Privacy Policy

SIMICO SRL a socio unico Registered office: Via Giovanni Battista Moroni 11, 24060 Casazza (BG), Italia Warehouse: Via Acquasparsa 37, 24060 Grone (BG), Italia P.IVA/CF: 04709870168 | REA: BG - 483305 Email: info@simico.srl | Tel: +39 035 19775012 | PEC: simico@pec.it

Privacy contact: info@simico.srl — write to this address to exercise the rights under Arts. 15–22 of Regulation (EU) 2016/679.

---

2. Categories of data collected

Through our website, the client portal and the provision of logistics services we process the following categories of personal data:

• Identification and contact data: first name, surname, company name, email, telephone
• Tax and corporate data: VAT number, tax code, registered office, SDI recipient code
• Operational data: orders, inbound and outbound shipments, stock levels, transport documents
• Portal access data: credentials, access logs, IP address
• Browsing data: IP address, browser type, pages visited, session duration
• Technical cookies and, subject to consent, analytics and marketing cookies

3. Data processed on behalf of the client (as processor)

In order to carry out shipments we receive from our clients the data necessary for delivery: recipient name, address, telephone contact and any delivery instructions. For this data the client is the controller and SIMICO SRL acts as processor under Art. 28 GDPR, on the basis of the appointment set out in Annex B to the service contract. We process it solely on the client's documented instructions, to prepare the goods and hand them over to the carrier; it is not used for our own purposes and is not disclosed to third parties other than the appointed couriers, and authorised personnel are bound by a duty of confidentiality. In the event of a personal data breach we inform the client without undue delay and in any case within 48 hours of becoming aware of it, providing the information needed for the obligations under Arts. 33 and 34 GDPR. The client is entitled to verify compliance with these obligations through an annual audit, on at least 15 days' written notice and subject to the confidentiality of other clients. Sub-processors may be engaged within the limits set out in Annex B. On termination of the relationship the data is deleted or returned according to the client's instructions.

4. Purposes of processing and legal basis

Data is processed for the following purposes, each resting on a specific legal basis:

• Provision of logistics and fulfilment services, namely receiving, storage, preparation, labelling and shipping — performance of a contract, Art. 6(1)(b) GDPR
• Operational communications regarding orders, shipments and stock — performance of a contract, Art. 6(1)(b) GDPR
• Invoicing, accounting and tax compliance — legal obligation, Art. 6(1)(c) GDPR
• Sending commercial communications and newsletters — explicit and revocable consent, Art. 6(1)(a) GDPR
• System security, fraud prevention and process improvement — legitimate interest, Art. 6(1)(f) GDPR

5. Whether provision of data is required

Providing identification, tax and contact data is necessary in order to enter into and perform the contract: refusal makes it impossible for us to supply the service. Providing data for marketing purposes is optional, and refusal has no consequence whatsoever for the contractual relationship.

6. Methods of processing

Data is processed using electronic and telematic tools and, residually, on paper, applying technical and organisational measures adequate to prevent unauthorised access, loss, alteration and disclosure. Specifically: a WMS for warehouse management, cloud platforms with encryption of data in transit and at rest, role-based access control, and logging of operations performed.

7. Recipients of the data

Data may be disclosed to the parties listed below, appointed as processors pursuant to Art. 28 GDPR where they act on our behalf:

• Amazon EU S.à r.l. — Seller Central and SP-API integration for FBA services
• PrepBusiness — prep operations management system
• Couriers and carriers, including BRT, GLS, DHL and UPS, for delivery execution
• Vercel Inc. — hosting and distribution of the website and portal
• Resend — transactional email delivery
• Google Ireland Ltd. — Google Workspace for email and Google Analytics 4 for browsing statistics
• Cybot A/S (Cookiebot) — cookie consent management and record-keeping
• WhatsApp Ireland Ltd. — commercial contact channel, where activated by the user
• Accountancy firm and tax advisors, for accounting compliance
• Public authorities and supervisory bodies, in the cases provided for by law

8. Transfers outside the European Union

Client portal data, the operational database and email are hosted on servers located within the European Union. Two processing operations involve a transfer to the United States: transactional email delivery through Resend and the collection of aggregate browsing statistics through Google Analytics 4. Both providers adhere to the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its adequacy decision of 10 July 2023, and are additionally bound by the standard contractual clauses referred to in Art. 46 GDPR. Google Analytics is activated only after consent and with IP address anonymisation.

9. Retention period

Data is retained only for as long as strictly necessary for the purposes for which it was collected:

• Contractual and operational data: for the entire duration of the relationship
• Tax and accounting records: 10 years from entry, as required by Art. 2220 of the Italian Civil Code (statutory retention of accounting records)
• Delivery data received from the client: deleted when the client's account is closed
• Data processed for marketing purposes: until consent is withdrawn
• Browsing data and technical logs: 12 months maximum
• Cookie consent records: 12 months

10. Your rights

Under Arts. 15-22 GDPR you have the right to obtain access to your data and a copy of it, rectification of inaccurate or incomplete data, erasure, restriction of processing, and portability of the data in a structured, machine-readable format. You also have the right to object to processing based on legitimate interest and to processing for direct marketing purposes, and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Requests should be sent to info@simico.srl and receive a reply within one month. Your right to lodge a complaint with a supervisory authority or to bring proceedings before the courts remains unaffected.

11. Automated decision-making

We do not carry out profiling or automated decision-making producing legal effects on data subjects, or similarly significantly affecting them, within the meaning of Art. 22 GDPR.

12. Cookies and tracking technologies

The website uses technical cookies necessary for its operation, which are set without the need for consent, and analytics and marketing cookies which are subject to the consent collected through the banner. You may change your preferences at any time via the link in the footer. The up-to-date list of cookies is set out in the Cookie Policy.

13. Changes to this notice

We reserve the right to amend this notice to reflect regulatory or organisational changes. Substantial changes are communicated by publication on this page, stating the date of the last update; where required by law, consent will be collected again.