IF LIGHTING® – Privacy Policy

IF LEUCHTEN des Müller Markus, with its registered office at Handwerkerzone Weiher 20, 39010 St. Pankraz, Italy (hereinafter “IF LEUCHTEN“), is committed to protecting the online privacy of its users. This Privacy Policy has been prepared in accordance with Article 13 of Regulation (EU) 2016/679 (hereinafter the “Regulation” or “GDPR“) to help you understand how your personal information is collected, used and protected when you visit our website, and, where required, to enable you to provide your explicit and informed consent to the processing of your Personal Data (applicable only to individuals aged 16 years or older). Any information or Personal Data you provide, or that is otherwise collected through your use of the services available on this website (hereinafter the “Services“), will be processed in accordance with the provisions of the GDPR and the confidentiality obligations governing the activities of the Data Controller.

Contents

Data Controller
Personal Data Processed
1. Browsing Data
2. Special Categories of Personal Data
3. Data Voluntarily Provided by the Data Subject
Purpose of Processing
Legal Basis and Mandatory or Optional Nature of Processing
Recipients of Personal Data
Transfer of Personal Data
Retention of Personal Data
Rights of Data Subjects
Changes to this Privacy Policy

1. Data Controller
IF LEUCHTEN des Müller Markus, with its registered office at Handwerkerzone Weiher 20, 39010 St. Pankraz, Italy (hereinafter “IF LEUCHTEN“), is committed to protecting the online privacy of its users. This Privacy Policy has been prepared in accordance with Article 13 of Regulation (EU) 2016/679 (hereinafter the “Regulation” or “GDPR“) to explain how your personal data is processed when you use our website and to enable you, where required, to provide your informed and explicit consent to such processing (applicable only to individuals aged 16 years or older). Any information or personal data you provide, or that is otherwise collected while using the services available on this website (hereinafter the “Services“), will be processed in accordance with the Regulation and the confidentiality obligations governing the activities of the Data Controller.

2. Personal Data Processed
Please note that, while browsing this website, the Data Controller may process personal data that can directly or indirectly identify you, including your name, identification number, online identifier, postal address, email address, telephone number (landline and/or mobile), or one or more elements relating to your physical, physiological, psychological, economic, cultural, or social identity (hereinafter referred to as “Personal Data“).
The Personal Data processed through this website includes the following:

a. Browsing Data
The computer systems and software procedures used to operate this website automatically collect certain Personal Data during their normal operation. The transmission of such data is inherent in the use of Internet communication protocols. This information is not collected in order to identify individual users. However, by its nature, it may allow users to be identified through processing and association with data held by third parties. This category of data includes IP addresses or domain names of the devices used by users to access the website, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file returned, the numerical status code indicating the server’s response (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment. These data are processed exclusively for the purpose of obtaining anonymous statistical information regarding the use of the website, ensuring its proper functioning, detecting anomalies and/or misuse, and are deleted immediately after processing. Such data may also be used to determine liability in the event of suspected cybercrime against the website or third parties. Except for this circumstance, browsing data is retained only for the time strictly necessary.

b. Special Categories of Personal Data
If you use our website to submit a job application (or send one via email), you may provide Personal Data belonging to the special categories referred to in Article 9 of the Regulation, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for the unique identification of a natural person, health data, or data concerning a person’s sex life or sexual orientation. Please avoid providing such information unless it is strictly necessary. The Data Controller cannot be held liable for the voluntary submission of special categories of Personal Data without explicit consent, although you are naturally free to submit your curriculum vitae. In such cases, processing is permitted pursuant to Article 9(2)(e) of the GDPR, as the data has been manifestly made public by the data subject. Nevertheless, where such data is intentionally provided, we strongly recommend giving your explicit consent to its processing. Please also note that, for recruitment purposes, the Data Controller may review publicly available professional social media profiles (such as LinkedIn).

c. Data Voluntarily Provided by the Data Subject
When using specific services available on this website (such as contact forms, enquiry forms or reservation requests), you may provide Personal Data relating to third parties. In such cases, you act as an independent Data Controller and assume all legal obligations and responsibilities arising from the processing of such data. Accordingly, you agree to fully indemnify and hold the Data Controller harmless against any claims, damages or liabilities arising from the unlawful processing of Personal Data relating to third parties submitted through the website in breach of applicable data protection legislation. Whenever you provide or otherwise process Personal Data relating to third parties through this website, you warrant that such processing is based on an appropriate legal basis pursuant to Article 6 of the GDPR.

3. Purpose of Processing
Where required and subject to your explicit consent, your Personal Data may be processed for the following purposes:

To provide the Services you have requested.
To respond to customer support requests, enquiries, or reservation requests.
To review submitted applications and contact candidates regarding recruitment opportunities.
To comply with legal, accounting, and tax obligations.
For marketing purposes: subject to your prior, explicit and specific consent, your Personal Data may be processed for the sending of promotional and marketing communications, including newsletters and market research surveys, through both automated means (such as SMS, MMS, email and push notifications) and non-automated means (such as postal mail and telephone contact). The legal basis for this processing is Article 6(1)(a) of the GDPR. Providing consent for marketing purposes is entirely optional and your decision not to provide such consent will not affect your ability to use our Services.

