Privacy Notice on the Processing of Personal Data in Newsletters and Electronic Communications

This notice specifically describes the collection and use of personal data in connection with the sending of newsletters, DEMs and other electronic communications

1. Data Controller

The Data Controller is Lemi Group S.r.l., with registered office at Via Soldi, 13, Casalbuttano (CR), Italy.

For information regarding the processing of personal data and to exercise data subject rights, the Data Controller may be contacted at contact@lemigroup.it.

2. Who this Notice Applies To

This notice applies to individuals who:

• subscribe to the Lemi Group newsletter or other electronic communications;
• receive promotional or informational communications from Lemi Group;
• interact with such communications, including by opening, clicking or forwarding them;
• make purchases after receiving or selecting a link contained in a communication;
• have provided their data in the context of a commercial relationship or sale and may receive communications relating to similar products or services, where permitted by law.

3. . Categories of Data Processed

In connection with the sending and management of electronic communications, Lemi Group may process:

• first name, surname and email address;
• data relating to subscription, source of the contact, and the list or segment to which the individual belongs;
• data relating to consent, objection, withdrawal and unsubscription;
• data relating to email opens, including the date and time of opening, most recent opening, number of opens and, where technically detectable, the association of the event with the recipient or with an identifier attributable to them;
• data relating to email forwarding, where the platform is able to detect it;
• data relating to clicks on links contained in emails, including the selected link, the date and time of the click and any association of the click with the individual recipient;
• technical and approximate geographical data, such as the country or approximate location associated with the interaction, where derived from the IP address or other technical data;
• data relating to the device, browser, email client, IP address, campaign, message or recipient identifiers, and other technical parameters transmitted by the platform.
•  

4. Tracking pixel and Tracked Links

Emails sent may contain a tracking pixel, i.e. an image, normally very small, hosted on a remote server. When the email client downloads the image, the server may receive information relating to the opening of the message and to the technical request made by the device or software used to read it.

Emails may also contain tracked links. Selecting a link may be recorded by the platform and associated with the communication, the campaign and, where the link is individually configured, with the recipient or an identifier attributable to them.

Depending on the technical configuration adopted, loading the pixel and selecting links may make it possible to detect:

• whether the email has been opened or reopened;
• the date and time of the opening or click;
• the number of opens;
• the selected link;
• the device, browser or email client used;
• the IP address and other technical data;
• the country or approximate location of the interaction;
• any orders or revenue attributed to the communication.

5. Purposes of Processing

Data are processed for the following purposes:

a) Sending newsletters and promotional communications

To send newsletters, DEMs, commercial communications and updates regarding Lemi Group products, services, initiatives, events and activities.

b) Managing subscriptions and unsubscriptions

To manage recipient lists, record preferences, enable unsubscription and respond to requests to object or withdraw consent.

c) Technical verification of delivery

To detect deliveries, non-deliveries, technical errors, full mailboxes and other events necessary to improve the technical quality of delivery and to counter spam or abuse.

d) Aggregate statistics

To compile overall statistics on campaign performance, opens, clicks and delivery quality, where the data are processed in genuinely anonymous or aggregate form and do not make it possible to measure the behaviour of an individual recipient.

e) Individual measurement of interactions

To detect and analyse opens, clicks, forwards and other interactions of an individual recipient with communications, in order to measure campaign performance and improve the content, frequency, subject line, structure and relevance of communications.

f) Conversion analysis

To verify whether a communication or link has generated an order and, where provided for by the configuration used, to attribute the related order, revenue or average revenue to the communication.

g) Segmentation, personalisation and demographic analysis

To create recipient segments and, where applicable, personalise communications on the basis of declared, observed, estimated or inferred data, including gender, age group, interactions, clicks, opens, orders and country of interaction.

These activities will be carried out only within the limits described in this notice and on the basis of a valid lawful basis for processing.

h) Security, prevention of abuse and protection of rights

To prevent fraudulent or abusive use of the platform, verify technical anomalies, protect Lemi Group’s rights, and establish, exercise or defend legal claims in judicial or extrajudicial proceedings.

6. Legal Bases

6.1 Sending promotional communications

As a rule, promotional communications by email are sent on the basis of the data subject’s consent. Consent is optional and may be withdrawn at any time.

In the cases provided for by Article 130(4) of the Italian Privacy Code, Lemi Group may use, for direct marketing purposes, the email address provided by the data subject in the context of the sale of a product or service in order to communicate similar products or services, provided that the data subject has been adequately informed and can object free of charge and easily both at the time of collection and in each communication.

