NIEDERSTÄTTER SPA

Website Privacy Policy

1. Introduction

We are delighted that you are visiting our website. In this document, we would like to provide you with an overview of the technical structure of our website and inform you about the processing of your personal data whilst you are visiting our website. The following information is not legally binding and is provided for information purposes only.

In addition to this privacy policy for our website, please also refer to our general information on the processing of personal data for prospective and existing customers.

2. Name and contact details of the data controller

Niederstätter AG
Via Achille Grandi 1
39100 Bolzano, Italy
Email: info@niederstaetter.it

Hereinafter, ‘we’ – as the operator of the website – is the data controller responsible for the personal data of the website’s users (hereinafter ‘you’) within the meaning of the General Data Protection Regulation (‘GDPR’).

3. Contact details of the Data Protection Officer

Nuviax GmbH
Voitsbergstraße 2,
39040 Vahrn, Italy
Email: privacy@nuviax.it
www.nuviax.it

You may contact the Data Protection Officer directly with any queries regarding the protection of your personal data and the exercise of your rights as a data subject.

4. Processing of personal data, purposes of processing and legal bases

4.1 General

Personal data, as defined in this privacy policy, refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’).

Personal data also includes information about your use of our website. In this context, we collect personal data from you as follows: information about your visits to our website, such as the volume of data transferred, the location from which you access data from our website, and other connection data and the sources you access.

We use your personal data in particular for the following purposes:

  • to provide the website and to ensure its technical security and stability;
  • to ensure that our website is presented to you in the most effective and engaging way possible (in particular, by storing your language selection and your cookie settings);
  • to process your enquiries via our contact, Academy and application forms, as well as by email;
  • to send you our newsletter, provided you have given your consent;
  • to conduct recruitment processes;
  • to fulfil our obligations under any contracts concluded between you and us;
  • to inform you of changes to our services.

4.2 Provision of the website and creation of log files

When you visit our websites, you transmit data to our web server via your internet browser (for technical reasons). The following data is recorded during an active connection for communication between your internet browser and our web server:

  • IP address of the end device
  • Date and time of the request
  • Content of the request (specific page)
  • Access status / HTTP status code
  • Amount of data transferred in each case
  • Website from which the request originates (referrer)
  • Operating system used on the end device
  • Language, product and version information of the browser software

The processing of your IP address is necessary to enable the website to be delivered to your device, to identify and rectify errors on the website, to determine the website’s usage levels, and to make adjustments or improvements. For this purpose, your IP address must be stored for the duration of the session.

Where we collect your IP address, it is stored only for the duration of your use of the website and is subsequently deleted immediately or anonymised by truncation. The legal basis for the processing of log files is our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

4.3 Cookies, analytics tools and third-party services

Our website uses so-called browser cookies. These are small text files that are stored on your device and which store certain settings and data for exchange with our system via your browser. A cookie usually contains the name of the domain from which the cookie data was sent, as well as information about the age of the cookie and an alphanumeric identifier.

Any processing of personal data that is not strictly necessary requires your consent. This includes, in particular, cookies used for analytics, tracking or advertising purposes. Such data will only be processed with your explicit consent (Article 6(1), first sentence, point (a) of the GDPR). You may withdraw your consent at any time with future effect.

4.3.1 Google Tag Manager

We use Google Tag Manager provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (represented in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager is a tool that enables us to manage tracking and analytics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any independent analysis. It serves solely to manage and deploy the tools integrated via it.

Legal basis: Depending on the tags loaded in each instance (Article 6(1)(a) or (f) of the GDPR).

Google Privacy Policy: https://policies.google.com/privacy

4.3.2 Google Analytics

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC. Google Analytics uses cookies (including _ga and _gid) that enable the analysis of website usage. The information generated about your use of this website is usually transmitted to a Google server in the USA and stored there.

Legal basis: Article 6(1)(a) of the GDPR (consent). You can prevent data collection by Google Analytics by not giving your consent in the cookie banner or by withdrawing your consent.

