Last updated: October 27, 2026

I Medicei S.p.A. is committed to safeguarding the confidentiality and protection of the personal data of users who visit the website www.imedicei.it (hereinafter, the “Site”).

This notice describes the methods for collecting, using, storing, and protecting personal data, as well as the possible use of cookies and other tracking tools during browsing.

Data processing is carried out in compliance with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree 196/2003 as amended, the applicable legislation on electronic communications, and the provisions of the Italian Data Protection Authority.

1. Data Controller

The Data Controller is:

I Medicei S.p.A.
Registered office: Via dell’Artigianato 53, 50056 Montelupo Fiorentino (FI), Italy
Tax Code and VAT No.: 04648620484
REA: FI-469084
Email: info@imedicei.it
Certified email (PEC): imedicei@pecsicura.it

For any request concerning the processing of personal data or the exercise of the rights recognized by law, data subjects may use the contact details indicated above.

2. Scope of application

This notice applies to personal data processed through the Site, including data collected during browsing, through any online forms, and through communications sent voluntarily by the user to the published company contact details.

This notice does not apply to third-party websites that may be accessed through links on the Site, nor does it replace the specific notices that may be provided in relation to particular contractual, commercial, professional, or employment relationships.

3. Categories of personal data processed

3.1 Browsing data

The IT systems and applications that enable the Site to function may automatically acquire certain information necessary for communication over the Internet.

This information may include:

• IP address of the device used;
• date and time of access and of requests to the server;
• addresses of the pages and resources requested;
• method used to make the request;
• response codes returned by the server;
• size of the data transferred;
• browser type, operating system, and technical characteristics of the device;
• technical information relating to the connection and the origin of the requests;
• any data relating to errors, anomalies, or unauthorized access attempts.

This information may be processed to ensure the correct display of pages, guarantee system security, identify technical problems, and prevent unlawful use of the Site.

3.2 Data provided voluntarily by the user

When a user contacts I Medicei S.p.A. by email, telephone, or any forms available on the Site, the personal data voluntarily communicated may be processed.

This data may include first name, last name, email address, telephone number, company, professional role, subject of the request, and further information included in the message.

The data is used exclusively to manage the communication, provide the information requested, and carry out activities directly connected with the request received, unless further and specific legal bases apply.

Please do not transmit special categories of personal data through normal contact forms, such as information relating to health, religious beliefs, political opinions, or other sensitive data that is not necessary for managing the request.

3.3 Data collected through cookies and similar technologies

The Site may use cookies, local storage systems, and other technical tools to ensure the correct functioning of the pages and, where provided and permitted, to carry out statistical analyses or enable features offered by third parties.

The characteristics and management methods of these tools are described in the section dedicated to the Cookie Policy.

4. Purposes and legal bases of processing

Personal data is processed for specified, explicit, and legitimate purposes, in compliance with the principles of lawfulness, fairness, transparency, minimization, and storage limitation.

4.1 Operation and security of the Site

Technical and browsing data is processed to allow access to content, ensure service stability, prevent cyberattacks, detect anomalies, and protect the integrity of systems.

Legal basis: the legitimate interest of the Controller in ensuring the security and proper functioning of the Site, pursuant to Art. 6, para. 1, letter f) of the GDPR, as well as any applicable legal obligations.

4.2 Management of contact requests

Data provided through communication channels is used to respond to requests for information, provide assistance, manage communications, and follow up on any commercial or professional requests.

Legal basis: performance of pre-contractual measures taken at the request of the data subject, pursuant to Art. 6, para. 1, letter b) of the GDPR, where applicable, or the Controller’s legitimate interest in managing communications and professional relationships, pursuant to Art. 6, para. 1, letter f).

4.3 Compliance with legal obligations

Data may be processed when necessary to comply with obligations laid down by national or European legislation or to respond to legitimate requests from the competent authorities.

Legal basis: compliance with a legal obligation, pursuant to Art. 6, para. 1, letter c) of the GDPR.

4.4 Protection of the Controller’s rights

Where necessary, data may be processed to establish, exercise, or defend a right in court or out of court, manage disputes, and prevent fraudulent or unlawful conduct.

