Personal data protection notice.

1. Data Controller

The controller of personal data collected through www.ricolfi.com and in the course of business relationships is:

Company name	Ricolfi & C. S.p.A.
Registered office	Viale Antonio Gramsci, 15 — 80122 Naples, Italy
Operating office	Strada Comunale Ponterotto, snc — 81030 Gricignano d'Aversa (CE), Italy
VAT / Tax ID	IT 00282670637
Chamber of Commerce	Reg. no. 282203
Share capital	€ 500,000 fully paid
Phone	+39 081 502 9075

The Ricolfi Group also includes R&R S.r.l. (Genoa/Parma), Ricolfi Group Inc. (Baltimore, USA) and Ricolfi & C. Perú S.A.C. (Lima, Peru), which may act as joint controllers or processors depending on the purpose.

2. Categories of data processed

Ricolfi processes the following categories of personal data:

• Identification and contact data: name, surname, company name, address, e-mail, phone, tax code, VAT number.
• Professional data: company role, employer references, industry sector.
• Browsing data: IP address, access logs, session identifiers, device and browser information, as detailed in the Cookie Policy.
• Commercial and contractual data: information contained in orders, quotations, invoices, insurance policies, packing lists, customs documents, manifests.
• Communication data: e-mail content, call recordings (where previously notified), professional correspondence.
• CV and application data: education, work experience, references.

Special categories of data (Art. 9 GDPR) and criminal-conviction data (Art. 10 GDPR) are not processed, save for specific statutory requirements communicated case by case.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Management of the contractual relationship (quotations, contracts, performance of freight forwarding, customs, warehousing services)	Art. 6(1)(b) — performance of the contract
Tax, accounting, customs and anti-money-laundering obligations	Art. 6(1)(c) — legal obligation
Service communications related to the existing relationship	Art. 6(1)(b) — performance of the contract
Direct e-mail marketing on similar services to existing clients (soft opt-in)	Art. 6(1)(f) — legitimate interest
Newsletter and commercial communications to non-clients	Art. 6(1)(a) — consent
Recruitment and personnel selection	Art. 6(1)(b) — pre-contractual measures
IT security, fraud prevention, protection of company assets	Art. 6(1)(f) — legitimate interest
Defence of a legal claim	Art. 6(1)(f) — legitimate interest

4. Provision of data

Provision of data for contractual, legal and accounting purposes is necessary: refusal makes it impossible to establish or perform the relationship. Provision for marketing purposes is optional and refusal does not affect access to services.

5. Recipients of the data

Data may be disclosed to the following categories of recipients, always consistently with the stated purposes and under appropriate contractual safeguards (Arts. 28 and 46 GDPR):

• Ricolfi Group companies (R&R S.r.l., Ricolfi Group Inc., Ricolfi & C. Perú S.A.C.) for internal administrative and operational coordination purposes.
• Carriers, shipping lines, airlines, terminal operators, customs depositaries, shipping agents and foreign correspondents for the performance of requested services.
• Customs and port authorities, national and foreign tax and administrative bodies, in compliance with legal obligations.
• Insurance companies and brokers for cargo coverage.
• Legal, tax, labour consultants and auditors, bound by professional confidentiality.
• IT, cloud, hosting, e-mail, ERP and antispam service providers, as processors under Art. 28 GDPR.
• Judicial and public security authorities, exclusively upon legitimate request.

An updated list of processors is available on request through our contact form.

6. Transfers outside the EU

Due to the inherent nature of international freight forwarding, data may be transferred to countries outside the European Economic Area (in particular USA, Peru, China, Korea, India, Turkey, Jordan, United Kingdom and other shipment origin/destination countries).

Such transfers take place on the basis of:

• European Commission adequacy decisions (e.g. EU-US Data Privacy Framework for the USA, decision of 10 July 2023);
• Standard Contractual Clauses (SCC) approved by Commission Decision (EU) 2021/914;
• Transfer Impact Assessments (TIA) for countries lacking an adequacy decision, in light of the Schrems II ruling;
• Derogations under Art. 49 GDPR where applicable (e.g. transfers necessary for contract performance).

7. Retention period

Category	Retention
Contractual and tax data	10 years from termination (Art. 2220 Italian Civil Code, tax law)
Customs documentation	Terms set by EU and national customs law (generally 3 years from accounting, save for extended obligations)
CVs and applications	24 months from receipt, unless earlier withdrawn
Commercial communications to non-clients	Until consent is withdrawn, with biennial interest check
Website and system access logs	Maximum 12 months (Italian DPA decision 27/11/2008 and subsequent)
Newsletter	Until opt-out by the data subject

8. Data subject rights

At any time the data subject may exercise the following rights against the Controller (Arts. 15-22 GDPR):

• Access to personal data and the information referred to in Art. 15 GDPR.
• Rectification of inaccurate data and completion of incomplete data (Art. 16).
• Erasure ("right to be forgotten") in the cases set out in Art. 17.
• Restriction of processing in the cases set out in Art. 18.
• Portability of provided data in a structured, machine-readable format (Art. 20).
• Objection to processing based on legitimate interest or for direct marketing purposes (Art. 21).
• Not to be subject to automated decisions, including profiling, producing legal effects (Art. 22). Ricolfi does not use automated decision-making under Art. 22 GDPR and does not employ high-risk AI systems under Regulation (EU) 2024/1689 (AI Act).
• Withdrawal of consent, at any time, without affecting the lawfulness of processing based on consent before withdrawal.
• Lodging a complaint with the Supervisory Authority: Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.

Requests should be submitted through our contact form. Ricolfi will reply within 30 days, extendable by 60 days in complex cases with prior justification (Art. 12 GDPR).

9. Data security

Ricolfi adopts appropriate technical and organisational measures under Art. 32 GDPR, including: pseudonymisation and encryption of data in transit and at rest, access controls based on least-privilege principle, multi-factor authentication on critical systems, access logging, periodic backups and recovery tests, staff training, vendor assessment and selection, documented incident-management procedures (data breach) with notification to the Authority within 72 hours where required, pursuant to Art. 33 GDPR.

The Controller adheres, where applicable, to the principles of Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2555 (NIS2) as transposed in Italy.

10. Tracking pixels in communications

In compliance with the Italian DPA guidelines of 17 April 2026 (Provv. no. 284), any tracking pixels in commercial e-mails are used only with the data subject's explicit consent, transparently informed about purposes and recipients of tracking data. Consent may be withdrawn at any time.

11. Changes to the Notice

This Notice may be updated at any time to reflect regulatory, organisational or technological changes. The current version is always available at www.ricolfi.com/en/privacy-policy. Material changes will be notified to data subjects by appropriate means.

Last update: September 2026