Privacy Notice

Last updated: 1 October 2026

Who we are

The data controller is Gradi Group S.r.l. a socio unico, Via Vittorio Veneto 35, 50050 Cerreto Guidi (FI), Italy — VAT 07348480489, REA FI 697304. For any privacy matter you can write to info@gradigroup.com.

What data we collect

When you submit a request through our website, we collect the information you provide: company name, VAT or business registration number, full name, role, business email, phone or WhatsApp number, company website, country of registration, type of business, markets served, typical order value, purchasing frequency, categories of interest and any notes you choose to add.

We also collect technical data needed to operate the website, such as IP address and browser information, and — only with your consent — data from analytics cookies. See our Cookie Policy for details.

We do not request or process special categories of personal data.

Why we use it, and on what legal basis

• To reply to your request and assess whether a business relationship is possible — pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• To verify the business you represent before granting access to our catalogue — our legitimate interest in working only with verified counterparts (Art. 6(1)(f) GDPR).
• To manage the commercial relationship once it begins — performance of a contract (Art. 6(1)(b) GDPR).
• To comply with legal, tax and accounting obligations — legal obligation (Art. 6(1)(c) GDPR).
• To measure how the website is used through analytics cookies — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not use your data for automated decision-making or profiling, and we do not sell it.

The fields marked as required in our forms are necessary to handle your request: without them we cannot reply. All other information is optional.

Who receives it

Your data is accessed only by Gradi Group staff who need it to handle your request. It may also be processed by service providers acting on our behalf, such as our hosting and email providers, bound by data processing agreements.

Transfers outside the European Union

Your personal data is stored and processed within the European Union. We do not transfer it outside the EU.

If you accept analytics cookies, Google may process the related technical data outside the European Union. In that case the transfer relies on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on Standard Contractual Clauses.

How long we keep it

• Requests that do not lead to a business relationship: up to 24 months from our last contact.
• Clients and commercial relationships: for the duration of the relationship and then for 10 years, as required by Italian civil and tax law.
• Analytics data: for the period described in our Cookie Policy.

Your rights

Under Articles 15–22 GDPR you can ask to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw it at any time without affecting what was done before. To exercise your rights, write to info@gradigroup.com. We will reply within one month.

If you believe your data is being processed unlawfully, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.

Changes to this notice

We may update this notice from time to time. The date at the top always shows the current version.