Privacy Policy

Pursuant to art. 13 of EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

Controller: SPAPPERI NT S.r.l.

Site: www.spapperi.com

Last updated: 22 September 2026

Language note: This Privacy Policy is available in Italian (official version), English, French, German, Spanish, Portuguese and Chinese. In case of discrepancy, the Italian version shall prevail.

This Privacy Policy is provided pursuant to art. 13 of EU Regulation no. 2016/679 and applies exclusively to all Data collected through the Website www.spapperi.com.

This Privacy Policy is subject to updates, which will be promptly published on the Website. This Privacy Policy and the Cookie Policy, set out the basis on which the Personal Data of the Data Subject will be processed.

1. Data Controller

The Controller of the Data collected by this Website is SPAPPERI NT S.r.l., with registered office at Via Pietro Ercolani, 5 b 06012 Città di Castello PG, ITALY, VAT number 03467460543, email: info@spapperi.com.

2. Personal Data

Personal Data means any information relating to an identified or identifiable natural person (Data Subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to his or her physical identity.

3. Categories of Personal Data processed

3.1 Browsing data

The computer systems operating this Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes: IP addresses, browser type, operating system, domain name and addresses of sites from which access was made, pages visited, access time, time spent on individual pages and other parameters related to the user's computing environment.

Such data are used to ensure the operation and security of the Site, for example to limit abusive form submissions (in which case the IP address is retained for no longer than one hour), and may be used to ascertain liability in the event of hypothetical computer crimes against the Site.

3.2 Data voluntarily provided by the user

a) Contact form and information requests

First name, last name, e-mail, phone, country, message. If the user selects "Company": company name (mandatory), activity type and sector (optional).

b) Newsletter subscription

First name, last name, e-mail, phone, occupation (optional), language preference. Subscription is subject to e-mail confirmation (double opt-in).

c) Job applications ("Work with us")

First name, last name, e-mail, phone (optional), curriculum vitae (mandatory), other attachments (optional), message (optional), position of interest. Attached files may contain special categories of data pursuant to art. 9 GDPR (e.g. health status): you are invited not to include such information unless strictly necessary.

d) Video call requests

First name, last name, e-mail, phone, country, service of interest, preferred date and time, message. If the user selects "Company": company name (optional).

e) Customer reserved area

E-mail, company name, customer code, contact name (optional), phone (optional), job title. Access is permitted exclusively to customers authorised by the Controller.

f) Technical assistance requests

First name, last name, company (optional, only collected when the user selects "Company"), e-mail, phone (optional), country (optional), machine serial number (optional), message, photographic attachments (optional, formats HEIC/JPG/PNG/WebP/BMP, max 5 files of 15 MB each).

g) Transplanter requirements form (quote request)

Customer/company, e-mail, mobile number, contact person's name (optional) and the technical answers provided in the form (crop type, plant dimensions, planting layout, transplanting type, soil type, tractor specifications, accessories and notes).

3.3 Data collected via cookies and tracking technologies

The Site uses technical cookies and tools necessary for its operation and necessary third-party services (Cloudflare Turnstile anti-abuse verification, OpenFreeMap map on the Contact page). YouTube videos are loaded only if the user starts playback. The Site is set up for Google Analytics 4, currently not active, which would be activated only subject to your consent; no marketing cookies are used. For more information please refer to the Cookie Policy available on the Site.

3.4 Data processed through the AI virtual assistant

The Site provides an artificial-intelligence virtual assistant, named "Gaia", to give information about products, services and contacts. Interacting with the assistant involves processing the data the user freely enters in the chat: the text of the messages, the language, a technical session identifier and certain technical metadata (date and time, tools used).

To generate replies, messages are processed through OpenAI, L.L.C. (United States) acting as data processor. Users are asked not to enter personal, confidential or special-category data in the chat.

4. Methods of Processing Personal Data

The Personal Data provided or acquired will be processed in accordance with the principles of fairness, lawfulness, transparency and protection of confidentiality pursuant to the regulations in force. The Controller processes the Personal Data of Users by adopting appropriate security measures aimed at preventing unauthorised access, disclosure, modification or destruction of Personal Data. Processing is carried out by means of computer and/or telematic tools, with organisational methods and logic strictly related to the purposes indicated.

5. Purposes of the Processing of Personal Data and Legal basis

Personal Data may be collected independently by the Controller or through third parties. In this case, the computer systems and software procedures operating this Website acquire certain Personal Data of Users of a technical-IT nature (e.g. the IP address, the type of browser used, the operating system, the domain name and the addresses of websites from which access or exit took place, etc.), the transmission of which is inherent to the normal functioning of the internet. Such Data may be processed for the sole purpose of obtaining anonymous statistical information on the use of the site and/or to check its correct functioning and will be deleted immediately after processing.

The Data that the Data Subject chooses to provide voluntarily will be processed in compliance with the conditions of lawfulness under art. 6 GDPR and will be processed to enable the Website to provide its services, as well as for the Purposes indicated below, and will be retained for the time necessary to fulfil the aforementioned Purposes.

The Purposes of the processing are:

a) Information and pre-contractual obligations

The Data will be processed in order to be contacted again or to follow up on specific requests addressed to the Controller by the Data Subject for informational communications and/or in relation to an interest in purchasing the Services and Products of the Controller, by means of e-mail messages or by completing the Contact Form and other communication tools such as, for example, the telephone.

Legal basis: this processing is optional and based on the consent of the Data Subject; however, providing the Data is necessary to pursue the indicated purpose.

