Privacy Policy

Notice on the use of Cookies and similar tracking technologies
Last revised: 11 March 2026

1. Introduction and regulatory references
This notice sets out the main information relating to the processing of personal data and the use of cookies within this site.
This notice is addressed to anyone who accesses or uses this site, describing how the user’s personal data may be collected, used and protected through cookies and similar technologies, as well as the rights granted by law.
These provisions do not concern other websites, pages or online services accessible through external links that may be present on the site, in respect of which you are invited to consult the relevant privacy notices.
This notice is provided in compliance with the principal national and international regulations on the protection of personal data, including:

  • Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
  • Swiss Federal Act on Data Protection (nFADP / FADP)
  • Other regulations that may be applicable.

2. Who manages your data and how can you contact us?
Your personal data is processed by:
Cotton Point S.r.l.
 Via Alessandro Volta, 57/59 25020 Flero (BS) – Italy
 info@cottonpoint.it
 VAT ID: IT-03303200988

For any information concerning the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.

3. What data do we collect when you visit the site?
When you browse this site, we may collect certain information through cookies, related tools and tracking technologies. The main types of data that may be recorded include:

  • Technical and navigation information: IP address, identifiers of the device in use, information about the browser and operating system, date and time of accesses, pages visited, technical commands necessary for the correct display of content, system errors.
  • User preferences: choices made in relation to cookies and privacy settings, collected through panels, banners or similar tools.
  • Statistical and usage data: information used to assess and improve the functioning of the site, for example the frequency of visits or the most consulted areas. This data may be processed in aggregated or anonymized form where the tool used allows it; in other cases the related processing takes place according to the preferences expressed by the user and as indicated in the detailed list of cookies.
  • Interactions with integrated external services: technical data shared when the site integrates third-party services (e.g. fonts, maps, image display), always in accordance with the rules of the operators involved.

For details on the processing of data provided through contact forms, service requests or other features, we invite you to consult our Personal Data Policy.

4. What types of cookies (and similar) exist?
In general, there are several categories of cookies and similar technologies (web beacons, local storage and equivalent technologies). Below is a description of the categories that can generally be used; the list of those actually present on this site is set out in the following section “Detailed list of cookies”.

  • Strictly necessary cookies: essential for the technical functioning of the site, they allow, for example, access to protected areas, session management or remembering essential preferences.
  • Cookies for preferences and personalization: they serve to store display choices, such as language, text size or viewing mode, in order to offer you an interaction closer to your preferences.
  • Analytics and performance cookies: they help us understand how the site is used. They may be used without prior consent only when all the conditions set by the applicable legislation, as interpreted by the competent authorities, are met: for example, when they are intended exclusively to produce statistics for improving the site, the data is adequately minimized or aggregated and any sharing with third parties is limited to that purpose. In other cases they are activated only with prior consent.
  • Cookies for promotional or advertising activities: used to offer personalized commercial content and to monitor the effectiveness of advertising campaigns.
  • External components and services: by interacting with social plugins, analytics tools or third-party platforms, cookies or comparable systems managed directly by external parties may be installed.

5. How can you give or refuse consent to the use of cookies?
Jurisdictions EU, Switzerland, or in any case in countries with legislation similar to the GDPR:

  • The use of cookies and similar technologies that are not strictly necessary is subject, where required by the applicable legislation, to the prior consent of the user, freely given, specific, informed and unambiguous; in other cases, it takes place in compliance with the conditions of lawfulness and, where applicable, on the basis of an appropriate legal basis, following transparent information and in compliance with the rights of refusal, objection or withdrawal provided for by the applicable legislation. As a precautionary choice, the consent management system My Agile Privacy® adopted on this site blocks the non-necessary cookies and tools configured by the Data Controller, including those that the system adds by itself when it detects them, until the user has expressed their preferences through the banner or the consent management panel, except as indicated below for users to whom an opt-out model applies.
  • The user can manage and modify their preferences at any time, withdraw the consent granted and access the “Manage cookie preferences” function.

