Dear User,
the Retelit Group is made up of the Parent Company Retelit S.p.A. and the other Companies which will process your data as joint controllers, pursuant to the Joint Controllership Agreement entered into under article 26 of the GDPR, the essential content of which is available on request through the contacts indicated below.

1. Who we are
The Joint Controllers are:

• Retelit S.p.A. with registered office in via Pola 9, Milan – 20124, retelit@pec.retelit.com;
• Retelit Digital Services S.p.A. (RDS) with registered office in via Pola 9, Milan – 20124, retelitdigitalservices@pec.it;
• Retelit Datacenter S.r.l. with registered office in via Pola 9, Milan – 20124, retelitdc@pec.it;
• Brennercom Tirol GmbH with registered office in Eduard Bodem Gasse 8, 6020 Innsbruck, office@brennercom-tirol.at;
• Retelit-X S.r.l. with registered office in Via Tucidide 14, Milan – 20134, retelitx@pec.it.

hereinafter collectively the “Retelit Group” and/or the “Joint Controllers”, provide, pursuant to art. 13 of the GDPR, appropriate information on the processing of personal data (hereinafter the “Data”), on the occasion of your visit to and browsing of our websites (hereinafter the “Sites”).
For any request concerning the processing of the Data, it will in any case also be possible to contact the Parent Company Retelit S.p.A. by sending

• a registered letter with return receipt to the registered office;
• a certified email (PEC) to the addresses indicated above;
• an email to the address privacy@retelit.it.

For the Companies belonging to the Retelit Group, please see the website, on the page /en/legal/legal-notes.

2. Data Protection Officer The Joint Controllers of the Retelit Group have appointed a Data Protection Officer (DPO).
The DPO for the Companies indicated below:

• Retelit S.p.A. with registered office in via Pola 9, Milan – 20124;
• Retelit Digital Services S.p.A. (RDS) with registered office in via Pola 9, Milan – 20124;
• Retelit Datacenter S.r.l. with registered office in via Pola 9, Milan – 20124;
• Retelit-X S.r.l. with registered office in via Pola 9, Milan – 20124.

can be contacted by email, at the address dpo@retelit.it

3. Type of Data and processing methods

3.1. Browsing data
The computer systems and software used to operate the website collect certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server – successful, error, etc. – and other parameters relating to the user’s operating system and IT environment).
Although this information is not collected in order to be associated with identified data subjects, by its very nature it could, through processing and association with data held by third parties, make it possible to identify users. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Sites and to monitor their correct operation. Specific privacy notices will be published on the pages of the Group’s sites, set up for the provision of certain services or for participation in specific initiatives. This privacy notice is also not to be considered valid for other third-party websites that may be accessed via links present on this website, for which no responsibility is assumed.

3.2. Data provided voluntarily by the user
No provision of personal data by the user is required in order to consult the Sites. However, any contact with the Controller, for example to request information via the “online form”, or the spontaneous sending of messages by electronic or traditional mail to the Controller’s contact details, entails the subsequent acquisition of such personal data of the sender, necessary to respond to the requests, as well as any other personal data voluntarily entered by the user in the relevant communications. Furthermore, while browsing the Sites, personal data may be collected through the use of cookies and similar technologies, which allow the Joint Controllers to acquire information relating to the use of the Sites such as, by way of example, IP addresses, log data, device or browser identifiers, information on the pages visited and on how content is interacted with.