Opt-out: https://tools.google.com/dlpage/gaoptout

4.3.3 Google Ads

Our website uses Google Ads, a service provided by Google LLC for displaying advertisements. Google Ads uses cookies to display adverts relevant to you. Your IP address is anonymised. The data collected through Google Ads may be transferred to the USA.

Legal basis: Article 6(1)(a) of the GDPR (consent).

4.3.4 Meta Pixel

On our website, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (hereinafter “Meta”). The Meta Pixel enables us to track the behaviour of visitors after they have been redirected to our website by clicking on an advert on Facebook or Instagram. This allows us to measure the effectiveness of our adverts and display relevant adverts to you on these platforms. The Meta Pixel uses cookies (including _fbp). If you are logged in to Facebook or Instagram, Meta can associate the data with your user account. We are joint controllers with Meta for the collection and transfer of data to Meta within the meaning of Article 26 of the GDPR; the relevant agreement is available at https://www.facebook.com/legal/controller_addendum. The data may be transferred to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (DPF).

Legal basis: Article 6(1)(a) of the GDPR (consent). You can prevent data collection via the Meta Pixel by not giving your consent in the cookie banner or by withdrawing your consent.

Meta Privacy Policy: https://www.facebook.com/privacy/policy/

4.3.5 Consent Management

To manage your cookie consents, we use a consent management solution that is operated locally on our server. When you first visit our website, a cookie banner will be displayed, allowing you to accept or reject individual categories. Your decision is stored in the relevant cookie and can be changed or withdrawn at any time with future effect via the ‘Agree to settings’ button.

Any processing of personal data that is not strictly necessary requires your consent. This includes, in particular, cookies used for analytics, tracking or advertising purposes. Such data will only be processed with your express consent. Consent may be withdrawn at any time with effect for the future; the lawfulness of any processing carried out prior to withdrawal remains unaffected.

4.3.6 Blocking cookies via your browser

You can also disable the use of cookies at any time via your browser settings or delete cookies that have already been set. Please note that this may restrict the functionality of our website. You can find instructions in your browser’s help section (Chrome, Firefox, Safari, Edge).

4.4 Contacting us

You can contact us in various ways, in particular via:

Email: You can contact us via the email addresses provided on our website (including info@niederstaetter.it, academy@niederstaetter.it, service@niederstaetter.it and our staff’s personal email addresses). In this case, the personal data transmitted via email will be stored. The data is processed solely for the purposes of the correspondence. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in responding to your enquiry. If the email contact is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) of the GDPR. The data will be deleted as soon as the relevant correspondence with you has been concluded and provided there are no statutory retention obligations to the contrary.

Contact form: Contact forms are available on our website. If you use this option, the data entered in the form will be transmitted to us and stored. When you submit your message, we store the following data:

  • First name and surname
  • Email address
  • Telephone number
  • The content of your message and any other personal data you voluntarily provide in the message field
  • Your declaration of consent (privacy notice, newsletter where applicable)
  • IP address of the computer making the request, as well as the date and time of contact

The processing of personal data entered via the form serves solely to handle enquiries or to initiate a contractual relationship. The legal basis is Article 6(1)(f) of the GDPR; if the enquiry is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) of the GDPR. The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

4.5 Enquiries regarding Academy training courses

You can use the form in the ‘Academy’ section to make enquiries about our training and further education programmes. The data processed includes your first name and surname, company, number of participants, email address, telephone number and any other details you provide. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures) and Article 6(1)(f) of the GDPR (responding to your enquiry).

4.6 Newsletter

You can voluntarily subscribe to our newsletter via our contact form. To do so, we process your email address and your name. Subscription is carried out using the double opt-in procedure: after you have subscribed, you will receive an email in which you must confirm your subscription. To provide evidence of your consent, we record the time of subscription and confirmation, as well as the IP address used.

