Privacy Policy

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
Updated version: 11 June 2026

Data Controller and contact details

The Data Controller is Zucchetti Centro Sistemi S.p.A., with registered office at Via Lungarno 305 – 52028, Terranuova Bracciolini (AR), Italia.

Email: privacy@zcscompany.com
Certified email (PEC): zcs@pec.it

The Data Protection Officer (DPO) can be contacted at the following e-mail address: privacy@zcscompany.com

Scope of application

This notice concerns the processing of personal data of users authorized to access and use the "Azzurro Studio" platform, an IT tool used for the creation and management of quotes, technical configurations, bills of materials and related functional activities.

This notice is provided:

• pursuant to Art. 13 GDPR, when personal data is collected directly from the user, for example during first access, account activation, profile completion or use of the platform;
• pursuant to Art. 14 GDPR, when the user's personal data is disclosed to ZCS by third parties, such as, by way of example, the user's employer company, distributors, platform administrators, sales contacts or other parties authorized to create or manage accounts.

Where the data is not collected directly from the data subject, the source of the data is the party that requests, enables or manages the user's account on the platform.

Purposes of processing and legal bases

The personal data will be processed for the following purposes.

Creation, management and activation of the user account

The data is processed to enable account creation, user identification, assignment of the correct authorization profile, access to the platform and ordinary management of the account.

Legal basis:

• performance of contractual or pre-contractual measures, where applicable;
• the Data Controller's legitimate interest in managing the platform and B2B relationships with customers, distributors, partners and other authorized parties.

Provision of the platform's functionalities

The data is processed to enable the use of Azzurro Studio's functionalities, including the preparation of quotes, configurations, bills of materials, technical documents and other activities related to the operational use of the tool.

Legal basis:

• performance of contractual or pre-contractual measures, where applicable;
• the Data Controller's legitimate interest in providing a digital tool functional to the management of commercial and technical relationships with customers, distributors and partners.

Administrative, technical and operational management of the platform

The data may be processed for configuration, maintenance, technical support, anomaly management, user support, system updates and platform administration activities.

Legal basis:

• the Data Controller's legitimate interest in the proper management, maintenance and operational continuity of the platform;
• fulfillment of contractual obligations, where applicable.

IT security, abuse prevention and system protection

Technical data and logs may be processed to ensure the security of the platform, prevent unauthorized access, and detect anomalies, abuse, security incidents or improper use of the system.

Legal basis:

• the Data Controller's legitimate interest in the security of its information systems, the protection of its corporate assets and the protection of users;
• fulfillment of legal obligations, where applicable.

Internal statistical analysis on platform usage

Data relating to the use of the platform may be processed to carry out internal statistical analyses, including in aggregate form, relating for example to the number of quotes generated, the functionalities used, product preferences and the areas of greatest use of the tool.

Such analyses are aimed at improving the platform, optimizing internal processes, commercial and technical planning, and evaluating the performance of the service.

Legal basis:

• the Data Controller's legitimate interest in analyzing the use of its digital tools, improving services and planning commercial and organizational activities.

Where the data is processed in anonymous or aggregate form such that it does not allow the identification of users, such information does not constitute personal data.

Fulfillment of legal obligations and protection of rights

The data may be processed to fulfill obligations set forth by law, regulations or orders of the competent authorities, as well as to ascertain, exercise or defend the Data Controller's rights in judicial or extrajudicial proceedings.

Legal basis:

• fulfillment of legal obligations;
• the Data Controller's legitimate interest in the protection of its rights.

Cookies and other tracking tools

The platform may use cookies and other technical tools necessary to enable the proper functioning of the service, including, by way of example, tools necessary for user authentication, session management, platform security, prevention of unauthorized access and the maintenance of the user's technical preferences.

Such tools are used to the extent strictly necessary to provide the service requested by the user and do not require the acquisition of consent, without prejudice to the related notice.

The platform may also use measurement and statistical analysis tools regarding the use of the service, including through third-party providers, in order to understand platform usage, improve its functionalities and verify the effectiveness of the services offered. Where such tools are configured to produce aggregate statistics and appropriate minimization measures are adopted, without combining the data with other information or disclosing it to further third parties, they may be managed under the regime provided for technical tools.

Any use of cookies or other non-technical tracking tools, including non-anonymized analytics tools, profiling, marketing, remarketing, advertising personalization or integration with third-party services that are not strictly necessary, will be managed through appropriate preference management tools.