3.3. Cookies and other tracking systems
See HERE the privacy notice on the use of cookies and other technologies.

4. Purposes of the processing.
The Joint Controllers carry out the Processing of personal data for the following purposes:
a. to allow you to browse and use the website;
b. to handle your request for contact or information through the completion of the online form;
c. for direct marketing activities, consisting of sending advertising material or carrying out market research, commercial and promotional communication, newsletters, by automated means (email, SMS) and traditional means (telephone call with an operator and paper mail). In order to compare and possibly improve the results of automated communications, the Joint Controllers may use systems with reports, which make it possible to know the number of readers and interactions with the message, the devices and operating systems used to read the communication;
d. Data processing takes place for the purposes of statistical analysis and categorisation of business information, through the use of commercial data providers. This information will be integrated into the company CRM to allow a classification of customers into homogeneous groups, thus improving the management of the services offered;
e. authentication and use of the reserved areas and online services made available;
f. to comply with applicable legal obligations and to respond to requests from the competent authorities;
g. management of disputes and any claims in court;
h. the data could be used to ascertain liability in the event of computer crimes;
i. Management of data subjects’ requests, pursuant to art. 15 et seq. of the GDPR (exercise of the data subject’s rights).

5. Legal bases of the processing.
The legal bases of the Processing for the purposes indicated above are the following:

• Performance of pre-contractual and/or contractual purposes, under Art. 6 par. 1 lett. b) EU Reg. 2016/679, for purposes b) and e);
• Consent of the data subject, under Art. 6 par. 1 lett. a) EU Reg. 2016/679, for purpose c);
• Pursuit of the legitimate interest of the data controller or of third parties, provided that the interests or fundamental rights and freedoms of the data subject do not prevail, under Art. 6 par. 1 lett. f) EU Reg. 2016/679, for purposes a), d), g) and h);
• Compliance with a legal obligation to which the data controller is subject, under Art. 6 par. 1 lett. c) EU Reg. 2016/679, for purposes f) and i).

6. Data retention period.
The Joint Controllers will process your Data for the time strictly necessary to achieve the purposes indicated and described in this privacy notice. In particular, depending on the purpose of the processing, the retention periods provided for are as follows: Purpose of processing / Retention period. Browsing and cookies: the retention times of the cookies adopted by this website are indicated in the Cookie Notice.

Request for contact or information	Up to 60 months from the collection of the requester’s data or until consent is withdrawn, where given.
Processing for the performance of direct marketing activities	Until consent is withdrawn or up to 24 months from the end of the contractual relationship.
Statistical analysis and categorisation	60 months from the collection of the lead’s data or until consent is withdrawn, where given.
Use of the My Portal reserved area	For the duration of the contractual relationship and for the technical time necessary to disable the credentials.
Use of Online services	For the duration of the contractual relationship.
Compliance with legal obligations and response to the competent Authorities	For the time necessary to fulfil the legal obligations or requests of the Authorities for which the data was collected.
Management of disputes in court	10 years, save for objection and save for the time necessary for the defence in court.

7. Nature of the provision of data
Depending on the purpose of the processing, the nature of the provision of personal data is defined as follows:

• The provision of personal data is necessary for purposes a), b), d), e), f), g), h), and i). In the absence of the provision of the data it will not be possible to carry out the processing purposes in question;
• The provision of data is optional for purpose c). In the absence of provision, no direct marketing communications will be sent to you. This will not affect the performance of the other processing purposes indicated in this privacy notice.

8. Recipients of the data
The data will not be disseminated. The personal data will be communicated to parties qualified as Joint Controllers, autonomous Controllers, or Data Processors (art. 28 GDPR) and processed by natural persons (art. 29 GDPR) who act under the authority of the Joint Controllers, autonomous Controllers and Processors on the basis of specific instructions provided regarding the purposes and methods of the processing.
The data will be communicated to recipients belonging to the following categories:

• Parties necessary for carrying out the activities connected with and resulting from the provision of services through the sites, hosting of the sites, parties for the provision of marketing activities (subject to consent), as external processors or autonomous Controllers;
• Group Companies;
• Authorities whose right of access to the Data is expressly recognised by law or by measures issued by other competent Bodies.

It is not technically possible to refuse to communicate the Browsing Data in order to use the services of the Sites. Failure to communicate or incorrect communication will make it impossible for the Joint Controllers to respond to any requests and/or provide the service.