Operational details:
On first access to the site, except in the cases described below, a banner is displayed that allows you to manage preferences relating to cookies and tracking tools.
Through the banner, the user can choose whether to:

  • Accept all cookies: by clicking the dedicated button, all non-essential cookies will be activated.
  • Customize the settings: you can select in detail which cookies to authorize and which to keep disabled.
  • Reject optional cookies: by pressing the reject button or closing the banner via the dedicated close command (X), the default settings remain unchanged and browsing continues with only the technical cookies necessary for the functioning of the site; closing the banner therefore amounts to a refusal of consent.

The preferences expressed through the banner are retained for a period of 180 days by means of a technical cookie. If you access from a different device or browser, you will need to reconfigure your preferences.
The user may, in any case, at any time modify the choices made by accessing the dedicated functionality, identifiable by the icon or the link dedicated to consent management.

The preferences on the use of cookies and tracking tools are collected and managed through the consent management system (Consent Management Platform) My Agile Privacy®, a Google-certified partner for integration with Google Consent Mode v2.

This site participates in the IAB Europe Transparency & Consent Framework (TCF) and complies with its Policies and Specifications; it uses My Agile Privacy®, a CMP registered with IAB Europe under CMP ID 403. The Purposes and the vendors selected for this site can be consulted, and the related choices modified at any time, through the consent management panel; IAB Europe’s Global Vendor List contains the list of vendors registered with the Framework.

6. On what legal bases do we process the data collected through cookies and related technologies?
The installation of cookies and the use of tracking tools are based on different legal bases depending on the category of the tool and the applicable legislation. In general:

  1. Technical cookies and strictly necessary tools: they are used without the user’s consent, as they are necessary to carry out the transmission of a communication over an electronic communications network or to provide an information society service expressly requested by the user. This category includes, for example, cookies necessary for the functioning of the site, session management, security and the storage of consent preferences.

Where cookies or other tools involve the processing of personal data, the storage of information on the device or access to it is subject to consent only where this is required by the applicable legislation, save for the exemptions indicated above for strictly necessary tools; the subsequent processing operations on the data collected are based on a legal basis under the applicable data protection legislation. Any legitimate interest of the Data Controller may concern such subsequent processing, where necessary and proportionate (for example specific security activities), and cannot replace the consent required for tools that are not strictly necessary.

Refusing or withdrawing consent to the use of certain cookies may limit access to some personalized features of the site.

7. How is your data protected?
The personal data collected through this site by means of cookies and tracking tools is processed by electronic means in accordance with the principles of lawfulness, fairness, minimization, integrity and confidentiality.

In particular, communications between the user’s browser and the site are protected by HTTPS encryption, a measure aimed at reducing the risk of interception or manipulation of the data transmitted during browsing.

The Data Controller also adopts further technical and organizational measures appropriate to ensure a level of security suited to the risk. For details of such measures, please refer to the Personal Data Policy on this site.

8. Where can your data be processed and transferred?
Some of the cookies and third-party tools listed in the following section “Detailed list of cookies” are provided by parties that may process the data in countries other than the one in which you reside, including foreign countries.

The data collected through cookies and tracking tools is processed, as a rule, in the country where the Data Controller is established and at the service providers used. Where data is transferred or made accessible outside the relevant territory under the applicable legislation, the transfer takes place by means of one of the mechanisms it permits, including adequacy decisions, appropriate or suitable safeguards and, where applicable, derogations or other conditions provided for by the applicable legislation. For transfers subject to the GDPR, the relevant territory is the European Union / European Economic Area and, in particular, the EU-U.S. Data Privacy Framework, limited to organizations included in the relevant list and within the scope of the certification, and the Standard Contractual Clauses adopted by the European Commission are relevant. The destination countries and the mechanism actually applied are indicated in the detailed list of cookies, together with the methods for obtaining a copy of any safeguards.

9. Who can receive your data?
The personal data collected through cookies and tracking tools may be processed by the Data Controller, by authorized persons and by technical service providers or third parties involved in the provision of the services on the site.

Such parties may, depending on the activities actually carried out and the applicable legislation, process the data on behalf of the Data Controller or determine the purposes and means of the processing, independently or jointly with other parties. The identities or categories of such parties, their respective roles and, where relevant, the purposes are indicated in the detailed list of cookies; the privacy notices of the individual suppliers provide supplementary information.