The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, in particular via the unsubscribe link in every newsletter or by sending an email to info@niederstaetter.it. Following your withdrawal, your data will be removed from the newsletter distribution list; proof of your original consent will be retained to fulfil our accountability obligations (Article 5(2) of the GDPR).

We use the CleverReach service provided by CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany, to send the newsletter. CleverReach acts as our data processor in accordance with Article 28 of the GDPR; a corresponding data processing agreement has been concluded. The data is processed on servers within the European Union. Further information: https://www.cleverreach.com/de/datenschutz/.

4.7 Online applications

Via the ‘Jobs’ section, you can apply either on your own initiative or for advertised vacancies. The data processed includes your first name and surname, email address, telephone number, the application documents you have uploaded (CV, attachments) and your message.

The legal basis for processing data during the application process is Article 6(1)(b) of the GDPR in conjunction with Article 88 of the GDPR, as well as the relevant provisions of employment law (initiation of an employment relationship). Application documents will be deleted no later than six months after the conclusion of the process, unless you have consented to them being retained for a longer period in the applicant pool (Article 6(1)(a) of the GDPR) or there are statutory retention obligations. Please do not provide us with any special categories of personal data within the meaning of Article 9 of the GDPR (e.g. health data), unless such data is necessary for the application.

We maintain a candidate pool so that we can consider you for suitable future vacancies and contact you. Provided you have given your express consent, we will add your application details to the candidate pool and retain them for up to 2 years after the application process has been completed; they will then be deleted. The legal basis for this is your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect, e.g. by sending an email to privacy@niederstaetter.it; your data will then be deleted from the candidate pool without delay.

4.8 Search function

When you use the search function, the search term you enter is transmitted to our server and processed there in order to display the search results to you. No personal data is stored on a permanent basis. The legal basis is Article 6(1)(f) of the GDPR.

4.9 Embedded third-party content (videos)

Videos from the service providers Vimeo and YouTube are embedded on our website. Vimeo is provided by Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA (hereinafter “Vimeo”); YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “YouTube”). We embed YouTube videos in enhanced privacy mode. The videos from both providers are only loaded once you have consented to the embedding of external media via our cookie banner. Only then does your browser establish a connection to the respective provider’s servers. In order to display the requested video in your browser, the processing of your IP address and, where applicable, other technical data (e.g. browser type, time of access) is technically necessary. If you are logged into your user account with the relevant provider whilst the video is playing, the provider may link your usage behaviour to your personal profile; you can prevent this by logging out beforehand. The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR; you may withdraw your consent at any time with future effect.

In connection with video playback, personal data is transferred to the USA: Vimeo is based in the USA, and YouTube may transfer data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Vimeo.com, Inc. and Google LLC are certified under the EU-US Data Privacy Framework (DPF). The European Commission has determined that certified organisations provide an adequate level of data protection (adequacy decision pursuant to Article 45 of the GDPR). You can view the current certification at https://www.dataprivacyframework.gov. Further information on how Vimeo handles your data can be found in Vimeo’s privacy policy at https://vimeo.com/privacy.

Further information on how YouTube processes your data can be found in Google’s privacy policy at https://policies.google.com/privacy.

4.10 Company profiles on other platforms

We make use of the opportunity provided by our company’s presence on social and professional platforms for communication and the exchange of information. Posts published via our company’s profile may contain information about products and services, contact details for customers and prospective clients, job vacancies, as well as information and PR material.

The legal basis for processing the data we collect in connection with the use of our corporate online presence is Article 6(1)(f) of the GDPR. If the contact is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) of the GDPR. If you carry out an action on our corporate social media profiles (e.g. comments, posts, likes), you may thereby make personal data (e.g. your real name or profile photo) publicly available. Where we are joint controllers within the meaning of Article 26 of the GDPR together with the respective platform operator, we have entered into appropriate agreements.

We are present on the following platforms: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Meta Platforms Ireland Ltd. (Facebook/Instagram), Merrion Road, Dublin 4, Ireland.