For further information on the cookies and other tracking tools used, as well as to manage or modify the preferences expressed, please refer to the Cookie Policy and/or the consent management system available on the platform.

Purposes of processing and legal bases

For the purposes indicated above, ZCS may process the following categories of personal data:

• the user's identification and contact data, such as first name, last name, e-mail address and, where provided, telephone number;
• professional and organizational data, such as the company to which the user belongs, associated distributor or contact person, reference market, role or authorization profile assigned within the platform;
• account-related data, such as credentials, user ID, account status, and date of creation, activation, modification or deactivation;
• data relating to the use of the platform, such as quotes, configurations, bills of materials or documents generated, functionalities used, product preferences and statistical data on the use of the service;
• technical and security data, such as IP address, access logs, session data, browser information, the device used and other application logs necessary for the security, maintenance and operation of the platform.

ZCS does not require users to provide special categories of personal data pursuant to Art. 9 GDPR.

Nature of the provision of data

The provision of the data necessary for the creation and management of the account is necessary to enable access to and use of the platform.

Failure to provide the mandatory data may result in the impossibility of creating the account, accessing the tool or using its functionalities.

The provision of the telephone number, where indicated as optional, does not affect access to the platform, unless such data is necessary for specific operational or support needs.

Data recipients

Personal data may be disclosed to or made accessible, to the extent strictly necessary to pursue the purposes indicated, to the following categories of parties:

• staff and collaborators of the Data Controller authorized to process the data;
• platform administrators and parties responsible for the technical or operational management of the tool;
• providers of IT, hosting, cloud, maintenance, software development, technical support and IT security services;
• group companies, where necessary for organizational, technical or management needs;
• consultants and professionals who assist the Data Controller;
• public authorities, supervisory bodies or parties entitled to receive the data by virtue of legal provisions or orders of the authority.

External parties that process personal data on behalf of the Data Controller are appointed as data processors pursuant to Art. 28 GDPR.

Some providers may be based or may process personal data outside the European Economic Area (EEA). In such cases, ZCS ensures that the transfer takes place in compliance with Articles 44 et seq. of the GDPR, adopting adequate safeguards, such as the Standard Contractual Clauses approved by the European Commission or other equivalent protection measures.

Retention period

Personal data will be retained for the time necessary to pursue the purposes for which it was collected.

In particular:

• account-related data will be retained for the entire duration of the user's authorization to use the platform and, subsequently, for the time necessary to manage any administrative, technical, contractual or defensive needs;
• technical and security logs will be retained for a period proportionate to the security, verification and traceability needs of the system;
• data relating to the use of the platform may be retained for internal statistical purposes, preferably in aggregate or anonymized form;
• data necessary for the protection of the Data Controller's rights may be retained for the period provided for by the applicable statute of limitations.

At the end of the applicable retention periods, the data will be deleted, anonymized or irreversibly aggregated, save for further retention required by legal obligations or necessary for the protection of the Data Controller's rights.

Rights of the data subject

As a data subject, you may exercise at any time the rights recognized by Articles 15-22 of Regulation (EU) 2016/679, including:

• Right of access: obtain confirmation as to whether or not personal data concerning you is being processed and receive the information provided for by the applicable regulations;
• Right to rectification: obtain the correction of inaccurate data or the completion of incomplete data;
• Right to erasure: request the erasure of personal data in the cases provided for by the GDPR;
• Right to restriction of processing: obtain the restriction of processing where the conditions established by law apply;
• Right to data portability: receive the personal data in a structured, commonly used and machine-readable format, and transmit it to another data controller, where technically feasible;
• Right to object: object, on grounds relating to your particular situation, to the processing of personal data in the cases permitted by the applicable regulations;
• Right to withdraw consent: withdraw at any time any consent given, without affecting the lawfulness of processing carried out prior to withdrawal;
• Right to lodge a complaint: contact the Garante for the protection of personal data (Italian Data Protection Authority) or another competent supervisory authority.

The exercise of such rights is subject to the limits and conditions provided for by the GDPR and national legislation. In certain cases, the exercise of specific rights may be deferred, limited or excluded in order to fulfill legal obligations or for the protection of rights in judicial proceedings.

To exercise these rights, you may send a written request to the Data Controller at the e-mail address privacy@zcscompany.com or through the other contact details indicated in this notice.

Changes to this notice

This notice may be updated in the event of changes to the platform, the purposes of processing, operational methods or the applicable regulations.

Users will be informed of any updates through appropriate means, including publication of the updated version within the platform or through service communications.