Privacy Policy
Information notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code).
Last updated: 11 July 2026
1. Data Controller
VAT No. / Tax Code IT03299510796 — REA CZ-194125 — Share capital € 10,000.00 fully paid up.
E-mail: info@maucotools.com — PEC: maucotoolssrl@pec.it — Tel.: +39 0961 021836
The Controller has not appointed a Data Protection Officer (DPO), as the mandatory conditions under Article 37 GDPR do not apply. To exercise your rights and for any request concerning personal data, you may write to the addresses indicated above.
2. Categories of personal data processed
Depending on your interactions with the website, the Controller may process the following categories of data:
- Identification and contact data: first name, last name, company name/business, e-mail, telephone, country, VAT number/customer code.
- Navigation and technical data: IP address, browser/device type, pages visited, date/time, server logs, identifiers stored via cookies (see Cookie Policy).
- Data provided voluntarily: the content of messages and requests sent through the forms, technical specifications of machinery, curriculum vitae and application data.
- Restricted Area / Customer Portal data: credentials (encrypted password), two-factor authentication secret, ERP customer code, commercial and tax documents, orders and shipments.
- Online training (LMS) data: course enrolments, progress, test results, certificates issued.
The website is not intended for minors and does not knowingly process the data of children under 16. No special categories of data (Article 9 GDPR) are processed, except for anything the user may voluntarily and spontaneously include in a CV or in a free-text message.
3. Purposes, legal basis and retention
Personal data are processed for the purposes set out below, each with its relevant legal basis and retention period:
| Purpose | Legal basis (Article 6 GDPR) | Retention |
|---|---|---|
| Provision of the website, technical operation and security (logs, anti-abuse/anti-spam protection, management of authenticated sessions) | Legitimate interest (art. 6.1.f) | Technical logs: up to 30 days; technical cookies: see Cookie Policy |
| Management of cookie consent | Legal obligation / legitimate interest (art. 6.1.c/f) | 180 days |
| Responding to requests sent through the forms (quote, contact, configurator, ROI calculator, distributor application) and management of the negotiation | Pre-contractual measures (art. 6.1.b) / legitimate interest (art. 6.1.f) | 24 months from the last contact, unless a contractual relationship is established |
| After-sales assistance and management of support requests | Performance of the contract / legitimate interest (art. 6.1.b/f) | Duration of the relationship and, in any case, no longer than 24 months from the last contact |
| Newsletter subscription and sending of commercial communications | Consent, with double opt-in confirmation (art. 6.1.a) | Until consent is withdrawn |
| Aggregated website usage statistics (Google Analytics 4) | Consent (art. 6.1.a) | GA data: 14 months; cookies: see Cookie Policy |
| Online marketing and remarketing (Google Ads: campaign measurement and relevant ads) | Consent (art. 6.1.a) | Duration of the cookies / until withdrawal |
| Management of job applications | Pre-contractual measures / consent (art. 6.1.b/a) | 24 months, then deletion |
| Management of the Restricted Area / Customer Portal (authentication, documents, orders, shipments, training) | Performance of the contract (art. 6.1.b) | Duration of the contractual relationship |
| Administrative, accounting and tax obligations (invoices, delivery notes/DDT) | Legal obligation (art. 6.1.c) | 10 years (art. 2220 of the Italian Civil Code) |
| Establishment, exercise or defence of a legal claim in court | Legitimate interest (art. 6.1.f) | For as long as necessary |
At the end of the periods indicated, the data are deleted or irreversibly anonymised.
4. Processing methods and security measures
Data are processed using IT and electronic tools, adopting appropriate technical and organisational measures (Article 32 GDPR): encrypted HTTPS/TLS connections, password storage via hashing (bcrypt), mandatory two-factor authentication (2FA) for the Restricted Area, login attempt limiting, access control and anti-spam/anti-bot protection of the forms. The servers are located within the European Union.
5. Recipients of the data and data processors
The data are not disseminated. They may be processed by authorised persons (instructed staff) and disclosed to third parties acting as data processors pursuant to Article 28 GDPR, including:
| Provider | Role / service | Location |
|---|---|---|
| Google Ireland Ltd. / Google LLC | Google Tag Manager, Google Analytics 4, Google Ads, Google Maps | Ireland / USA |
| Cloudflare, Inc. | Anti-bot protection of the forms (Turnstile), content delivery and protection, video hosting for the training area (Stream) | USA / EU |
| Sendinblue SAS (Brevo) | Sending of e-mails and newsletters, contact/lead management (CRM) | France (EU) |
| OVH SAS | Hosting of the application and database (VPS server) | European Union |
| host.it | E-mail service (SMTP) for the e-mails generated by the forms | Italy (EU) |
| Consultants, professionals, public authorities | Legal, accounting and tax obligations | Italy / EU |
Data from the company's ERP system — customer records, tax documents, orders and shipments — are acquired from an internal system of the Controller and made available in the Restricted Area only to the customer who holds the relevant relationship. An up-to-date list of the data processors is available on request by writing to info@maucotools.com.
Enhanced conversions: subject to "Marketing" consent, a SHA-256 hash of the email address (and, where applicable, the phone number) entered in the forms is transmitted to Google (Google Ads, via Google Analytics 4) for the attribution of advertising conversions. Hashing takes place in the browser: Google does not receive the contact data in plaintext. Legal basis: consent (Article 6(1)(a) GDPR).
6. Transfer of data to third countries (outside the EU)
Some providers (in particular Google and Cloudflare) may involve the transfer of data to the United States. Such transfers take place under appropriate safeguards pursuant to Articles 44 et seq. GDPR, such as the Standard Contractual Clauses approved by the European Commission and/or adherence to the EU-U.S. Data Privacy Framework, together with supplementary measures (for Google, the activation of Consent Mode and IP anonymisation). A copy of the safeguards can be obtained by writing to the Controller.
7. Cookies
The website uses technical cookies and, subject to consent, analytics and marketing cookies, as well as embedded third-party content. Full details are provided in the Cookie Policy.
8. Nature of the provision of data
Providing the data marked as mandatory in the forms (and the data required for the Restricted Area) is essential in order to act on the request or manage the relationship: refusal makes it impossible to provide the relevant service. Providing data for newsletter and marketing purposes is optional, and refusal does not affect the use of the website.
9. Rights of the data subject
The data subject may at any time exercise the rights provided for by Articles 15-22 GDPR:
- access to their data and to information about the processing;
- rectification, updating or completion;
- erasure (right to be forgotten);
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest and, in any case, to use for direct marketing purposes;
- withdrawal of consent at any time, including by changing cookie preferences through the dedicated panel on the website.
Requests should be addressed to info@maucotools.com or by PEC to maucotoolssrl@pec.it. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).
10. Amendments to this information notice
The Controller reserves the right to amend or update this information notice, including as a result of changes in legislation or in the services used. The updated version will be published on this page, together with the date of the last update.