5. Location of data processing and data security

This website is hosted on servers belonging to a service provider commissioned by us. The service provider we have selected for this purpose is Hetzner Online GmbH. We have entered into a data processing agreement with this service provider in accordance with Article 28 of the GDPR. The server is located in Germany.

Unfortunately, the transmission of information over the internet is not entirely secure, which is why we cannot guarantee the security of data transmitted to our website via the internet. However, we protect our website and other systems against the loss, destruction, unauthorised access, alteration or disclosure of your data by unauthorised persons through technical and organisational measures. In particular, your personal data is transmitted to us in encrypted form (TLS/SSL).

6. Recipients of data

We will only disclose your data to third parties with your consent or on a legal basis. This may be the case, for example, when disclosing data to service providers for the purpose of fulfilling a contract, or where there is a statutory or judicial obligation to do so.

As part of our business processes, the following categories of recipients handle your personal data:

  • Employees of our company and service providers who assist us with data processing in the context of data processing on our behalf (e.g. hosting and IT service providers, web agencies, newsletter service providers). These parties have access to your personal data to the extent necessary to fulfil the aforementioned purposes.
  • Public authorities and natural or legal persons, insofar as we are legally obliged to disclose information (e.g. requests for information from investigating authorities) or where such disclosure is necessary to assert claims.

Our service providers are carefully selected, bound by our instructions and subject to regular monitoring. They provide sufficient guarantees regarding appropriate technical and organisational measures to ensure that processing is carried out in accordance with legal requirements and to protect your rights.

No personal data is currently transferred via this website to third countries outside the EU/EEA. Should such a transfer become necessary, it will take place exclusively on the basis of an adequacy decision by the European Commission (Article 45 of the GDPR) or appropriate safeguards (Article 46 of the GDPR, in particular the EU Standard Contractual Clauses).

7. Retention period

We process and store your personal data only for as long as is necessary to fulfil the respective purpose of processing or as required by statutory retention obligations. Once the purpose no longer applies or the retention periods have expired, the data is routinely deleted or anonymised. The respective retention periods are specified for each individual processing activity under section 4.

8. Your rights as a data subject

As your personal data is processed in connection with the use of this website, you, as a data subject, are generally entitled to the following rights under the GDPR:

  • You have the right to obtain information about the data processed concerning you (Article 15 of the GDPR).
  • You have the right to have inaccurate personal data rectified or incomplete data completed (Art. 16 GDPR).
  • You have the right to have your personal data erased (Art. 17 GDPR).
  • You have the right to restrict processing (Art. 18 GDPR).
  • You have the right to data portability (Article 20 of the GDPR).
  • You have the right to withdraw your consent to the processing of your personal data at any time with effect for the future (Article 7(3) of the GDPR). This does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. To exercise your right to withdraw consent, please contact us at privacy@niederstaetter.it.
  • You have the right to object to the processing of your personal data (Article 21 of the GDPR). In this regard, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data carried out on the basis of Article 6(1)(f) of the GDPR; this also applies to profiling based on these provisions. We will then no longer process your personal data for these purposes, unless there are compelling legitimate grounds for further processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
  • Should we process your personal data for the purposes of direct marketing, you have the right to object at any time to the processing of this personal data for the purposes of such marketing.
  • Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, I-00187 Rome, email: garante@gpdp.it, PEC: protocollo@pec.gpdp.it, www.garanteprivacy.it.

If you wish to exercise any of the above rights, you may do so by contacting us using the contact details provided above.

9. External links / third-party websites

The website may contain hyperlinks to and from third-party websites. If you follow a hyperlink to one of these websites, please note that we cannot accept any responsibility or liability for third-party content or data protection policies. Please refer to the privacy policies available on those websites to find out how the respective providers handle data protection. Please ensure you are aware of the applicable data protection policies before submitting personal data to these websites.

10. Changes

Changes to this privacy policy may be necessary. The current privacy policy can be accessed at any time via the ‘Privacy Policy’ link. You can request older versions of this privacy policy using the contact details provided above.

Last updated: October 2026