Privacy Policy
Last updated: April 2, 2026
Notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") for users who browse and interact with the website www.pellegrinobrothers.it (hereinafter, the "Site").
This notice describes how the Site is managed with regard to the processing of personal data of users who browse it and/or use the services offered therein. Pellegrino Brothers is committed to protecting users' privacy by applying high security standards, in line with the principles of Privacy by Design and Privacy by Default.
1. Data Controller
The Data Controller for personal data processing is:
Pellegrino Brothers s.r.l.
Registered Office: Via Taranto zona g 59 74015 Martina Franca (ta)
VAT Number: 03445970738
Contact email for privacy matters: info@pellegrinobrothers.it
Email for Data Breach reports: databreach@pellegrinobrothers.it
2. Types of Data Processed
While browsing and using the Site, we collect and process the following categories of data:
A. Browsing data
The computer systems and software procedures used to operate this Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category includes:
• IP addresses or domain names of the computers and terminals used by users.
• Addresses in URI/URL notation of the resources requested.
• Time of the request and the method used to submit the request to the server.
• Size of the file obtained in response and the numerical code indicating the status of the response given by the server (successful, error, etc.).
• Other parameters relating to the user's operating system and computing environment (type of device, browser used).
This data is used solely to obtain anonymous statistical information about the use of the Site, to check its correct functioning, and to establish liability in the event of hypothetical computer crimes against the Site or our server infrastructure.
B. Data voluntarily provided by the user
The optional, explicit, and voluntary sending of messages to the contact addresses indicated on the Site, as well as the completion and submission of the forms available (e.g. the "Contact Us" form or the "Free Audit" form), involves the acquisition of the sender's contact details, necessary to respond, as well as all personal data included in the communications.
Specifically, through the Site's forms we may collect:
• First and Last Name
• Company Name
• Email Address (work or personal)
• Phone Number
• URL of the website to be analyzed (for Audit requests)
• Content of the message or request
All data entered in the forms is natively processed by the KeideaCMS infrastructure, encrypted in the proprietary database, and never passes through third-party plugins or external systems not controlled by the Data Controller.
3. Purposes and Legal Basis of Processing
Personal data is processed for the following purposes:
Purpose and Legal Basis
Provision of requested services: Responding to information requests, providing commercial consulting, carrying out the Free Audit of the website indicated by the user.
Performance of a contract or pre-contractual measures (Art. 6(1)(b), GDPR).
Security and operation of the Site: Monitoring the proper technical functioning of the infrastructure, preventing and blocking cyber attacks (e.g. unauthorized access attempts, brute force, DDoS).
Legitimate interest of the Data Controller in ensuring the security of its networks and systems (Art. 6(1)(f), GDPR).
Compliance with legal obligations: Complying with accounting, tax regulations or requests from the Judicial Authority.
Legal obligation to which the Data Controller is subject (Art. 6(1)(c), GDPR).
Statistical analysis and Marketing (subject to consent): Analyzing traffic on the Site and proposing relevant advertisements through third-party platforms (e.g. Google Ads, Meta Pixel).
Express consent of the user via the cookie banner (Art. 6(1)(a), GDPR).
4. Data Processing and Security Methods
Processing is carried out using IT and telematic tools, following logics strictly related to the stated purposes. The main security measures include:
• Hardened Architecture: The Site is developed on an optimized LEMP stack, with clear physical and logical separation between the front-end (public) and back-end (administrative).
• Database Protection: Exclusive use of parameterized queries to eliminate the risk of SQL Injection attacks. Sensitive data collected via forms is stored in encrypted form.
• No Third-Party Plugins: Unlike Open Source systems, Pellegrinobros does not use external plugins or extensions for data management, eliminating the risks of vulnerabilities arising from code not directly controlled by our engineers.
• Firewall and Intrusion Prevention: Active traffic monitoring to automatically block malicious IPs and anomalies.
•Backup: Encrypted and redundant backup procedures to ensure data availability and resilience.
The servers hosting the Site and its databases are physically located in Italy (and in any case within the European Economic Area - EEA), ensuring full compliance with European data protection regulations.
