Privacy Policy – M. Brugnara GmbH

Version: October 2026

1. Data Controller

The controller responsible for the processing of personal data collected through this website within the meaning of Art. 4(7) GDPR is:

M. Brugnara GmbH
Via Roma 31/A 39012 Merano (BZ) Italy
E-mail: info@brugnara.bz.it
Telephone:: +39 0473 232755

2. Categories of personal data processed

When you access this website and use the contact channels provided, the following categories of personal data may be processed in particular:

Technical usage and access data (server log files): IP address, date and time of access, requested file, amount of data transferred, browser type and version, operating system and referrer URL.
Contact data: first and last name, e-mail address, telephone number, if provided, and the content of your message.

3. Purposes and legal bases of processing

Personal data is processed for the following purposes and on the following legal bases:

Handling enquiries and communication: The data you submit via the contact form or by e-mail is processed in order to handle and respond to your enquiry. Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to pre-contractual or contractual matters, or Art. 6(1)(f) GDPR based on our legitimate interest in ensuring proper communication.
Technical operation, provision and IT security of the website: Technical data is processed to ensure the stability, security and proper functioning of the website and to prevent misuse and cyberattacks. Legal basis: Art. 6(1)(f) GDPR.
Integration of external services (Google Maps): An interactive map is loaded only if you have given your prior express consent. Legal basis: Art. 6(1)(a) GDPR.
Compliance with legal obligations: Personal data may be processed where necessary to comply with legal retention, documentation or cooperation obligations. Legal basis: Art. 6(1)(c) GDPR.

4. Contact form and data minimisation

Use of the contact form is voluntary. Mandatory fields are marked accordingly because, without the minimum required information, it may not be possible to process your request. Data submitted is not used for advertising purposes and is not used for automated profiling.

5. Recipients of personal data

Personal data is disclosed only where necessary, in particular:

to handle your enquiry or carry out pre-contractual or contractual measures;
to comply with legal obligations;
to establish, exercise or defend legal claims;
to external technical service providers acting as processors pursuant to Art. 28 GDPR, in particular: Vercel Inc. (hosting and delivery of the website), Convex, Inc. (database and storage of content and images) and Microsoft Ireland Operations Limited (Microsoft 365: sending and storing messages submitted via the contact form).

Personal data is not sold for marketing purposes.

6. Transfers of data to third countries

Personal data may be transferred to countries outside the European Union or the European Economic Area in the following cases:

Our providers Vercel Inc., Convex, Inc. and Microsoft (see section 5) are based in the United States or belong to US groups, so access to data from the United States cannot be ruled out. Transfers rely on the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR) or standard contractual clauses under Art. 46 GDPR. If you activate Google Maps, data may additionally be transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to Google LLC in the United States on the same basis.

Without your prior activation of the map, no transfer to Google will take place.

7. Retention period

Personal data is stored only for as long as necessary for the purposes for which it is processed.

contact enquiries: for the time required to handle the enquiry and, where applicable, beyond that period where required for retention obligations or the defence of legal claims;
server log files: generally for a limited period, insofar as necessary to ensure security and service continuity;
cookie-related information: in accordance with the retention periods set out in the Cookie Policy.

8. Rights of data subjects

Under Arts. 15 to 22 GDPR, you have the following rights in particular:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to data portability;
right to object to processing based on Art. 6(1)(f) GDPR;
right to withdraw consent at any time with effect for the future.

To exercise your rights, you may contact: info@brugnara.bz.it

9. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes the GDPR or applicable Italian data protection law, you have the right to lodge a complaint with a supervisory authority.

The competent authority in Italy is: Garante per la protezione dei dati personali Piazza Venezia 11 00187 Rome Italy. Website: https://www.garanteprivacy.it/

10. Changes and updates to this Privacy Policy

We reserve the right to amend or update this Privacy Policy at any time where this becomes necessary as a result of changes to the website, the technical systems used, the data processing operations or legal and regulatory requirements.

The version of the Privacy Policy published on this website from time to time shall prevail.