The updated list of suppliers can be consulted in the table in section 10 and is also available on request at the Data Controller’s contact details.

10. Detailed list of cookies

My Agile Pixel® - Google Analytics

Google Analytics is a statistical analysis service provided by Google Ireland Limited (“Google”), a company of the Google LLC group (USA). This site uses it through My Agile Pixel®, which sends browsing events to Google via the site's server instead of directly from your browser; the events do not pass through the servers of the provider of My Agile Pixel®. To work, the service loads into your browser the Google Analytics script, which may install its own cookies.

The site owner chooses, through the My Agile Pixel® settings, which data to transmit: for example, they can choose not to send your IP address and the information about your browser, or remove certain tracking parameters from the page addresses.

The data sent is collected for the purposes of personalizing the experience and statistical tracking. You can find more information on the page “More information on how Google processes personal information”.

Events are transmitted only after your consent, which you can withdraw at any time from the cookie preferences. If the site uses Google's consent mode (Consent Mode), before you make your choice a cookieless communication may be sent to Google indicating that consent has not been given; its content depends on the site's configuration.

Google Tag Manager

Google Tag Manager is a tag management service provided by Google Ireland Limited. The data sent is collected for the purposes of personalizing the experience and statistical tracking. You can find more information on the "More information on Google's handling of personal information" page.

Place of processing: Ireland - Privacy Policy

11. How long do we keep your data and preferences?

The preferences expressed on the use of cookies and tracking technologies through the banner or the consent management platform are retained for a period of 180 days.

For the retention, duration and methods of deletion of data other than those mentioned, you can consult the specific provisions set out in the Personal Data Policy on this site.

12. What are your rights regarding the data collected?
In relation to the data collected through cookies and tracking tools, the user can exercise at any time the rights granted by the applicable legislation.

In particular, the right most directly connected to cookies is the right to withdraw the consent previously given to the use of non-essential cookies and to modify one’s preferences at any time, through the dedicated consent management function identifiable by the icon or the dedicated link, without retroactive effect on the lawfulness of processing already carried out on the basis of consent, without prejudice to the further rights provided for by the applicable legislation, including, where applicable, the right to erasure or deletion of the data.

The user also has, under the applicable legislation, the further rights granted to data subjects - including access, rectification, erasure, restriction, objection to processing, data portability and lodging a complaint with the competent authority, pursuant to Article 77 of the GDPR. For a full description of these rights and the methods of exercising them, please refer to the Personal Data Policy on this site.

13. How to delete cookies

Each browser provides different procedures to prevent the use of cookies or to remove them. You can act from the settings of your browser to block and/or delete them. Below you will find references to the official guides of the main browsers on how to manage and delete cookies:

If you use a browser other than those indicated, consult the support section of the official website of the relevant manufacturer.

14. How do we inform you of changes to this notice?
This notice is subject to periodic revision to reflect regulatory changes or modifications to the services offered through the site. Any significant change will be communicated through this page.
Last revised: 11 March 2026

Notice on the Processing of Personal Data collected through this website
Last revised: 11 March 2026

1. Introduction and regulatory references
This notice describes the processing of personal data collected through this website, including data acquired by means of cookies, tracking technologies and - where present - contact forms and any other features that may be active on the site.
This notice is addressed to anyone who accesses or uses this website, describing how the user’s personal data is collected, used and protected, as well as the rights granted by law.
These provisions do not concern other websites, pages or online services accessible through external links that may be present on the site, in respect of which you are invited to consult the relevant privacy notices.
This notice is provided in compliance with the principal national and international regulations on the protection of personal data, including:

  • Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
  • Swiss Federal Act on Data Protection (nFADP / FADP)
  • Other regulations that may be applicable.

2. Who manages your data and how can you contact us?
Your personal data is processed by:
Cotton Point S.r.l.
 Via Alessandro Volta, 57/59 25020 Flero (BS) – Italy
 info@cottonpoint.it
 VAT ID: IT-03303200988

For any information concerning the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.