Legal basis: the Controller’s legitimate interest in protecting its rights, pursuant to Art. 6, para. 1, letter f) of the GDPR, without prejudice to any further applicable conditions.

4.5 Statistical analysis and improvement of the Site

Where traffic analysis tools are used, data may be employed to understand the use of pages, identify browsing problems, and improve the organization of content.

When statistical tools involve cookies or identifiers that are not exempt from the consent requirement, the related processing is subject to obtaining the user’s consent, pursuant to Art. 6, para. 1, letter a) of the GDPR and the rules applicable to cookies.

Any statistical tools equivalent to technical tools, within the limits and under the conditions established by the legislation, may be used without prior consent.

4.6 Optional features and third-party content

If the Site integrates external services that involve the use of non-necessary tracking tools, the related processing may take place on the basis of the data subject’s consent, according to the methods specified in the Cookie Policy.

Where external services require other processing of personal data, the relevant legal bases indicated in the related information will apply.

5. Nature of data provision

The provision of technical data strictly necessary for the operation of the Site is connected with the use of Internet protocols and the provision of the requested service.

The provision of data for contact requests is voluntary. Failure to provide the necessary information may prevent the Controller from responding to or properly managing the request.

Consent to the use of non-necessary cookies and tracking tools is optional. Failure to give consent does not prevent normal consultation of the Site’s content, although it may limit certain optional features connected to external services.

6. Processing methods and security

Personal data is processed using IT, electronic, and, where necessary, paper-based tools, according to methods consistent with the stated purposes.

The Controller adopts technical and organizational measures appropriate to the risks of processing, with the aim of preventing unauthorized access, disclosure, loss, alteration, or unlawful use of data.

These measures may include access control systems, communication protection, update and maintenance procedures, authorization management, backup systems, and security monitoring tools.

Access to personal data is limited to authorized persons and suppliers who need the information to carry out their respective activities, in compliance with the applicable instructions and obligations.

7. Recipients of personal data

Within the limits of the purposes described, personal data may be disclosed or made accessible to the following categories of recipients:

• personnel and collaborators authorized by the Controller;
• providers of hosting services and IT infrastructure;
• providers appointed to handle the technical management, maintenance, updating, and security of the Site;
• providers of email, communication, and request management services;
• any providers of statistical tools and digital services actually used;
• consultants and professionals, where necessary for administrative or legal needs;
• public authorities and other parties entitled to request data under the law.

External parties that process personal data on behalf of the Controller are appointed, where necessary, as Data Processors pursuant to Art. 28 of the GDPR. Other recipients may operate as independent controllers, according to their respective responsibilities.

Personal data is not disseminated indiscriminately and is not transferred to third parties for independent commercial purposes in the absence of an appropriate legal basis.

8. Transfer of data outside the European Economic Area

Data processing may involve IT or technology service providers operating outside the European Economic Area or providing for access to data from third countries.

If international transfers of personal data occur, the Controller verifies the presence of the conditions required by Chapter V of the GDPR.

Transfers may be based, depending on the case, on adequacy decisions adopted by the European Commission, on Standard Contractual Clauses approved by the Commission, or on other instruments and safeguards permitted by law.

Where required, supplementary measures are assessed and adopted to ensure a level of protection substantially equivalent to that provided in the European Union.

Data subjects may request information on the safeguards applied to transfers concerning them by contacting the Controller.

9. Data retention periods

Personal data is retained for the period necessary to achieve the purposes for which it was collected and, where applicable, for the periods required by law.

• Browsing data and technical logs: for the time necessary to ensure the operation, security, and maintenance of systems, according to the retention policies applied to the services used, without prejudice to the need to ascertain unlawful acts or defend rights.
• Contact requests: for the time necessary to manage the request and any resulting relationships, taking into account legal obligations and documentary or rights protection needs.
• Data relating to contractual relationships: according to the retention terms provided for by the applicable legislation and any limitation periods.
• Data collected through statistical tools: according to the settings of the services actually used and within the limits necessary for the stated purposes.
• Cookie preferences: for the period established by the consent management system adopted, in compliance with the indications of the Italian Data Protection Authority.

