Notice provided pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”), Art. 13 of Italian Legislative Decree 196/2003 (“Privacy Code”), and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante) on 10 June 2021, No. 231 (in force since 10 January 2022)
Last updated: 29 July 2026
Introduction
For ELFO S.r.l. con socio unico (“ELFO”, “the Company”), personal data is a valuable asset to be protected. Transparency towards data subjects is a primary objective: this notice describes how personal data is processed for visitors of the website ariannadocs.it (“Site”) and for users of the ARIANNA platform, in compliance with Regulation (EU) 2016/679, Legislative Decree 196/2003, and the Garante’s cookie guidelines of 10 June 2021.
Data Controller and Contacts
| Data Controller | ELFO S.r.l. con socio unico |
| Registered office | Via Pastore, 3/5 – 29017 Fiorenzuola d’Arda (PC), Italy |
| Phone | +39 0523 985811 |
| Data Protection Officer (DPO) | Luca Salini – Tel. 0523.713250 – Email: dpo@ecoreholding.it |
Data subjects may contact the DPO to exercise the rights set out in Arts. 15-21 GDPR (access, rectification, erasure, restriction, portability, objection) and to withdraw a previously given consent. In the absence of a response, the data subject may lodge a complaint with the Garante for the protection of personal data (www.garanteprivacy.it).
1. Processing of data related to browsing the Site
1.1 Browsing data
The computer systems used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (IP addresses, domain names, URIs of requested resources, request time, method used, response size, server status code, and other parameters relating to the user’s operating environment).
Purpose and legal basis: anonymous statistics on Site usage, monitoring of correct functioning, and establishing liability in the event of computer crimes against the Site (Controller’s legitimate interest, Art. 6(1)(f) GDPR).
Recipients: authorised internal personnel (Art. 29 GDPR) and any external providers appointed as data processors (Art. 28 GDPR) for platform maintenance. No disclosure to third parties except upon request by judicial authorities.
Retention: for the time necessary for the above purposes, normally not exceeding 12 months, save for extensions connected to ongoing investigations.
Provision: not required from the data subject, automatically acquired by technological systems.
1.2 Cookies and other tracking tools
The Site uses cookies and similar technologies according to the categories described below, in compliance with the Garante’s Guidelines of 10 June 2021, No. 231.
What cookies are. Small text files that the browser stores on the user’s device and returns to the Site on each subsequent visit, to recognise the device and personalise the experience.
Consent management. On first access, a banner managed via the Iubenda platform is shown, allowing the user to accept, reject (with an action of equal simplicity to acceptance) or customise preferences, before any non-technical cookies are installed. Consent may be changed or withdrawn at any time by opening the “Manage cookie preferences” panel, accessible via the dedicated button present on every page of the Site, or directly through browser settings.
a) Technical (strictly necessary) cookies
Do not require consent (Art. 122(1) Privacy Code). They ensure the operation of the Site: session management, storage of consent preferences, security, and fraud prevention.
| Purpose | First/third party | Duration |
| User session management | First party | Session |
| Storage of cookie preferences | First party | 2 months |
b) Analytics cookies
Used, subject to consent, to measure traffic and understand user behaviour in aggregate form, in order to improve the Site and the platform.
The Site uses Google Analytics 4 (GA4): data is processed by Google Ireland Ltd. and may involve a transfer of data to the United States by Google LLC, which adheres to the EU-US Data Privacy Framework (European Commission adequacy decision 2023/1795 of 10 July 2023), currently the applicable legal basis for such transfer. For further information: Google’s privacy policy and Google Analytics opt-out page.
| Service | Purpose | Duration | Extra-EU transfer |
| Google Analytics 4 (GA4) | Aggregate usage statistics | 2 months | USA – EU-US Data Privacy Framework |
c) Functionality cookies
Improve the user experience by remembering user preferences (language, layout, answers already given to surveys) and enabling optional features (e.g. video, forms).
d) Third-party / social cookies
When the user interacts with social content embedded in the Site, third-party cookies not controlled by ELFO may be installed:
| Service | Service provider | Place of processing |
| Meta (Facebook) widget/buttons | Meta Platforms, Inc. | USA – Meta’s privacy policy |
| X (formerly Twitter) widget | X Corp. | USA – X’s privacy policy |
| YouTube (embedded videos) | Google LLC | USA – Google’s privacy policy |
For these services, the transfer of data to the USA is based, where applicable, on the EU-US Data Privacy Framework or, absent the provider’s adherence to it, on Standard Contractual Clauses (Art. 46 GDPR).
e) Marketing / advertising targeting cookies
The Site uses, subject to consent, a Google Ads (Conversion Linker) tool, which links clicks on online advertisements to conversions completed on the Site. Data is processed by Google Ireland Ltd. and may involve a transfer of data to the United States by Google LLC, which adheres to the EU-US Data Privacy Framework (adequacy decision 2023/1795 of 10 July 2023).
| Service | Purpose | Duration | Extra-EU transfer |
| Google Ads – Conversion Linker | Linking ad clicks to conversions on the Site | up to 90 days | USA – EU-US Data Privacy Framework |
The Site does not currently use third-party behavioural profiling or retargeting advertising cookies other than as indicated above.
1.3 How to manage cookies from the browser
In addition to the Site’s preference management panel, users can act directly through their browser: Chrome, Firefox, Safari, Edge. Disabling technical cookies may impair the operation of the Site.
1.4 Information requests, contact, and material downloads
The Site allows users to request information via a contact form, as well as to download documents and informational materials after providing their email address. Purpose: responding to received requests and sending the requested material, based on the data subject’s consent (Art. 6(1)(a) GDPR). Where a further, separate consent is required for subsequent promotional or commercial communications, such consent will be collected separately when the form is filled in. Retention: for the time necessary to handle the request or provide the material, unless consent is given for further retention for marketing purposes. Provision: necessary to receive a response or to access the download.
2. Processing of data related to client and supplier relationships (including use of the ARIANNA platform)
2.1 Purpose of processing
ELFO processes identification data of clients, suppliers, and their operational contacts (name, company name, tax data, address, contact details, payment references) in connection with the provision of its services, including the ARIANNA platform — a Vendor Document Management solution for the Oil & Gas sector. Where ELFO acts as a data processor on behalf of clients who use ARIANNA to manage their own suppliers’ data, the terms of such processing are governed by a dedicated Data Processing Agreement (DPA) pursuant to Art. 28 GDPR, separate from this notice.
2.2 Purpose and legal basis
- Conclusion and performance of contractual relationships (Art. 6(1)(b) GDPR);
- fulfilment of pre-contractual, contractual, tax and legal obligations (Art. 6(1)(b), (c) GDPR);
- Controller’s legitimate interest, including legal defence and operational/accounting management (Art. 6(1)(f) GDPR).
Failure to provide the data makes it impossible to establish the relationship. Additional consent will be requested for any further purposes.
2.3 Methods and scope of processing
Processing is carried out using paper-based and electronic tools, in compliance with the principles set out in Art. 5 GDPR and with the security measures required by Art. 32 GDPR. Data is processed by authorised internal personnel and, where necessary, by external parties appointed as data processors (IT providers, hosting providers, consultants). The list of external processors is available upon request to the DPO.
2.4 Extra-EU transfers
Where, in the course of providing its services, certain data is processed by providers based in or operating infrastructure in the United States, the transfer is based on the EU-US Data Privacy Framework (adequacy decision 2023/1795), where the provider adheres to it, or on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR).
3. Policy updates
This notice may be subject to periodic review in light of regulatory or case-law developments. Any significant changes will be announced on the Site’s home page. Users are advised to review this page periodically.