3. On what legal bases do we process your data?
The processing of personal data collected through this site (including data collected by means of cookies, similar technologies, contact forms and any other features that may be active on the site) is based on one or more of the following legal bases:

  1. Performance of pre-contractual or contractual measures: where processing is necessary to respond to user requests, provide requested services and, where the site so provides, manage orders, accounts or contractual relationships.
  2. Compliance with legal obligations: where processing is necessary to comply with tax, accounting, administrative or security obligations or with requests from the authorities.

The Data Controller may also process the necessary data on the basis of its own legitimate interest, pursuing interests consisting in the security of the site, the prevention of abuse and fraud and the protection of its rights in legal proceedings. The user may in any case object to the processing in accordance with the applicable legislation, in the cases provided for by Article 21 GDPR.

Failure to accept or the withdrawal of consent may limit certain features or services of the site.

The provision of data supplied directly by the user is generally optional, except for any data indicated as mandatory in the individual forms or where it is required by a legal or contractual obligation or is necessary to perform a contract or pre-contractual measures requested by the user; in such cases, failure to provide it may make it impossible to follow up on the request or to deliver the service. Technical navigation data is in any case collected automatically and is necessary for the functioning of the site.

4. What data do we collect when you visit the site?
While browsing this site, the following data may be collected, including by means of cookies and similar technologies such as pixel tags, web beacons, local storage and equivalent technologies, namely:

  • Navigation and technical data: information such as IP address, device identifiers, data relating to the operating system and browser, requested URLs, connection times, technical logs, technical preferences, and usage data collected through cookies and tracking technologies (pixel tags, web beacons, local storage and equivalent tools).

  • Identifying data provided voluntarily: information entered in the digital forms on the site (e.g. first name, last name, e-mail, telephone) and/or provided by sending e-mails or through other contact channels, used to respond to requests, provide services and any consultations.

5. How do we process your data, how do we protect it and how long do we keep it?
The personal data collected through this site is processed mainly by electronic and digital means in accordance with the principles of lawfulness, fairness, data minimization, integrity and confidentiality.

Appropriate technical and organizational measures are adopted to prevent unauthorized access, loss, alteration or unauthorized disclosure of data, including:

  • Encryption of communications (https): communications between your browser and the site are protected by HTTPS encryption, a measure aimed at reducing the risk of interception or manipulation of the data transmitted during browsing;
  • Log monitoring: the system records and monitors accesses and activities in order to detect suspicious or unauthorized attempts and ensure the security of the data;
  • Periodic backups: data is copied and stored periodically to protect it from any accidental loss or technical incidents;
  • Security audits and checks: security checks and tests are carried out regularly to identify and correct any system vulnerabilities;

Data is retained according to the following timeframes:

  • Cookie preferences and consents: retained for 180 days, as set out in the Cookie Policy on this site.
  • Navigation and technical data: retained for the time strictly necessary for security purposes and, as a rule, no longer than 12 months, after which it is deleted or anonymized, save for longer periods imposed by legal obligations or by the need to establish, exercise or defend a right in legal proceedings.
  • Data connected to any contractual relationships established with the Data Controller: where they exist, it is retained for the duration of the relationship and, thereafter, for the time required by the applicable legal obligations (for example in accounting and tax matters).
  • Data entered through forms or specific requests: retained for the time necessary to respond to the request and to fulfill the related purpose, and thereafter for any period required by legal obligations.

6. Who can receive your data?
The following may access the personal data collected through this site, within the limits of their respective responsibilities and purposes:

  • Authorized internal persons designated by the Data Controller, duly instructed on privacy and security matters;
  • Suppliers and third parties appointed as Data Processors (for example: technical providers and IT services, site maintenance, e-mail providers, consultants, where applicable);
  • Third parties that provide services integrated into the site (e.g. fonts, maps, image display), which may process technical data as independent controllers in accordance with their own notices (in which case please also consult the individual notices of such third parties);
  • Competent public authorities and supervisory bodies, within the limits imposed by law or in order to comply with requests from the judicial authority;

The updated list of external recipients can be made available on request by writing to the Data Controller’s contact details.