5. Data Recipients
Personal data will not be disclosed or sold to third parties. It may be made accessible exclusively to:
•Authorized personnel: Employees and collaborators of Pellegrino Brothers s.r.l. (e.g. software engineers, business consultants, IT staff), trained and bound by confidentiality obligations.
•Data Processors: Third parties who carry out outsourced activities on behalf of the Data Controller (e.g. hosting service providers in Italy, legal/tax consultants), appointed as External Data Processors pursuant to art. 28 GDPR.
6. Transfer of Data Outside the EU
The management and storage of personal data take place on servers located in Italy. However, for specific statistical or marketing purposes (e.g. Google Analytics 4, Google Ads, Meta Pixel), some browsing data and online identifiers may be transferred to servers located in the United States.
Such transfer takes place exclusively to providers that adhere to the EU-US Data Privacy Framework (DPF) or through the signing of Standard Contractual Clauses (SCC) approved by the European Commission, ensuring an adequate level of protection.
7. Retention Period
Personal data will be retained for the time strictly necessary to achieve the purposes for which it was collected:
•Contact data and requests: Retained for the time necessary to process the request and, subsequently, for a maximum of 24 months, unless a contractual relationship is established.
•Browsing data and security logs: Retained for a maximum period of 6 months, except where necessary for the investigation of crimes by the Judicial Authority.
•Data collected through cookies: Please refer to the specific "Cookie Policy" section.
8. Data Breach Management
Despite its robust architecture, Pellegrino Brothers s.r.l. has set up a rapid response procedure in the event of a personal data breach (Data Breach).
In the event of an anomalous event, the Data Controller, with the direct support of the IT Manager, will proceed to:
1.Immediately assess the extent of the breach and the data involved.
2.Isolate and neutralize the cyber threat.
3.Notify the breach to the Data Protection Authority within 72 hours, if the breach poses a risk to the rights and freedoms of data subjects.
4.Promptly inform the affected users of the event, if the risk is assessed as high, providing clear information on the measures taken and reference contacts.
9. Rights of the Data Subject
Pursuant to Articles 15-22 of the GDPR, the user has the right to:
•Obtain confirmation of the existence or otherwise of personal data concerning them and access to such data.
•Request the updating, correction or integration of inaccurate or incomplete data.
•Request the erasure of data ("right to be forgotten"), if the reasons provided for by law exist.
•Request the restriction of processing.
•Object, in whole or in part, for legitimate reasons, to the processing of their data.
•Receive their data in a structured, commonly used and machine-readable format (data portability).
•Withdraw consent given at any time, without affecting the lawfulness of processing based on consent given before withdrawal.
To exercise these rights, the user can send a written communication to the email address: info@pellegrinobrothers.it.
The data subject also has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) if they believe that the processing violates current regulations.
10. Cookie Policy
The Site uses cookies and similar technologies to ensure the proper functioning of the pages, improve the user experience and, subject to consent, analyze traffic and provide personalized ads.
Consent management is natively integrated into the Pellegrino Brothers infrastructure (without the use of vulnerable external plugins), ensuring the preventive blocking of unnecessary cookies until explicit acceptance by the user.
Types of Cookies used:
Technical Cookies (Strictly Necessary)
These are essential for the proper functioning of the Site (e.g. maintaining the session, saving privacy preferences). They do not require user consent.
Analytics Cookies
Used to collect information, in aggregate form, on the number of users and how they visit the Site.
•Google Analytics 4 (GA4): Configured with IP address masking to reduce identifying power.
Profiling and Marketing Cookies
Used to track the user's browsing and create profiles aimed at sending advertising messages in line with the preferences expressed. They are activated only upon explicit consent.
•Google Ads
•Meta Pixel (Facebook)
Preference Management
Users may change their cookie choices at any time by clicking on the "Manage Cookies" button in the Site's footer. It is also possible to configure your browser to refuse all cookies or to receive a warning when a cookie is sent.
11. Changes to this Policy
The Data Controller reserves the right to make changes to this Privacy Policy at any time, informing users on this page. Please check this page regularly, referring to the last modified date indicated above.