At the end of the respective retention periods, the data is deleted, anonymized, or further retained only where an appropriate legal basis exists.

10. Rights of data subjects

Data subjects may exercise, in the cases and within the limits provided for by the GDPR, the following rights:

• Access: obtain confirmation of the existence of processing of personal data concerning them and receive information and a copy of the data.
• Rectification: request the correction of inaccurate data or the completion of incomplete data.
• Erasure: obtain the deletion of data where the conditions provided for by Art. 17 of the GDPR are met.
• Restriction: request the restriction of processing in the circumstances provided for by law.
• Portability: receive the data in a structured, commonly used, and machine-readable format, where the relevant conditions are met.
• Objection: object to processing based on legitimate interest, on grounds relating to their particular situation, in the cases provided for by Art. 21 of the GDPR.
• Withdrawal of consent: withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Complaint: lodge a complaint with the competent supervisory authority, without prejudice to the right to seek judicial remedy.

Requests may be sent to info@imedicei.it or by certified email (PEC) to imedicei@pecsicura.it.

The Controller responds to requests within the time limits set out in Art. 12 of the GDPR, generally within one month of receipt, unless any extensions permitted by law apply.

11. Complaints to the Data Protection Authority

If the data subject believes that the processing of their personal data is carried out in violation of the applicable legislation, they may lodge a complaint with the Italian Data Protection Authority.

For information on how to submit a complaint, please consult the Authority’s official website: www.garanteprivacy.it.

12. Automated decision-making processes and profiling

As part of normal consultation of the Site and ordinary management of contact requests, no exclusively automated decision-making processes are envisaged that produce legal effects concerning the data subject or similarly significantly affect them, pursuant to Art. 22 of the GDPR.

Any use of online profiling tools, where present, is governed by the sections dedicated to cookies and tracking technologies and requires compliance with the conditions provided for by the applicable legislation.

13. Processing of minors’ data

The Site presents institutional and commercial information relating to company activities and is not specifically intended for minors.

The Controller does not intend to deliberately collect personal data of minors through features for which consent is required that the minor cannot validly provide.

If collection that does not comply with the legislation is detected, appropriate measures will be adopted to manage or delete the data concerned.

14. Links to external sites

The Site may contain links to websites, platforms, and services managed by third parties.

Access to such resources may involve personal data processing independently governed by the respective managers. I Medicei S.p.A. does not determine the processing methods adopted by external sites and invites users to consult the relevant notices before providing personal data.

15. Cookie Policy: general information

This section describes the characteristics of cookies and other tracking tools that may be used during browsing on the Site, as well as the methods through which the user can manage their preferences.

Cookies are small text files that visited websites may store on the user’s device, such as a computer, smartphone, or tablet. During subsequent visits, this information may be read by the site that generated it or by other parties, depending on the characteristics of the tool.

The same purposes may also be pursued through different technologies, such as local storage, online identifiers, pixels, or other tracking tools, to which the relevant provisions apply.

16. Types of cookies

16.1 Technical and strictly necessary cookies

Technical cookies allow communications to be transmitted over an electronic network or are strictly necessary for the provision of a service expressly requested by the user.

They may be used to:

• ensure the correct loading of pages;
• manage the browsing session;
• store technical preferences necessary for the requested service;
• maintain the settings relating to the selected language;
• protect the Site from unauthorized access and harmful automated behavior;
• store the preferences expressed in the management of cookie consent.

When they meet the conditions provided for by law, these cookies do not require the user’s prior consent. The obligation to provide adequate information on their use remains unaffected.

16.2 Functional cookies

Functional cookies may be used to remember certain user preferences and provide additional features.

Where they are strictly necessary to provide a service expressly requested, they may fall within the category of technical cookies. In other cases, their use is subject to consent, where required by law.

16.3 Statistical or analytics cookies

Statistical cookies allow information to be collected on the use of the Site, such as the number of visits, the most frequently viewed pages, browsing paths, and the operation of the different sections.

Some statistical tools may be considered equivalent to technical cookies if they comply with the conditions established by the Italian Data Protection Authority, including safeguards relating to data minimization and limitation of the possibility of identifying the user.

