Privacy notice

1. Introduction and scope

This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.

It applies to the processing of personal data of users who visit the website https://www.bunder.it (the "Site"), operated by Bunder Company SRL.

The Site is intended to provide information about the company and the products and services offered, is available in Italian and English (user choice via navigation or the language switcher), and allows users to submit contact requests through a dedicated form.

Third-party websites and services reachable via external links are excluded and are subject to the privacy notices of their respective controllers.

2. Data controller

The data controller is Bunder Company SRL, Viale F. De Blasio sn 70132 Bari BA, P.IVA 07734810729.

To exercise the rights provided under the GDPR, for any request relating to data protection, and for commercial or general enquiries: info@bunder.it · +39 0809644693.

As of the date of the last update of this notice, a Data Protection Officer (DPO) has not been appointed, as the mandatory conditions under Article 37 GDPR do not apply.

3. Categories of data processed

In connection with the Site, the following categories of data may be processed.

3.1 Data provided via the contact form

The contact form may collect:

• first and last name;
• company name;
• address;
• VAT number;
• telephone number;
• email address;
• categories of products or services of interest;
• message text.

Users are asked not to enter personal data that are not necessary to handle the request.

3.2 Browsing data and technical logs

The systems that deliver the Site may record technical data relating to requests, including IP address, date and time, requested URI, browser user agent, connection data, and security events.

Such data are used to provide the service, ensure security, prevent abuse, and carry out maintenance activities.

3.3 Cookie and similar-tool preferences

The Site uses an integrated cookie banner and preference panel to manage choices relating to non-essential tools.

Cookie preferences are stored on a first-party basis (browser local storage) as described in the Cookie Policy.

Browser sessionStorage may also be used (key bunder-locale-suggest-dismissed) so that the suggestion to switch to the other Site language is not repeated in the same browsing session; this does not involve cross-site tracking or profiling.

3.4 Map on the Contact page

The Contact page may display an interactive Google Maps map showing the location of the registered office.

Until consent is given for functional cookies, only an informational placeholder is shown on the Site; an external link is always available to open the same location on Google Maps without an embed.

When the embed is active, Google may process technical data (for example IP address, device data, and interactions with the map) in accordance with its own privacy notice.

3.5 Browsing and analytics data (Google Analytics)

Subject to the user's consent to the statistics cookie category, the Site may use Google Analytics 4 to collect aggregated information about browsing (pages visited, approximate duration, traffic source, device and browser type).

Data are processed by Google Ireland Limited as the analytics service provider, acting as processor or independent controller depending on contractual arrangements and settings adopted.

The Site configuration includes IP anonymisation and deactivation of Google Analytics advertising signals; remarketing is not enabled.

4. How data are collected

Data are collected:

• directly from the data subject, via the contact form;
• automatically, during browsing, through the Site's IT and network systems and infrastructure providers;
• through the tools used to record cookie preferences;
• with consent, via Google Analytics 4 for aggregated statistical purposes.

The Site does not provide user registration, an integrated restricted area, e-commerce, or newsletter sign-up through public forms.

5. Purposes and legal bases

Personal data are processed for specified, explicit, and legitimate purposes.

5.1 Handling contact requests

Form data are processed to:

• receive and handle the request;
• provide information on products and services;
• carry out pre-contractual measures at the data subject's request;
• manage subsequent communications linked to the request.

Legal basis: performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR), where the request is aimed at information or a possible commercial relationship.

Submitting the form is subject to acceptance of this notice via a dedicated declaration on the contact form.

5.2 Security and operation of the Site

Technical data may be processed to:

• ensure the Site functions correctly;
• protect infrastructure from abuse and attacks;
• apply traffic limits and anti-spam measures on the form;
• diagnostics, maintenance, and exercise or defence of a legal claim.

Legal basis: legitimate interest of the controller (Article 6(1)(f) GDPR), to the extent that the data subject's rights do not override such interest.