9. Transfers
The Joint Controllers undertake to process and store the personal Data within the European Economic Area (EEA). Without prejudice to the above, in order to achieve the purposes referred to in paragraph 4, where a transfer is envisaged, the data will be transferred outside the EEA with the guarantees provided for in articles 44 et seq. of the GDPR, to parties that provide the Joint Controllers with services connected to the processing activities carried out (e.g. technology service providers, cloud hosting spaces, CRM, etc.). Such transfer will take place in compliance with the conditions provided for by the GDPR and will be governed, depending on the recipients, by recourse to the Standard Contractual Clauses (“SCC”) adopted by the European Commission, on the basis of an adequacy decision of the Commission or of any other instrument permitted by the relevant legislation, including adherence to the certification mechanism of the “EU-U.S. Data Privacy Framework” (“DPF”).
To obtain information about the guarantees relating to the transfer of data outside the EEA, data subjects may write to privacy@retelit.it.

10. Processing methods
The personal data will be subject to traditional manual, electronic and automated processing. It is specified that no fully automated decision-making processes are carried out.

11. Rights of the data subject.
During the period in which the Joint Controllers process your Data, you, as a data subject, may, at any time, exercise the rights provided for in articles 15 et seq. of the GDPR:

• Right of access (art. 15 GDPR): you have the right to obtain confirmation as to whether or not processing concerning your Data is taking place, and, where applicable, the right to receive all information relating to the processing;
• Right of rectification (art. 16 GDPR): you have the right to obtain the rectification of your Data, where it is incomplete or inaccurate;
• Right to erasure (right to be forgotten) (art. 17 GDPR): in certain circumstances, you have the right to obtain the erasure of your Data, where it is not relevant for the continuation of the contractual relationship and/or necessary to comply with a legal obligation to which the Joint Controllers are subject and/or for the establishment, exercise and/or defence of a right in court;
• Right to restriction of processing (art. 18 GDPR): you have the right to obtain the restriction of the processing concerning your Data, in the cases provided for by art. 18 of the GDPR;
• Right to portability (art. 20 GDPR): you have the right to receive the personal data concerning you, in a structured, commonly used and machine-readable format and to request its transmission to another controller, where technically feasible.
• Right to object to processing carried out for legitimate interest (art. 21 GDPR): you have the right to object, at any time, on grounds relating to your particular situation, to the processing of your Data, if based on the lawfulness condition of legitimate interest, unless there are legitimate grounds for the Joint Controllers to continue the processing which override the interests, rights and freedoms of the data subject, such as, for example, the establishment, exercise or defence of a right in court.
• Withdrawal of consent in relation to processing carried out for marketing and/or profiling purposes: data subjects are granted the right to withdraw the consent given where provided as a legal basis, without prejudice to the lawfulness of the processing based on the consent given before withdrawal.
• To stop receiving direct marketing communications, you can write an email to the address dpo@retelit.it or privacy@retelit.it, use our automatic cancellation systems provided for emails only (opt-out) or access the Customer area using, where available, the dedicated function.
• The data controllers communicate (art. 19 GDPR) to each of the recipients to whom the personal data has been transmitted any rectifications or erasures or restrictions of processing carried out. The data controllers communicate such recipients to data subjects who so request.
• Should you believe that the processing of personal data carried out by the Joint Controllers takes place in violation of the provisions of Regulation (EU) 2016/679, you may lodge a complaint with the national supervisory authority, in particular in the Member State in which you habitually reside or work, or in the place where the alleged violation of the Regulation occurred (Garante Privacy https://www.garanteprivacy.it ), or bring the matter before the appropriate judicial authorities.

12. Updates
This privacy notice refers to the methods of processing the Data of visitors while browsing and using the Sites of the Joint Controllers. The possible entry into force of new sector-specific regulations, as well as the constant review and updating of the Sites, could make it necessary to change these methods over time. We therefore invite you to consult this page periodically.

Date of update: 14/05/2026