Last updated: 16 September 2026

This privacy policy describes the processing of personal data carried out through the cavalleri.com website (the “Website”) and, where applicable, through emails sent by Cavalleri Comunicazione S.a.s. (the “Communications”).

This privacy policy must be read in conjunction with the Cookie Policy and any specific policies provided when the email address is collected or when individual services are activated. It concerns the processing actually carried out by the Data Controller and must be reviewed and updated before the activation of new providers, tracking tools, marketing platforms or additional purposes.

1. Data Controller

Cavalleri Comunicazione S.a.s.
VAT number: 08520740963
Registered office: Via G. Ventura, 5 – 20134 Milan (MI), Italy
Email: info@cavalleri.com

2. Personal data processed

In relation to the features used, the Data Controller may process:

  1. name, email address and data contained in requests sent via the contact form;
  2. technical and usage data relating to the Website, such as IP address, date and time of the request, URLs visited, user agent, operating system, type of device, language, connection data and security logs;
  3. information relating to the preferences expressed by the user regarding cookies and tracking tools;
  4. data relating to the sending and management of Communications, such as email address, contact identifier, subscription status, sending, delivery, bounce, unsubscribing and, where the Communications contain a validly activated tracking pixel, opening or viewing of the message;
  5. technical information transmitted by the email client to the server hosting any tracking pixel, such as IP address, device type, email client, date and time of the request, message identifier and technical identifier associated with the recipient;
  6. data collected through cookies, pixels, web beacons, tags, scripts, online identifiers and similar technologies, as described in the Cookie Policy and in this privacy policy.

The Data Controller does not intend to collect special categories of personal data through the Website or the Communications. Users are asked not to include information relating to health, biometric data, judicial data or other unnecessary information in the contact form or in communications.

3. Methods and place of processing

The processing is carried out using IT and electronic systems, in accordance with organisational procedures and logic relating to the purposes set out in this privacy policy.

Within the limits of their respective roles, the following may access the data: persons authorised by the Data Controller, administrative, sales, marketing and technical staff, system administrators, and external service providers responsible for hosting, maintenance, security, website management, email delivery, IT support, communications and consultancy. Where the conditions are met, these parties are appointed as Data Processors.

The data are processed at the Data Controller’s operating sites and at the locations where the providers involved operate. Some providers may process data outside the European Economic Area. In such cases, the Data Controller shall verify the existence of an adequacy decision or appropriate safeguards and shall make further information available upon request.

The Data Controller shall adopt technical and organisational measures appropriate to the risk, including access management, instructions to authorised persons, system updates, backups, security procedures, data minimisation and, where appropriate, encryption or pseudonymisation.

4. Purposes and legal bases

Your personal data is processed to:

  1. make the Website available, maintain it and protect it;
  2. respond to user requests and prepare any quotes;
  3. comply with legal obligations and requests from the authorities;
  4. manage contractual and pre-contractual relationships;
  5. prevent abuse, fraud, spam, unauthorised access and security incidents;
  6. compile statistics on the operation of the Website and on Communications, within the limits described in the following sections;
  7. send newsletters and promotional communications, where the user has given consent or where another condition provided for by law applies;
  8. send transactional, automated, institutional or service-related Communications;
  9. exercise or defend a right;
  10. manage user preferences, objections and withdrawals of consent;
  11. manage cookies, tags, pixels and other tracking tools in accordance with the Cookie Policy.

Depending on the specific processing activity, the applicable legal bases are the performance of pre-contractual measures or a contract, compliance with a legal obligation, the data subject’s consent, the legitimate interests of the Data Controller or third parties, and any other legal bases provided for under applicable law.

The Data Controller determines and documents the legal basis for each specific processing operation carried out. Consent is not replaced by legitimate interest when the applicable special regulations require prior consent.

5. Contact form

By filling in the contact form, the user provides their name, email address and the information entered in the message to enable the Data Controller to respond to the request, provide information or prepare a quote.

The provision of data marked as mandatory is essential in order to receive a response. Failure to provide such data may prevent the request from being processed.

Legal basis: performance of pre-contractual measures taken at the request of the data subject or legitimate interest in handling the requests received.

