Privacy Policy

Last updated: 30 September 2026

This policy explains how CABRU s.a.s. processes the personal data collected through the website www.cabru.it, in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Italian law.

1. Data Controller

The Data Controller is CABRU s.a.s., VAT no. 00772250965, Via Enrico Forlanini 52, 20862 Arcore (MB), Italy.
Email: [email protected] · Phone: +39 039 6013988.

2. What data we collect

Data you provide voluntarily

When you use the website forms (contact request and quotation request) we collect the data you provide: full name, email address, phone number, company or institution, department, the content of your message and, for quotations, the products and quantities you indicate. First name, last name and email address are required so that we can reply; the other fields are optional. We also record the choices you make on the consent boxes, so that we can demonstrate the basis on which we process your data.

Browsing data

The website is static and does not use profiling cookies or advertising tracking tools. Visits to the website pass through the Cloudflare network, which protects it from attacks and automated access and makes it load faster. The hosting provider and Cloudflare may record, for technical and security purposes, data such as the IP address and connection information in server logs.

To know how many people visit the website and which pages are read, we use Cloudflare Web Analytics, a measurement service that does not use cookies and does not recognise visitors from one visit to the next. To produce these statistics Cloudflare processes the IP address and some technical information about the visit, such as the page requested, the referring page, the browser type and the country. This information is used only to provide us with aggregated statistics: it is not used for advertising or to profile visitors.

Local storage

The catalogue page uses your browser's local storage to temporarily keep the products you add to a quotation request. This data stays on your device, is not transmitted automatically and is not used for tracking.

3. Purposes and legal basis

To respond to your information and quotation requests and to handle pre-contractual contacts. Legal basis: performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and/or the Controller's legitimate interest in responding to the requests received (Art. 6(1)(f)).
To comply with any applicable legal, accounting and tax obligations. Legal basis: legal obligation (Art. 6(1)(c)).
To protect the website from attacks and misuse and to measure visits in aggregated form. Legal basis: the Controller's legitimate interest in the security of the website and in understanding how it is used (Art. 6(1)(f) GDPR).
To send you updates on CABRU products and news, only if you ticked the relevant optional box in the form. Legal basis: consent (Art. 6(1)(a) GDPR). You may withdraw it at any time by writing to [email protected], without affecting the lawfulness of processing carried out before the withdrawal.

The box is optional and unticked by default: you can send an information or quotation request without giving that consent. We do not carry out profiling or automated decision-making, and we do not process special categories of data.

4. How we process data

Data is processed by electronic means, applying technical and organisational measures adequate to protect it against unauthorised access, loss or disclosure. Only the Controller's authorised staff and the processors listed below have access to it.

5. Recipients and processors

To operate the website and handle requests we rely on providers acting as data processors:

Google — the forms are processed via Google Apps Script; submitted data is stored in a Google Sheet and emails are sent through Google's mail service.
Supabase — requests sent from the website are stored in a database hosted in the European Union (Ireland).
GitHub, Inc. — website hosting (GitHub Pages).
Cloudflare, Inc. — protection and delivery of website traffic and aggregated visit measurement (Cloudflare Web Analytics).

Data is not disclosed or sold to third parties for their own purposes. It may be shared with advisers or authorities where required by law.

6. Transfers outside the European Union

The providers indicated above (Google, GitHub, Supabase, Cloudflare) may process data outside the European Union/European Economic Area. Where this happens, the transfer takes place on the basis of European Commission adequacy decisions or Standard Contractual Clauses (SCCs) provided for in those providers' data processing terms, suitable to ensure an adequate level of protection.

7. Retention period

We keep the data for as long as necessary to handle your request and to pursue any resulting business relationship, as well as for the period required by legal, accounting and tax obligations. Afterwards the data is deleted or anonymised. Data used to send you updates on products and news is kept until you withdraw your consent.

8. Your rights

As a data subject you have the right to ask the Controller for access to your personal data, its rectification or erasure, restriction of processing, to object to processing and to obtain data portability (Arts. 15-22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights you can write to [email protected].

9. Complaint to the supervisory authority

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU state where you reside.

10. Cookies

This website does not use profiling cookies or third-party cookies for tracking, and the visit measurement tool described in section 2 does not use cookies: for this reason no cookie consent banner is shown. Cloudflare may set technical cookies that are strictly necessary for security, for example when it checks that a visit does not come from an automated program: they are not used for tracking and do not require consent. The website also uses the browser local storage described in section 2, for a function requested by the user.

11. Changes to this policy

We may update this policy over time. The version in force is always the one published on this page, with the last-updated date shown at the top.

12. Contact us

For any questions about this policy or the processing of your data you can contact us:

By email: [email protected]
By phone: +39 039 6013988