Data retention period: until the Data Subject withdraws consent.

b) Fulfilment of any obligations provided for by applicable laws

The Data will be processed to fulfil any type of obligation contemplated and provided for by applicable laws, regulations, related legislation, commercial practices and tax/fiscal matters, including for the purposes provided for by the anti-money laundering legislation, Legislative Decree 231/2007 as amended.

Legal basis: this processing is necessary to comply with a legal obligation to which the Controller is subject.

Data retention period: 10 (ten) years or as otherwise required by law.

c) Direct marketing

The Data will be processed for the direct sale of Products/Services, the sending of communications and promotional, commercial and advertising material or material relating to initiatives and events, by automated means (e-mail, social network messages, whatsapp, messenger, online instant messaging applications, phone with operator).

Legal basis: this processing is based on the consent freely given by the Data Subject pursuant to art. 6(1)(a) of the GDPR.

Data retention period: until the Data Subject withdraws consent.

d) Personnel selection

The Data will be processed in order to be contacted again or to follow up on specific unsolicited applications and/or applications for a specific job position addressed to the Controller by the Data Subject

Legal basis: this processing is optional and based on the consent of the Data Subject; however, providing the Data is necessary to pursue the indicated purpose.

Data retention period: until the Data Subject withdraws consent.

e) Reserved Area

The data will be processed to allow the management of the account and access to the Reserved Area, the provision of the related services, security and technical maintenance.

Legal basis: performance of a contract or of pre-contractual measures to which the user is a party (Art. 6(1)(b) of the GDPR).

Data retention period: The personal data collected for the management of your account will be retained for the entire duration of your registration to the Reserved Area and, in any case, until you request the deletion or deactivation of your profile.

In the event of prolonged inactivity of the user for a period exceeding 24 months, the account and the data associated with it will be automatically deleted or irreversibly anonymised.

6. Communication of Data

In addition to the Controller, in some cases the following may have access to the Data:

a) categories of persons in charge of processing, specifically trained for this purpose, involved in the organisation of the Website (administrative, sales and marketing staff, legal staff, system administrators);

b) external parties (such as third-party technical service providers, hosting providers, IT companies, communication agencies) also appointed as Data Processors by the Controller pursuant to art. 28 GDPR. The updated list of Data Processors, if appointed, may always be requested from the Controller;

c) public or private entities that may access the Data in compliance with legal obligations;

d) persons authorised by the Controller;

7. Duration of Processing

As expressly provided for by art. 5(1)(e) of the GDPR, the Data are retained for the time necessary for their Processing in relation to the performance of the service requested by the Data Subject, or required by the Purposes described above in this document.

Upon expiry of the retention period, the Personal Data will be deleted and, therefore, the rights of access, erasure, rectification and portability of the Data may no longer be exercised

8. Place of Processing and transfer of Data abroad

The Data are processed at the Controller's operational headquarters. For further information, the Controller may be contacted. The Data may be processed by natural persons and/or legal entities acting on behalf of the Controller under specific contractual obligations and established in EU or non-EU Member States. Where the Data are transferred outside the EEA, the transfer takes place in compliance with the safeguards provided for by artt. 44 et seq. of the GDPR.

For processing operations that do not require extra-EEA transfers (contacts, job applications, video calls, customer area), data are processed exclusively within the territory of the European Union.

9. Exercise of the data subject's rights

The Data Subject has the right to exercise the rights provided for by artt. 15-22 of EU Regulation 2016/679. In particular, the Data Subject has the right to withdraw consent at any time and, upon simple request to the Controller, may request access to the Personal Data, receive the Personal Data provided to the Controller and, where possible, transmit them to another controller without hindrance (so-called portability), obtain the updating, restriction of processing, rectification of the Data and erasure of Data processed in breach of the applicable legislation. The Data Subject has the right, on legitimate grounds, to object to the Processing of Personal Data concerning him or her and to Processing for the purpose of sending advertising material, direct selling and carrying out market research. The Data Subject also has the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian supervisory authority) as the supervisory authority for the protection of personal data or to take legal action before the competent courts. The data subject may exercise his or her rights by contacting the Controller by e-mail at privacy@spapperi.it or by post at: SPAPPERI NT S.r.l., Via Pietro Ercolani, 5/B, 06012 Città di Castello (PG), Italy.

10. Tools used for the Processing of Personal Data

10.1 Contact form

By filling in the Contact form with his or her Data, the Data Subject consents to their use to respond to requests for information, or for any other purpose indicated in the heading of the form.

10.2 E-mail address management

These services make it possible to manage a database of e-mail contacts, telephone contacts or contacts of any other type, used to communicate with the Data Subject. These services may also allow the collection of Data relating to the date and time at which the messages are viewed by the Data Subject, as well as to the Data Subject's interaction with them, such as information on clicks on the links included in the messages.

10.3 Newsletter

By registering for the newsletter, the Data Subject's e-mail address is automatically added to a contact list to which e-mail messages may be sent containing information, including of a commercial and promotional nature, relating to this Website. The Data Subject's e-mail address may also be added to this list as a result of registering on this Site or after making a purchase. The Data Subject may choose at any time to unsubscribe from the newsletter by clicking on a specific button found within the e-mails. After clicking on the unsubscribe button, the Data Subject's Data will be deleted immediately

11. Changes and Updates to this Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy at any time, notifying Users on this page. Please therefore consult this page often, taking as a reference the date of last modification indicated. In the event of non-acceptance of the changes made to this Privacy Policy, the Data Subject is required to cease using this Website and may request the Controller to remove his or her Personal Data. Unless otherwise specified, the previous Privacy Policy will continue to apply to the Personal Data collected up to that time.