Retention: for the time necessary to handle the request and, subsequently, for the period necessary to comply with legal obligations or to establish, exercise or defend rights.

6. Tracking pixels in email communications

6.1 What they are

Communications may contain remote images, web beacons or other technical elements, often transparent and small in size, known as tracking pixels. The pixel is hosted on a remote server and, when the email client downloads the image, it can generate a technical request to that server.

The request may communicate data such as IP address, device type, email client, date and time of the request, message identifier, technical identifier associated with the contact and information relating to the opening or viewing of the Communication. The tracking pixel can also enable the detection of subsequent openings of the same message.

The automatic loading of images can be disabled by the recipient in the settings of their email service or client. However, this setting normally applies to all images and does not necessarily allow the selective rejection of tracking pixels alone.

6.2 Notices to which it may apply

Tracking may apply to the following, if actually sent by the Data Controller:

  1. newsletters;
  2. promotional communications or direct email marketing (DEM);
  3. transactional and automated emails;
  4. service emails;
  5. institutional or informative communications.

The presence of a tracking pixel and its purpose must be disclosed to the recipient before the communication is sent or, for processing activities already underway on the date compliance measures are implemented, with the next appropriate communication or at the first available opportunity to update the recipient.

6.3. Purposes of data processing

The tracking pixel may be used for one or more of the following purposes, to be specifically indicated in the communication and in the applicable privacy policy:

  1. to verify correct delivery and deliverability;
  2. to combat spam, phishing and abuse;
  3. to carry out aggregate statistical counts on the opening of Communications;
  4. to individually measure the opening or viewing of a message;
  5. to assess the performance of a promotional campaign;
  6. to change the subject, content, frequency or readability of the Communications based on the recipient’s behaviour;
  7. to stop or repeat mailings based on the interaction detected;
  8. to segment recipients or create commercial profiles;
  9. to personalise future Communications;
  10. to verify security, authentication or account management requirements;
  11. to ascertain that service or institutional communications have been read, when this is necessary and lawful.

The Data Controller does not use the individual open data for purposes other than those specifically indicated and does not engage in profiling or behavioural marketing without the relevant legal basis.

6.4 Processing for which specific consent may not be required

The Data Controller may use a pixel without further specific consent only when one of the cases of necessity provided for by the applicable regulations applies and the processing is limited to the necessary purpose.

In particular, the following cases are included, provided that the conditions set out in the Italian Data Protection Authority’s Guidelines of 17 April 2026 are met:

  1. exclusively statistical and aggregate counts of total opens, carried out using pixels that are not unique to each recipient and with effective anonymisation of the related technical data, so as to prevent the measurement of individual behaviour;
  2. security, authentication, account management or update requirements, when the pixel is necessary for the requested service or to verify the opening of a communication on a known user terminal;
  3. institutional or service-related communications that the Data Controller is obliged to send or that are necessary to protect the user or the community, including, where applicable, communications relating to security, fraud, incidents, contractual changes, terms of service, deadlines or obligations.

These cases do not allow the use of open data for profiling, behavioural marketing, commercial personalisation or individual campaign evaluation.

6.5 Processing that requires prior consent

The Data Controller obtains prior consent when the opening or viewing of the Communication is measured at an individual level for promotional or commercial purposes, including:

  1. assessment of the performance of individual campaigns;
  2. adaptation of the subject, content or frequency of mailings;
  3. decision to repeat or stop mailings based on whether or not they have been opened;
  4. segmentation of recipients;
  5. inference of interests, tastes or preferences;
  6. commercial profiling or personalisation of subsequent communications.

Consent to receive promotional communications may include consent to the use of tracking pixels when the request is clear, neutral, freely given, specific and informed. In any case, it must be possible to withdraw consent for tracking alone, while continuing to receive the communications that the user wishes to receive and that the Data Controller is entitled to send.

The refusal or withdrawal of consent to the tracking pixel does not, for this reason alone, entail any limitations on the requested service or on the receipt of non-promotional communications that do not require tracking.

6.6 Granular withdrawal of consent and preference management

Each Communication containing a tracking pixel subject to consent must include a clearly recognisable link, preferably in the footer, to a preference management page.

