Privacy Policy
Introduction
This notice is provided pursuant to Art. 13 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 (the “Personal Data Protection Code”), as amended by Legislative Decree 101/2018. It is addressed to anyone visiting the website www.working-metal.com (the “Site”) and to anyone contacting Working Metal through the “Contact us” form or by email.
The Controller uses the Site as a tool to provide information about its processes and as a contact channel. The processing of personal data is based on the principles of lawfulness, fairness, transparency, minimisation and confidentiality set out in Art. 5 of the GDPR.
Data Controller
The Data Controller is Eredi Bianchi Giuseppe S.p.A., which operates under the Working Metal brand through the division of the same name (the “Controller” or “Working Metal”).
- Registered office: Piazza Risorgimento, 7 – 20129 Milano
- Working Metal division office: Via G. da Cermenate, 51 – 22063 Cantù (CO)
- Tax Code and VAT No.: 01413990134 – REA Como 192896
- Phone: 031 7073801
- Email: info@working-metal.com
- Certified email (PEC): eredi.bianchi@pecmeb.it
Data processed
Browsing data. The IT systems used to operate the Site acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP address, browser type, operating system, domain name and referring URL, and time of the request. This data is used to ensure the proper functioning and security of the Site and may be used, in aggregate and anonymous form, for access statistics. It is not disclosed to third parties or disseminated, except where requested by judicial authorities for the purpose of ascertaining unlawful conduct.
Data provided through the “Contact us” form. By filling in the form, the user provides their name, company, email address, phone number and the content of the message, including any information about the project for which they are requesting support.
Data provided by email or phone. Spontaneously sending messages to the addresses shown on the Site entails the acquisition of the sender's address and any other data contained in the communication.
Special categories of data. The Controller does not request data belonging to the special categories referred to in Art. 9 of the GDPR (for example, data concerning health, political opinions or religious beliefs). Users are asked not to include such data in their messages: if present, it will be deleted, unless its processing is essential to handle the request.
Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Responding to requests for information, quotes, samples or project support | Pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR); for general enquiries, the Controller's legitimate interest in responding to those who contact it (Art. 6(1)(f)) |
| Managing any resulting business relationship (quotes, orders, supplies) | Performance of the contract (Art. 6(1)(b)) |
| Complying with legal obligations (tax, accounting, requests from authorities) | Legal obligation (Art. 6(1)(c)) |
| Ensuring the security and proper functioning of the Site | Legitimate interest of the Controller (Art. 6(1)(f)) |
| Establishing, exercising or defending a legal claim | Legitimate interest of the Controller (Art. 6(1)(f)) |
Data collected through the Site is not used for marketing activities, newsletters or profiling. Should the Controller intend to do so, it will ask the data subject for specific, separate and optional consent.
Nature of the data provided
Providing your email address and message (fields marked with *) is necessary to receive a reply: without them, the request cannot be processed. The other data (name, company, phone number) is optional and helps handle the request more quickly and effectively.
Processing methods and security
Data is processed using electronic tools and, where necessary, paper-based ones, by personnel of the Controller who are authorised and instructed in accordance with Art. 29 GDPR and Art. 2-quaterdecies of the Code. The Controller adopts appropriate technical and organisational measures (Art. 32 GDPR) to prevent loss, unlawful use or unauthorised access to data, including encrypted transmission of the form via the HTTPS protocol.
The user acknowledges that no data transmission over the Internet can be guaranteed to be completely secure. No automated decision-making processes, including profiling, are carried out (Art. 22 GDPR).
Data recipients
For the purposes indicated above only, data may be made accessible to:
- employees and staff of the Controller, acting as persons authorised to process data;
- suppliers who process data on behalf of the Controller, appointed as Data Processors under Art. 28 GDPR (Site hosting and management, email, IT support, consultants);
- companies of the EMA Holding group, when necessary to handle the request;
- public authorities and bodies, in the cases provided for by law.
Data is not disseminated. The up-to-date list of Data Processors is available on request by writing to info@working-metal.com.
Transfer of data outside the EU
Data is processed within the European Economic Area (EEA). Should any suppliers process data outside the EEA, the transfer will only take place subject to the safeguards set out in Articles 44 et seq. of the GDPR, such as an adequacy decision of the European Commission (for the United States, where applicable, the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses approved by the Commission.
Data retention periods
Data is kept for the time strictly necessary for the purposes for which it was collected; once the indicated periods have elapsed, it is deleted or anonymised.
| Data | Retention period |
|---|---|
| Contact requests not followed by a business relationship | The time necessary to handle the request and in any case no more than 24 months from the last contact |
| Data relating to quotes, orders and supplies | 10 years from the end of the relationship, for civil and tax law obligations (Art. 2220 of the Italian Civil Code) |
| Browsing data (technical logs) | No more than 12 months, unless needed to establish unlawful conduct |
These periods may be extended if necessary to establish, exercise or defend a legal claim.
Rights of the data subject
The data subject may exercise, at any time, the rights set out in Articles 15–22 of the GDPR:
- access to their personal data and to information about its processing;
- rectification of inaccurate or incomplete data;
- erasure of data, in the cases provided for;
- restriction of processing;
- portability of the data provided, in a structured, machine-readable format;
- objection to processing based on the Controller's legitimate interest;
- withdrawal of any consent given, without prejudice to the lawfulness of processing carried out before the withdrawal.
Requests should be sent to info@working-metal.com or via certified email (PEC) to eredi.bianchi@pecmeb.it. The Controller replies within one month, a period that may be extended by two months in more complex cases (Art. 12 GDPR).
If the data subject believes that the processing infringes the GDPR, they may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it (opens in a new tab)) or with the supervisory authority of the EU Member State where they reside or work.
Cookies
The Site uses only technical cookies necessary for its operation, for which user consent is not required.
Changes to this notice
The Controller may update this notice, for example due to regulatory changes or the introduction of new services on the Site. The current version is always published on this page.
Last updated: 19 October 2026