5.3 Compliance with legal obligations

Data may be processed to comply with obligations under law or requests from competent authorities.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

5.4 Cookie preferences

Non-essential tools are activated only with prior consent, where required by applicable law.

Consent may be changed or withdrawn via "Cookie preferences" in the Site footer.

5.5 Map display (Contact page)

At the user's request, and with prior consent to functional cookies, the Contact page may load a Google Maps embed to show the registered office location.

Legal basis: consent of the data subject (Article 6(1)(a) GDPR), revocable via cookie preferences.

Without consent, no processing connected to the embed takes place; the external link to Google Maps remains available.

5.6 Browsing statistics (Google Analytics 4)

With cookie consent, Google Analytics 4 processes Site usage data to understand in aggregate form which content is viewed and to improve the informational experience.

Legal basis: consent of the data subject (Article 6(1)(a) GDPR), revocable at any time via cookie preferences.

Without consent, Google analytics cookies or storage are not activated on the user's device.

6. Cookies and similar technologies

For detailed information on cookies, retention periods, and providers, please see the Cookie Policy at /en/cookie-policy/

Google Analytics 4 is integrated with Google Consent Mode and is activated only with consent to the statistics category. Google Tag Manager is not used as a separate container; remarketing and advertising profiling are not used.

Google Maps is used solely as an optional embed on the Contact page, subject to functional cookie consent.

Fonts are loaded through the Site framework without social network widgets that automatically transmit data during browsing.

7. Infrastructure and providers

The Site is published as a static website (HTML, CSS, and JavaScript files) on web hosting infrastructure.

Requests submitted via the contact form are sent to an API hosted on Cloudflare Workers, which applies security checks and rate limiting before forwarding.

Notification email for requests is sent via Resend Inc., the transactional email provider on the server side.

Google Ireland Limited provides Google Maps (Contact embed) and, with consent, Google Analytics 4.

Cloudflare, Inc. may act as a content delivery, security, and API hosting network depending on active features.

Providers process data within the limits of the controller's instructions and applicable contractual agreements, including appointment as processor under Article 28 GDPR where required.

8. Recipients and disclosure of data

Data are not disseminated. They may be accessed by authorised personnel of the controller and by technical providers (hosting, Cloudflare, Resend, Google for Maps and Analytics) to the extent necessary for their respective services.

Data may also be disclosed to public authorities where required by law.

An up-to-date list of processors may be requested at info@bunder.it.

9. Transfers to third countries

Some providers (in particular Cloudflare, Resend, and Google) may process data outside the European Economic Area.

Such transfers are carried out in compliance with Articles 44 et seq. GDPR, through adequacy decisions, standard contractual clauses, or other safeguards provided by applicable law, in accordance with contracts in force with providers.

10. Retention period

Contact request data are retained for as long as necessary to handle the request and related communications, and thereafter for the period required by civil, accounting, or tax obligations or to protect the controller's rights in legal proceedings.

Technical logs are retained for limited periods proportionate to security and maintenance purposes.

Browsing data collected via Google Analytics 4, with consent, are retained according to periods configured in the Google Analytics platform (typically up to 14 months for events, unless different settings are adopted by the controller).

Cookie preferences may be stored for up to 12 months, unless withdrawn or deleted earlier.

11. Whether provision is mandatory

Providing data marked as mandatory on the form is required to submit a request; failure to provide them prevents submission.

Consent to non-essential cookie tools is optional; refusal does not prevent viewing parts of the Site that do not require such tools.

12. Automated decision-making

No automated decision-making, including profiling, is carried out that produces legal effects or similarly significantly affects the data subject.

13. Rights of the data subject

The data subject may exercise the rights under Articles 15–22 GDPR (access, rectification, erasure, restriction, objection, portability, withdrawal of consent).

Requests: info@bunder.it.

A complaint may be lodged with the Italian Data Protection Authority (https://www.garanteprivacy.it).

14. Changes

The controller may update this notice for regulatory, technical, or organisational changes.

Last updated: 22 September 2026.