When these conditions are not met, statistical cookies and other analysis tools requiring consent are activated only after a positive choice by the user.

16.4 Profiling and marketing cookies

Profiling cookies and similar tools may be used to analyze users’ behavior, habits, and interests, including for the purpose of personalizing content or advertising messages.

Their use, where provided, requires the user’s prior consent, which must be freely given, specific, informed, and unambiguous.

Any refusal does not affect access to the normal features of the Site.

17. First-party and third-party cookies

Cookies may be distinguished based on the party that installs and manages them.

• First-party cookies: these are set directly by the Site’s domain.
• Third-party cookies: these are set by external domains or services integrated into the pages, according to the characteristics of the technologies used.

The possible presence of third-party cookies may depend on the integration of videos, maps, external content, statistical services, security tools, and other digital features.

Processing carried out by external providers may also be governed by their respective personal data protection notices.

18. Duration of cookies

Based on duration, cookies are divided into:

• Session cookies: these are normally deleted at the end of the browsing session, according to the browser’s behavior.
• Persistent cookies: these remain stored on the device until the scheduled expiry date or until they are deleted by the user.

The actual duration of each cookie depends on its function and on the settings of the service that uses it.

19. Cookies and services used by the Site

The Site is created using web technologies and a WordPress content management system. The operation of the pages may require technical tools necessary for browsing, managing preferences, and ensuring the security of communications.

Any use of third-party cookies and services depends on the features actually enabled and on the technical configurations adopted.

For each tool actually used, the information to be made available includes, where applicable, the name of the cookie or identifier, the provider, the purpose, the category, the duration, and any need for consent.

The updated details of the tools subject to consent must be available through the Site’s cookie preference management system, where present, or through an updated list published in this notice.

20. Management of cookie consent

When the Site uses cookies or tracking tools that require consent, the user is offered the possibility to freely express their preferences before they are activated.

The consent management system must allow users to:

• accept the use of optional tools;
• reject non-necessary tools;
• select the categories of tools for which consent is to be given;
• consult information on the purposes and the parties involved;
• subsequently modify or withdraw the preferences expressed.

Consent is not considered validly given solely by continuing to browse, scrolling a page, or using the Site without making a positive and unambiguous choice.

Cookies and tracking tools that require consent must remain disabled until valid consent is obtained.

21. Modification and withdrawal of preferences

The user may modify or withdraw at any time any consent given to the use of non-necessary cookies and tracking tools.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Preferences may be managed through the specific function made available by the Site, where provided, and through the settings of the browser used.

22. Managing cookies through the browser

The main browsers allow users to view, delete, limit, or block cookies through their respective privacy and security settings.

For further information, please consult the official guides:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Disabling strictly necessary technical cookies may compromise certain features of the Site or prevent it from functioning properly.

Deleting cookies from the browser does not necessarily result in the withdrawal of consents already recorded by any third-party services. Where available, it is therefore recommended to also use the preference management tools offered by the Site.

23. Embedded content and external services

Some pages may include content from external platforms, such as videos, maps, documents, social buttons, or other digital resources.

Interaction with such content may involve communications with the servers of the respective providers and, in certain circumstances, the processing of personal data or the use of tracking tools.

Non-necessary tools subject to consent must be activated exclusively in compliance with the preferences expressed by the user.

For information on processing carried out independently by external providers, please consult their respective notices.

24. Updates to this notice

I Medicei S.p.A. may modify or supplement this Privacy and Cookie Policy to adapt it to regulatory developments, indications from the competent authorities, organizational changes, or updates to the features and services used by the Site.

Changes are published on this page, indicating the date of update.

Where required by law, the introduction of new purposes or new tracking tools will involve the collection of new consent or the adoption of the further measures provided for.

25. Contacts and requests

For clarification on this notice, on the processing of personal data, or on the use of cookies, you may contact:

I Medicei S.p.A.
Via dell’Artigianato 53
50056 Montelupo Fiorentino (FI), Italy
Email: info@imedicei.it
Certified email (PEC): imedicei@pecsicura.it

This notice concerns the processing of personal data carried out through the website www.imedicei.it and must be read together with any specific notices provided in connection with further activities or services.