The page must allow the user, in a simple and free manner, to:

  1. withdraw consent to Promotional Communications in full;
  2. withdraw consent only to the use of tracking pixels;
  3. continue to receive Communications without tracking pixels, where the Data Controller is entitled to send them;
  4. change their preferences;
  5. unsubscribe from mailing lists.

Choices and withdrawals must be recorded in such a way as to enable the Data Controller to demonstrate the consent given, the version of the privacy policy displayed, the date and time of the choice and any withdrawal. Withdrawal of consent must be as straightforward as giving consent.

6.7 Privacy by design and minimisation

To reduce the risk of identifying the recipient, the Data Controller, where technically possible, uses unintelligible and non-sequential technical identifiers and keeps the association between the identifier and the email address separate at an internal level of the platform.

The email address must not be entered directly in the parameters of the request generated by loading the pixel when it is possible to use a pseudonym identifier. The Data Controller limits the data collected, access, purposes of reuse and retention periods, and checks the configuration of email sending providers.

7. Newsletters, marketing and commercial communications

Newsletters and promotional communications are sent on the basis of the data subject’s consent or another condition provided for by law, including, where applicable, the rules relating to similar products or services already purchased.

Consent to receive promotional communications is separate from preferences regarding tracking pixels where the Data Controller uses individual open tracking or other forms of profiling. In any case, the user may object to direct marketing free of charge and unsubscribe via the link in the Communications or by contacting the Data Controller.

Any use of an external email sending platform must be indicated with the name of the provider actually used, the purposes, the categories of data processed, the privacy role, the retention periods and any international transfers.

8. Cookies, tags and tracking tools on the Website

The Website may use cookies and other tracking tools for technical, statistical, advertising or tag management purposes. The categories, providers, durations, purposes and methods of consent or refusal are set out in the Cookie Policy.

Unnecessary tools must not be activated before the user makes a choice when consent is required. The preference management system must allow users to change or withdraw their choice and to record the version of the privacy policy, as well as the date and time of the preference.

Google Tag Manager
Google Tag Manager may only be used in the configuration that is actually active on the Website. Its presence does not authorise the loading of additional tags before any necessary consent is given. Unnecessary scripts must be blocked until the user’s choice is recorded.

Google Analytics
The original policy mentioned Google Analytics Universal Analytics. This service must be removed from the privacy policy if it is no longer active. If a different analytics tool is active, the exact name of the service must be indicated and its configuration described, including anonymisation, identifiers, purposes, retention and transfers.

Pinterest
Pinterest buttons, widgets, conversion tags and services must be mentioned only if they are actually present. Any use for advertising, remarketing, conversion tracking or profiling must be subject to the applicable legal basis and described in the Cookie Policy.

Google Fonts and external content
Whenever possible, fonts and other static content should be hosted locally. If the Website loads content from external servers, the provider, the technical data communicated, the purpose and any international transfer must be indicated.

9. Providers and receivers

The data may be disclosed, to the extent necessary, to:

  1. providers of hosting, maintenance, security and website management services;
  2. providers of platforms for sending newsletters and Communications;
  3. providers of consent management tools, cookies, tags and tracking pixels;
  4. consultants, professionals and agencies that support the Data Controller;
  5. public authorities and entities authorised by law.

The Data Controller checks the roles of the providers involved. When the provider processes data on behalf of the Data Controller, it is appointed as Data Processor pursuant to the applicable legislation; when it determines the purposes and means together with the Data Controller, the conditions for joint controllership are assessed.

10. Transfers to third-party countries

Some providers may be based or use infrastructure and subcontractors outside the European Economic Area. Before activating the service, the Data Controller shall verify the legal basis for the transfer, any adequacy decision, the appropriate safeguards and the necessary additional measures.

The transfers actually carried out and the providers involved must be indicated in the Cookie Policy or in this privacy policy in an up-to-date manner. The generic reference to the “USA” or “Ireland” does not replace the indication of the specific processing carried out.

11. Retention periods

The data are retained for the time necessary for the purpose for which they are collected and, subsequently, for any period necessary to comply with legal obligations or to establish, exercise or defend rights.