6.2 Individual tracking of opens, clicks and conversions

Where tracking pixels, tracked links or attribution tools make it possible to monitor the behaviour of an individual recipient, measure their interactions, analyse opens and clicks, associate orders or revenue, or create individual segments, the processing is carried out with the data subject’s prior consent, unless a specific exemption under applicable law applies.

Consent to tracking may be requested together with consent to receive promotional communications only where the request clearly explains the use of monitoring tools and allows a free, informed and unconditional choice.

6.3 Deliverability, security and aggregate statistics

Consent may not be necessary for strictly technical delivery, security or authentication activities and for exclusively aggregate statistics, provided that the processing is genuinely necessary for the stated purpose and that measurement of the behaviour of an individual recipient is technically prevented.

In particular, aggregate statistics must be produced using appropriate measures to prevent an event from being linked back to an individual data subject. Any application of this exemption does not extend to individual tracking of opens, clicks, orders or revenue.

6.4 Legal obligations and protection of rights

Processing may be carried out to comply with legal obligations or in pursuit of Lemi Group’s legitimate interest in security, the technical management of the service and the protection of its rights, within the limits laid down by the GDPR and applicable law.

7. Granular Consent and Withdrawal

Where required, consent to tracking is obtained before the use of tracking pixels or other individual monitoring tools.

The data subject may withdraw consent at any time and as easily as it was given. Withdrawal may concern:

• all promotional communications;
• only the tracking of opens;
• only the tracking of clicks and conversions;
• additional segmentation or personalisation activities, where managed separately.

Where technically possible, withdrawal of consent to tracking does not result in unsubscription from the newsletter and does not prevent receipt of communications without tracking pixels, tracked links or other individual monitoring tools.

The methods for withdrawing consent are indicated in the communications sent and may include the unsubscribe link, the preference centre or a request sent to contact@lemigroup.it.

The data subject’s choices, including consent, withdrawal, objection and unsubscription, are recorded in order to demonstrate compliance of the processing.

8. Transfers to Third Countries

Any transfers are carried out in compliance with Chapter V of the GDPR, on the basis of an adequacy decision, appropriate safeguards, Standard Contractual Clauses or another condition provided for by applicable law.

Information on the safeguards adopted and on how to obtain a copy of them may be requested at contact@lemigroup.it.

9. Data Retention

Data are retained for the period necessary for the purposes for which they were collected and, subsequently, for the period necessary to comply with legal obligations or to establish, exercise or defend legal claims.

In particular:

• data relating to subscription, consent, withdrawal, objection and unsubscription are retained for the period necessary to document the data subject’s choices and the lawfulness of the communications sent;
• data relating to deliveries, non-deliveries and technical errors are retained for the period necessary for the technical management and security of the service;
• data relating to opens, clicks, forwards, orders, revenue, demographic data and geographical reports are retained for the period necessary for the stated purposes and are subsequently deleted, anonymised or retained only in aggregate form;
• data used to send promotional communications are retained until consent is withdrawn, an objection is made or the relevant purpose ceases to apply, without prejudice to data necessary to demonstrate the lawfulness of the processing;
• data relating to orders and purchases are retained for the periods required by law or necessary for managing the relationship and protecting rights.

10. Profiling and Automated Decision-Making

Data relating to opens, clicks, orders, revenue, gender, age group and country of interaction may be used to segment recipients or personalise communications, where such activity is actually enabled.

Unless otherwise stated in a specific notice, Lemi Group does not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them.

Where estimated or inferred data are used, Lemi Group will provide, upon request, information on their source and the principal ways in which they are used, within the limits provided for by law.

11. Provision of Data

Providing an email address is necessary in order to subscribe and receive the requested communications.

Consent to receive promotional communications and consent to individual tracking are optional. Failure to consent to tracking, or subsequent withdrawal of such consent, does not affect receipt of communications without individual monitoring tools, where technically possible.

12. Data Subject Rights

Where provided for by the GDPR, the data subject may exercise the right to:

• obtain confirmation as to whether or not personal data concerning them are being processed and access such data;
• obtain the rectification of inaccurate data or completion of incomplete data;
• obtain the erasure of data;
• obtain restriction of processing;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing purposes, including profiling related to such marketing;
• withdraw consent at any time;
• obtain data portability where applicable;
• where applicable, know the source of data not collected directly from the data subject;
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

To exercise these rights, the data subject may write to contact@lemigroup.it or use the links provided in email communications and in the preference centre.

13. Updates

Lemi Group may update this notice to reflect regulatory, technical or organisational changes to the processing. The updated version will be published on the website and, where necessary, communicated to data subjects by appropriate means.

This notice supplements and does not replace the Cookie Policy of lemigroup.it, which governs the tracking tools used on the website. Last updated: October 2026.