Introduction
Welcome to pelthe.com (the “Website”). We are committed to protecting the personal data of our
community and ensuring that all personal information is handled with the utmost care and
transparency. This privacy notice informs you about how we process your personal data in
accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data (the "GDPR") and applicable Italian data protection law.

By interacting with our Website, you acknowledge that you have read and understood this privacy
notice.

1. Data Controller
The Data Controller is the natural or legal person, public authority, agency or other body which, alone
or jointly with others, determines the purposes and means of the processing of personal data.
Pursuant to Article 13(1)(a) GDPR, the Data Controller for the activities described in this notice is:
Pelthe Capital Partners S.p.A., with registered office at Via Chiaravalle 7, 20122 Milan (MI), Italy, VAT
No. 147723109681; Email: info@pelthe.com (the “Company” or the “Data Controller”). 

For any queries relating to this privacy notice or to the exercise of your rights, you may contact the
Data Controller at the above address or email.

2. Categories of Personal Data Collected Navigation Data
The IT systems and software procedures used to operate the Website acquire, during their normal
operation, certain personal data whose transmission is implicit in the use of internet communication
protocols.
This information is not collected to be associated with identified data subjects however, by its very
nature, could allow users to be identified through processing and association with data held by third
parties.
This category of data includes, among others: IP addresses, the type of browser used, the operating
system, the domain name and addresses of the websites from or to which access is made,
information on the pages visited within the Website, the time of access, the duration of the visit, and
other parameters relating to the user’s operating system and IT environment.
Data Voluntarily Provided by Users
When you contact the Company through the contact details published on the Website, the Company
may collect the personal data that you voluntarily provide in your communication. Such personal data
may include, by way of example: name, surname, email address, telephone number, and any other
information contained in your message.
The provision of such data is optional. However, failure to provide certain data may make it
impossible for the Company to respond to your inquiry.

3. Purposes and Legal Basis of Processing

Your personal data will be processed for the following purposes:

 

a) Website operation and security. Navigation data is processed for the purpose of ensuring
the correct functioning of the Website and managing its security (e.g., detecting anomalies
and preventing unauthorised access). Legal basis: legitimate interest of the Data Controller in
ensuring the proper operation and security of the Website (Article 6(1)(f) GDPR).

b) Responding to inquiries. Personal data voluntarily provided by you when contacting the
Company will be processed for the purpose of responding to your requests and managing the
resulting communication. Legal basis: performance of pre-contractual and contractual

measures taken at your request (Article 6(1)(b) GDPR); or legitimate interest of the Data
Controller (Article 6(1)(f) GDPR).

c) Compliance with legal obligations. Your personal data may be processed to comply with
obligations imposed by applicable laws, regulations, or EU legislation, or to comply with
orders issued by competent authorities. Legal basis: compliance with a legal obligation to
which the Data Controller is subject (Article 6(1)(c) GDPR).

d) Establishment, exercise, or defence of legal claims. Your personal data may be
processed where necessary to establish, exercise, or defend the Company’s rights in judicial,
administrative, or out-of-court proceedings. Legal basis: legitimate interest of the Data
Controller (Article 6(1)(f) GDPR).

4. Personal data recipients and personal data sharing
Your personal data may be disclosed to the following categories of recipients:

i. persons authorised to process personal data within the Company’s organisation, who have
committed to confidentiality or are subject to an appropriate statutory obligation of
confidentiality (e.g., employees and collaborators);

ii. third-party service providers that process data on behalf of the Company as data processors
pursuant to Article 28 GDPR (e.g., IT service providers, website hosting and maintenance
providers);

iii. public authorities and bodies, where required by applicable law or by order of a competent
authority;

iv. professional advisors (e.g., lawyers, auditors, consultants), to the extent necessary for the
provision of their professional services.

An updated list of data processors may be obtained by contacting the Data Controller at the address
indicated in Section 1 above.

The Company does not transfer your personal data outside the European Economic Area.

 

Where required by law, regulation, or binding court order, we may disclose your personal data to
competent public authorities or law enforcement bodies. In such cases, we disclose only the minimum
data necessary to comply with the legal obligation.

5. Data Retention

Personal data shall be kept in a form which permits identification of data subjects for no longer than is
necessary for the purposes for which the personal data are processed. We retain your personal data
only for as long as is strictly necessary to fulfil the purposes for which it was collected, in accordance
with the following criteria:

Data processed to comply with legal obligations: For the period required by applicable law (e.g., 10 years for accounting and tax records under Italian law — Article 2220 of the Italian Civil Code).