In particular:

  1. Data from the contact form are retained for the time necessary to handle the request and for any periods required to protect rights;
  2. Data relating to subscription, consent, withdrawal and unsubscription are retained for the time necessary to demonstrate the user’s choices and to handle objections;
  3. Individual data relating to the opening of Communications are retained only for the period necessary for the specific purpose and no longer than the period documented by the Data Controller;
  4. Data used for aggregate statistics are retained in anonymous form or, if not yet anonymous, for the time strictly necessary for the anonymisation process;
  5. Technical and security logs are retained for the period necessary for security, maintenance and the protection of rights;
  6. Data collected through cookies and other tracking tools are retained for the periods indicated in the Cookie Policy.

12. Rights of the data subject

Within the limits provided for by law, the data subject has the right to request access to personal data, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest.

Where processing is based on consent, the data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal. For Communications containing tracking pixels, withdrawal of consent may also be exercised in a granular manner, limited to tracking.

The data subject may also object to direct marketing, including profiling related to such marketing, at any time, free of charge and without giving reasons.

Requests can be sent to info@cavalleri.com. The Data Controller shall respond within the time limits set by the applicable legislation, usually within one month of receiving the request.

The data subject has the right to lodge a complaint with the Data Protection Authority or to take legal action before the competent court.

13. Security, logs and legal defence

For operational, maintenance and security purposes, the Website, email sending systems and third-party services may generate logs containing technical data and, where necessary, personal data.

The data may be used to prevent abuse, fraud, phishing, spam and unauthorised access, as well as to establish, exercise or defend a right in court or out of court. The Data Controller may be required to disclose data to public authorities when required by law or by a lawful order.

14. Changes to this privacy policy

The Data Controller may update this policy to reflect regulatory, technical or organisational changes. The date of the last update is indicated at the beginning of the document.

If a change affects processing based on consent, the Data Controller shall obtain a new choice where necessary. Changes relating to the use of tracking pixels must be communicated in an appropriate manner and, for new processing activities, before the relevant Communications are sent.

15. Deadline for compliance with regard to tracking pixels

For processing activities already underway as of the publication date of the Italian Data Protection Authority’s Guidelines of 17 April 2026, the Data Controller must complete the necessary compliance measures within six months of their publication in the Official Gazette, as specified in the Guidelines, which generally means by 29 October 2026.

Within this period, the following must be completed in relation to the processing actually carried out:

  1. the specific privacy notice on the use of tracking pixels;
  2. verification of the purposes and the legal basis;
  3. prior consent where necessary;
  4. the granular withdrawal mechanism;
  5. the recording of the user’s choices;
  6. verification of roles and agreements with providers;
  7. technical measures for minimisation, pseudonymisation and privacy by design.

For new processing activities, these measures must be applied before sending Communications containing tracking pixels.

16. Cookie Policy and further information

This privacy policy is coordinated with the Cookie Policy, which describes the tracking tools used on the Website. Further information may be requested from the Data Controller at any time at info@cavalleri.com.

17. Key definitions

Personal data: any information relating to an identified or identifiable natural person, whether directly or indirectly.
Tracking pixel: an element, usually consisting of a remote image or similar technology, embedded in an email communication and capable of generating a technical request when the message is opened or viewed.
Tracking tool: any technology, including cookies, pixels, web beacons, scripts, tags, unique identifiers and similar techniques, capable of reading, storing or transmitting information from the user’s device or client.
Data subject: the natural person to whom the personal data refer.
Data Controller: Cavalleri Comunicazione S.a.s., which determines the purposes and means of the processing.
Data Processor: the party that processes personal data on behalf of the Data Controller.
Communications: newsletters, DEM, transactional, automated, institutional or service-related emails sent by the Data Controller.
Cookie Policy: a document that describes the cookies and other tracking tools used through the Website, their purposes, providers, durations and methods of managing preferences.

Regulatory references

This privacy policy has been prepared taking into account Regulation (EU) 2016/679, Italian Legislative Decree 196/2003 and subsequent amendments, the provisions applicable to electronic communications and the Italian Data Protection Authority’s Guidelines on the use of tracking pixels in email communications, Provision No. 284 of 17 April 2026, published in the Official Gazette on 29 April 2026.

Last updated: 16 September 2026