7. Where can your data be transferred?
The personal data collected through this site is processed, as a rule, in the country where the Data Controller is established and at the service providers it uses. Where data is transferred or made accessible outside the relevant territory under the applicable legislation, the transfer takes place by means of one of the mechanisms it permits, including adequacy decisions, appropriate or suitable safeguards and, where applicable, derogations or other conditions provided for by the applicable legislation. For transfers subject to the GDPR, the relevant territory is the European Union / European Economic Area and, in particular, the EU-U.S. Data Privacy Framework, limited to certified organizations, and the Standard Contractual Clauses adopted by the European Commission are relevant. Information on the applicable mechanism and, where provided for, a copy of the relevant safeguards, possibly redacted in the confidential parts, may be requested at the Data Controller’s contact details.

For disclosures abroad subject to the FADP, the following are relevant: the list of countries with adequate protection established by the Federal Council (Annex 1 to the Swiss Data Protection Ordinance), which for the United States includes only organizations certified under the Swiss-U.S. Data Privacy Framework, and, for other countries, the standard contractual clauses approved, issued or recognized by the FDPIC or the other safeguards and exceptions provided for by Articles 16 and 17 of the FADP.

8. What are your rights regarding the data collected?
The user, under the applicable legislation, has the right to:

  • Obtain confirmation as to whether or not personal data concerning them is being processed and, if so, obtain access to that data and the related information (right of access).
  • Request the rectification, updating or erasure of data that is inaccurate or no longer necessary (right to rectification and erasure).
  • Request the restriction of processing or object, for reasons connected with your particular situation, to processing based on the Data Controller’s legitimate interest, subject to the existence of the conditions provided for by Article 21 GDPR.
  • Receive, in the cases and under the conditions provided for by the applicable legislation, the personal data concerning you in the format required by it and obtain its transmission to another controller or provider; for the EU/EEA and the UK, the right concerns the data you have provided, the format is structured, commonly used and machine-readable and direct transmission is carried out where technically feasible (right to data portability).
  • Withdraw at any time any consent given, without affecting the lawfulness of processing based on consent carried out before the withdrawal (for example for the sending of commercial communications or newsletters, where active).
  • Withdraw the consent given to the use of non-essential cookies and to the processing of data collected through tracking tools.
  • Report any irregularities or abuses to the competent supervisory authorities.

In Italy, the rights concerning the personal data of deceased persons may be exercised, within the limits of Article 2-terdecies of the Privacy Code, by anyone who has a personal interest, acts to protect the data subject as an agent or invokes family reasons worthy of protection.

To exercise these rights, it is sufficient to send a request to the Data Controller’s contact details. The Data Controller will respond without undue delay and within the time limits provided for by the applicable legislation. For requests subject to the GDPR or the UK GDPR, a response is provided within the ordinary period of one month, calculated in accordance with the applicable legislation; that period may be extended by a further two months, taking into account the complexity and number of the requests, and the data subject is informed of the extension and the related reasons within the ordinary period.

Switzerland (FADP): the information requested in the exercise of the right of access is generally provided within 30 days of receipt of the request; if this is not possible, the Data Controller will inform you within the same period, indicating when it will provide the information.

9. How is minors’ data processed?
The protection of minors is a fundamental priority.

This site is not directed at minors and does not intentionally collect their data through its forms. Where, in the context of a request or query, the user provides personal data relating to third parties - including any minors - they must ensure that they are authorized to do so; such data will be processed within the limits and for the purposes of the request, in compliance with the applicable legislation. For requests for rectification, restriction or erasure, you may write to the Data Controller’s contact details.

10. How can you make reports or complaints to the authorities?
If you believe that the processing of your personal data through this site does not comply with the applicable legislation, you may contact the competent authorities indicated below free of charge, in accordance with the applicable legislation, including by lodging a complaint pursuant to Article 77 of the GDPR:

11. How do we inform you of changes to this notice?
This notice is subject to periodic revision to reflect regulatory changes or modifications to the services offered through the site. Any significant change will be communicated through this page.
Last revised: 11 March 2026