​

Contact data (data voluntarily provided via inquiries): No longer than 12 months from the date of your most recent communication. Should the inquiry lead to the establishment of a contractual relationship,
personal data will be retained for the period necessary to perform and manage such relationship and to comply with the applicable legal obligations (as per the above section).

​

Navigation data (IP address, technical logs): No longer than 12 months from collection, save where a longer period is strictly necessary for IT security purposes and duly documented.

​

At the end of the applicable retention period, your personal data will be securely deleted or irreversibly
anonymised. You may request early deletion at any time by exercising your rights as described in

Section 6 below.

​

6. Your Rights
Pursuant to Articles 15 to 22 GDPR, and subject to the conditions and limitations set out therein, you
have the following rights in relation to your personal data:
• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether or
not personal data concerning you is being processed, and where that is the case, to access
the data and receive detailed information about the processing (purposes, categories of data,
recipients, retention period, etc.).
• Right to Rectification (Art. 16 GDPR): You have the right to obtain the rectification of
inaccurate personal data concerning you and to have incomplete personal data completed,
without undue delay.
• Right to Erasure / "Right to be Forgotten"(Art. 17 GDPR): You have the right to obtain the
erasure of your personal data where one of the grounds listed in Article 17 GDPR applies
(e.g., the data is no longer necessary for the purposes for which it was collected, or you
withdraw your consent and there is no other legal basis for the processing).
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to obtain the
restriction of processing in certain circumstances (e.g., where you contest the accuracy of the
data, or where you have objected to processing pending verification of the legitimate grounds
of the controller).
• Right to Data Portability (Art. 20 GDPR): Where processing is based on your consent or on
a contract, and is carried out by automated means, you have the right to receive your
personal data in a structured, commonly used, and machine-readable format, and to transmit
it to another controller without hindrance.
• Right to Object (Art. 21 GDPR): You have the right to object, on grounds relating to your
particular situation, to processing based on legitimate interest (Art. 6(1)(f) GDPR). Where
processing is for direct marketing purposes, you have an unconditional right to object at any
time, without the need to provide specific reasons, whereupon we will cease processing your
data for that purpose.
• Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent,
you have the right to withdraw your consent at any time. The withdrawal of consent shall not
affect the lawfulness of processing based on consent before its withdrawal. Withdrawal of
consent can be affected at any time by clicking the "unsubscribe" or "manage preferences"
link in any of our communications, or by contacting us at info@pelthe.com. Withdrawal of
consent is entirely free of charge and carries no adverse consequence.
• Right to Lodge a Complaint (Art. 77 GDPR): Without prejudice to any other administrative
or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in
particular in the Member State of your habitual residence, place of work or place of the
alleged infringement if you consider that the processing of personal data relating to you
infringes the GDPR. In Italy, the competent supervisory authority is:

Garante per la Protezione dei Dati Personali Piazza Venezia 11, 00187 Roma — Italy Tel.: +39 06
696771 Fax: +39 06 69677 3785 Email: garante@gpdp.it Certified email (PEC):
protocollo@pec.gpdp.it Website: www.gpdp.it

How to exercise your rights: To exercise any of the above rights, please contact us at
info@pelthe.com or in writing at the address indicated in Section 1, providing sufficient information to
identify yourself and the right you wish to exercise. We will respond to your request without undue
delay and in any event within one month of receipt of the request. That period may be extended by
two further months where necessary, taking into account the complexity and number of the requests;
in that case, we will inform you of any such extension within one month of receipt of the request,
together with the reasons for the delay. This service is provided free of charge, unless your requests
are manifestly unfounded or excessive.

7. Cookies And Tracking Technologies
Our digital platforms may use cookies and similar tracking technologies to analyse your browsing
behaviour and personalise your experience. Certain cookies require your prior consent; others are
strictly necessary for the functioning of our platforms and do not require consent. For detailed

information on the types of cookies we use, their purposes, the retention periods applicable, and your
choices in relation to them (including how to withdraw your consent), please refer to our Cookie
Policy, available on our website.

8. Changes To This Privacy Notice
The up-to-date version of this privacy notice is published from time to time on www.pelthe.com. The
date of the most recent update is indicated at the bottom of this document. Users are encouraged to
consult the website periodically to review the version currently in force.

Latest update: July 2026.