4. Legal Basis and Mandatory or Optional Nature of Processing
The legal basis for processing Personal Data for the purposes described in Section 3 (a–c) is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract. Providing Personal Data for these purposes is voluntary. However, failure to provide such data may prevent us from delivering the requested Services, responding to enquiries, or evaluating submitted applications. With specific reference to the recruitment activities described in Section 3(c), including the review of publicly accessible professional social media profiles referred to in Section 2(b), the legal basis is Article 6(1)(f) of the GDPR, namely the legitimate interest of the Data Controller in assessing a candidate’s suitability for a specific position. The processing described in Section 3(d) is based on Article 6(1)(c) of the GDPR, as it is necessary to comply with legal obligations to which the Data Controller is subject. The legal basis for the processing described in Section 3(e) is Article 6(1)(a) of the GDPR, namely your explicit consent. Without requiring your consent, the Data Controller may also process your email address and postal address to send direct marketing communications relating to products or services similar to those previously purchased (soft spam), in accordance with Article 130(4) of the Italian Privacy Code and the provisions issued by the Italian Data Protection Authority on 19 June 2008. The legal basis for this processing is Article 6(1)(f) of the GDPR, namely the legitimate interest of the Data Controller. This processing may include communications containing text, voice, video, audio or images transmitted through electronic communication networks and stored on network systems, computers or user devices, including SMS, MMS and other functionally equivalent communication technologies.

5. Recipients of Personal Data
Your Personal Data may be disclosed, for the purposes described in Section 3, to:

Entities typically acting as Data Processors, including:
1. Individuals, companies or professional firms providing accounting, administrative, legal, tax, financial, debt collection, marketing or communication services to the Data Controller;
2. Service providers whose cooperation is necessary for the provision of our Services (such as hosting providers);
3. Companies responsible for technical maintenance, including maintenance of network infrastructure and electronic communication systems.
(collectively referred to as “Recipients“).
Public authorities, institutions or other entities where disclosure is required by law or by order of a competent authority.
Persons authorised by the Data Controller to process Personal Data where necessary for the provision of the Services or the fulfilment of the purposes described in Section 3, who are bound by confidentiality obligations or an appropriate statutory duty of confidentiality.

6. Transfer of Personal Data
Some of your Personal Data may be transferred to Recipients located outside the European Economic Area (EEA). The Data Controller ensures that any such transfer is carried out in compliance with the GDPR. Where applicable, transfers are based on an adequacy decision adopted by the European Commission, the Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism recognised under the GDPR. For further information regarding international data transfers, please contact the Data Controller at info@if-leuchten.it.

7. Retention of Personal Data
Personal Data processed for the purposes described in Sections 3(a) and 3(b) will be retained only for as long as necessary to fulfil those purposes. As the processing is carried out for the provision of Services, the Data Controller may retain Personal Data for the period required under applicable Italian legislation in order to protect its legal rights (Articles 2946 et seq. of the Italian Civil Code). CVs submitted via the website or by email pursuant to Section 3(c) will be retained for a period considered appropriate for recruitment purposes. Before this period expires, the Data Controller may contact the applicant to request consent for an extension of the retention period. Personal Data processed for the purposes referred to in Section 3(d) will be retained for the period required by applicable legal obligations. Personal Data processed for the marketing purposes described in Section 3(e) will be retained until the data subject withdraws consent or, if consent is not withdrawn, for the maximum period considered appropriate under applicable legislation. For further information regarding data retention periods or the criteria used to determine them, please contact the Data Controller at info@if-leuchten.it.

8. Rights of the Data Subject
Pursuant to Articles 15 et seq. of the GDPR, you have the right, at any time, to request access to your Personal Data, request its rectification or erasure, or object to its processing. You also have the right to request restriction of processing in the cases provided for under Article 18 of the GDPR and to receive your Personal Data in a structured, commonly used and machine-readable format in the cases provided for under Article 20 of the GDPR. Any request should be submitted in writing to the Data Controller at: info@if-leuchten.it
You also have the right to lodge a complaint with the competent supervisory authority in accordance with Article 77 of the GDPR if you believe that the processing of your Personal Data infringes applicable data protection legislation.

9. Changes to this Privacy Policy
This Privacy Policy has been effective since 1 March 2026 and was last updated on 1 March 2026. The Data Controller reserves the right to amend or update this Privacy Policy, in whole or in part, including as a result of changes to applicable legislation. Users are therefore encouraged to review this page regularly in order to remain informed of the latest version of this Privacy Policy.