Privacy Policy

The data controller is EPTAPRINT S.R.L., with registered office at Borgo Pietro Wuhrer 39, 25123 Brescia (BS), Italy.

• VAT number / Italian tax code (Codice Fiscale): 04698670983
• REA number (Brescia Companies Register): BS-634601
• Email: info@eptaprint.com
• Phone: +39 351 433 5740

The designated Data Protection Officer is Gabriele Ballerio Nocivelli, who can be contacted at info@eptaprint.com (subject line: "Attenzione DPO", i.e. "Attention DPO").

We process the following categories of personal data:

• Contact data: first name, last name, company name, email address and telephone number.
• Project data: the written description of the request, preferred printing technology, material, quantity, and CAD files (.STL, .STEP, .STP) uploaded through the quote request form.
• Browsing and security data: IP address, browser user agent and request timestamps, collected in minimized form solely for rate limiting, service security and abuse prevention.
• Aggregate statistical data: traffic metrics (pages visited, referral source, load times) collected through Cloudflare Web Analytics, a tool that uses no cookies or persistent identifiers and does not use the IP address or the user agent to identify individual visitors (see the Cookie Policy).

Personal data are processed for the following purposes:

• Handling contact and quote requests. Legal basis: processing necessary to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).
• Compliance with legal obligations (tax, accounting and civil-law obligations). Legal basis: compliance with a legal obligation to which the controller is subject (Art. 6(1)(c) GDPR).
• Website security and abuse prevention (rate limiting, technical logging, anomaly analysis). Legal basis: the controller's legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).
• Aggregate website usage statistics. Legal basis: the controller's legitimate interest in measuring and improving the service (Art. 6(1)(f) GDPR); the tool used does not rely on cookies or on any technology that requires consent.

Providing contact and project data is optional but necessary in order to receive a response to the request; if the mandatory fields are not completed, the request cannot be processed.

Personal data are retained only for as long as strictly necessary for the purposes for which they are processed:

• Contact and quote requests and uploaded CAD files: 30 days from receipt, unless a business relationship is established; after that period, the data and files are automatically erased by a scheduled clean-up job.
• Data relating to active customers and tax documents: 10 years from the date of issue of the document, in compliance with the obligations laid down in Article 2220 of the Italian Civil Code and in tax legislation.
• Technical and security logs: a maximum of 12 months, unless they are needed to establish unlawful conduct.
• Traffic statistics: retained in aggregate form only, with no data that can be traced back to individual visitors.

Personal data may be disclosed to parties acting as data processors under Article 28 GDPR, appointed by means of a specific data processing agreement:

• Cloudflare, Inc. (USA): CDN/Workers hosting, perimeter protection of the website and aggregate traffic statistics (Cloudflare Web Analytics, cookieless); transfers outside the EU are based on Standard Contractual Clauses (SCCs) approved by the European Commission.
• Cloudflare R2: storage of uploaded CAD files (object storage); same safeguards.
• Supabase, Inc. (USA, infrastructure hosted in an AWS EU region): database, administrator authentication and request management; SCCs.
• Resend, Inc. (USA): sending of transactional emails (notification to the team and receipt to the user); SCCs.
• The controller's external consultants, accountants and other professionals, only where strictly necessary to process the request or to comply with legal obligations.

An up-to-date list of data processors may be requested at any time by writing to info@eptaprint.com.

Some of the processors listed above are established in the United States of America. Transfers take place on the basis of appropriate safeguards under Articles 44 et seq. GDPR, in particular Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where applicable, certification under the EU-U.S. Data Privacy Framework.

Data subjects may exercise the rights provided for in Articles 15 to 22 GDPR at any time:

• right of access (Art. 15);
• right to rectification (Art. 16);
• right to erasure (“right to be forgotten”) (Art. 17);
• right to restriction of processing (Art. 18);
• right to data portability (Art. 20);
• right to object (Art. 21);
• right not to be subject to a decision based solely on automated processing (Art. 22);
• right to withdraw consent at any time (Art. 7(3)).

Requests must be submitted in writing to info@eptaprint.com. The controller will respond within 30 days, unless that period is extended for justified reasons.

Data subjects have the right to lodge a complaint with the competent supervisory authority, the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy; www.garanteprivacy.it), and to seek a judicial remedy before the courts.

The controller does not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.

Personal data are processed by electronic means and protected by technical and organizational measures appropriate to the risk: TLS encryption in transit; access to the administration area restricted to an authenticated account with dedicated credentials and verification of the authorized role; separation between the public environment and the administration area; Row-Level Security policies on the database; application-level rate limiting; HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options); and automatic erasure of data at the end of the retention period.

This notice may be updated to reflect new legal or organizational requirements. The current version is always published at this URL. Last updated: September 2026.