI (Uniform Resource Identifier) notations of requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server, and other parameters relating to the User's operating system and computing environment.
      These data are used solely for the purpose of deriving anonymous and aggregate statistical information on the use of the Website and to monitor its correct functioning, and reside permanently on third-party responsible servers (hosting provider). The data may also be used for establishing liability in the event of any unlawful damaging actions carried out on or through the Website.
      The Data Controller does not carry out such data processing or association activities; the data are used solely by third-party providers to monitor correct functioning and are automatically deleted after processing.

    2. Data voluntarily provided by the User.
      These data are provided by the User, in the course of voluntary interaction with the Website, in order to request information, receive assistance or for any personal purpose.
      In particular, the voluntary and explicit sending of personal data via e-mail to the Controller's addresses, as well as through the possible completion of forms specifically provided on this Website, within which the personal data that must necessarily be communicated are highlighted, inevitably entails the collection of such User data.

  4. Methods of data processing

    The processing of the User's personal data is carried out, using methods strictly necessary to meet the purposes indicated above, by means of some or all of the operations referred to in Article 4, no. 2) of EU Regulation 2016/679: collection, recording, organisation, structuring, storage, consultation, processing, adaptation, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data. The operations may be carried out with or without the aid of electronic, telematic or otherwise automated tools, in any case in compliance with Article 32 of EU Regulation 2016/679. The User's personal data are not subject to any fully automated decision-making process, including profiling.

  5. Provision of data

    The provision of personal data by the User, while not a legal obligation, is a necessary requirement for responding to requests sent by e-mail or through the contact forms contained in this Website; therefore, failure to provide the data makes it impossible to pursue the aforementioned purposes. In any case, by providing the User's personal data to the Data Controller, or to its authorised parties, for any of the purposes listed above, the Data Controller may process such data to fulfil legal obligations and to pursue its legitimate interest in protecting a right in legal proceedings.

  6. Data retention

    The User's personal data will be processed and retained for the entire period necessary to fulfil the purposes indicated above and, specifically:

    1. data collected to manage and respond to requests sent by e-mail or through the contact forms contained in this Website are retained until the request is fully handled;

    2. data collected for the fulfilment of legal obligations are retained for the period necessary as required by law or regulation;

    3. data collected for the defence of rights in legal proceedings are retained until the limitation period for the relevant right expires or, where legal proceedings are initiated, until their definitive conclusion.

  7. Communication of data

    Personal data may be communicated to the following recipients, or become known to them, for the purposes referred to in point 2:

    1. internal personnel of M4SS S.r.l., specifically authorised to process data and assigned to administration, and to the management and control of the corporate IT infrastructure;

    2. data processors and their further processors and authorised parties, such as, by way of example and not exhaustively: accountants, labour consultant, IT service providers or their support providers, and the relevant appointed technical staff, any collaborators, persons in charge of occasional maintenance operations, all adequately trained in confidentiality protection;

    3. public bodies, judicial or administrative authorities, for the fulfilment of legal obligations;

    4. banking and insurance institutions;

    5. other parties processing the data in fulfilment of specific legal obligations;

    6. YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), limited to the browsing data (including the IP address) transmitted by the User's browser when they choose to load, with a click, the videos embedded in the Website through the YouTube player in privacy-enhanced mode (youtube-nocookie.com); no data is transmitted to Google before that action. Google LLC processes such data as an independent data controller, in accordance with its own privacy policy.

  8. Transfer of data to third countries outside the EU

    Personal data will not be transferred outside the European Union and the European Economic Area, except for the browsing data transmitted to Google LLC (United States) if the User chooses to load the videos embedded in the Website, as described in point 7. That transfer is covered by the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, under which Google LLC is certified.

  9. Rights of the data subject

    Pursuant to Articles 15-18 and 20-21 of EU Regulation 2016/679, the User has the right to obtain:

    1. confirmation as to whether or not personal data concerning them exist, even if not yet registered, and their communication in intelligible form;

    2. the indication of:

      1. the origin of the personal data;

      2. the purposes and methods of processing;

      3. the logic applied in case of processing carried out with the aid of electronic tools;

      4. the identifying details of the Controller and of any processors;

      5. the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as processors or appointees;

    3. updating, rectification or, where they have an interest therein, the integration of the data;

    4. the erasure, anonymisation or blocking of data processed in breach of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;

    5. confirmation that the operations referred to in letters c) and d) have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where such fulfilment proves impossible or involves a manifestly disproportionate effort compared to the right protected.

    The User has the right to object, in whole or in part:

    1. for legitimate reasons, to the processing of personal data concerning them, even if pertinent to the purpose of collection;

    2. to the processing of personal data concerning them for the purpose of sending advertising material or direct selling or for carrying out market research or commercial communication.

    The User has the right to withdraw, at any time, the consent given, in relation to processing activities for which it constitutes the legal basis, without prejudice to the lawfulness of the processing based on the consent given prior to its withdrawal. The User has the right to data portability, i.e. to receive, in a structured, commonly used and machine-readable format, the personal data concerning them and has the right to transmit such data to another Data Controller without impediment. The User also has the right to lodge a complaint with a supervisory authority (in Italy, the Garante per la Protezione dei dati personali, the Italian Data Protection Authority: www.garanteprivacy.it).
    The User may exercise their rights by sending a written request to the Data Controller, at the contact details indicated above.

  10. Changes to the privacy notice

    M4SS S.r.l. reserves the right to modify, update, add or remove parts of this Privacy Notice at its discretion and at any time.
    The interested User is required to periodically check for any changes published on this Website.