Personal data protection notice.

1. Data Controller

The controller of personal data collected through www.ricolfi.com and in the course of business relationships is:

Company name	Ricolfi & C. S.p.A. – Casa di Spedizioni
Registered office	Viale Antonio Gramsci, 15 — 80122 Naples, Italy
Operating office	Strada Comunale Ponterotto, snc — 81030 Gricignano d'Aversa (CE), Italy
VAT / Tax ID	IT 00282670637
Companies Register	Napoli no. 00282670637 · REA NA-282203
Share capital	€ 500,000 fully paid
Phone	+39 081 502 9075

The Ricolfi Group also includes R&R S.r.l. (Genoa/Parma), Errelogistica S.r.l. (Italy), Ricolfi Group Inc. (Baltimore, USA) and Ricolfi & C. Perú S.A.C. (Lima, Peru), which may act as joint controllers or processors depending on the purpose.

2. Categories of data processed

Ricolfi processes the following categories of personal data:

• Identification and contact data: name, surname, company name, address, e-mail, phone, tax code, VAT number.
• Professional data: company role, employer references, industry sector.
• Browsing data: IP address, access logs, device and browser information, as detailed in the Cookie Policy.
• Commercial and contractual data: information contained in orders, quotations, invoices, insurance policies, packing lists, customs documents, manifests.
• Communication data: e-mail content, professional correspondence.
• CV and application data: education, work experience, references.

The data is provided by the data subject or by the client or supplier on whose behalf they act (for example senders, consignees and contact persons named in shipping documents), or is obtained from public registers.

Special categories of data (Art. 9 GDPR) and criminal-conviction data (Art. 10 GDPR) are not processed, save for specific statutory requirements communicated case by case.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Management of the contractual relationship (quotations, contracts, performance of freight forwarding, customs, warehousing services)	Art. 6(1)(b) — performance of the contract
Tax, accounting, customs and anti-money-laundering obligations	Art. 6(1)(c) — legal obligation
Service communications related to the existing relationship	Art. 6(1)(b) — performance of the contract
Direct e-mail marketing of similar services to existing clients (soft opt-in under Art. 130(4) of Legislative Decree 196/2003)	Art. 6(1)(f) — legitimate interest
Commercial communications to non-clients	Art. 6(1)(a) — consent
Recruitment and personnel selection	Art. 6(1)(b) — pre-contractual measures
IT security, fraud prevention, protection of company assets	Art. 6(1)(f) — legitimate interest
Defense of a legal claim	Art. 6(1)(f) — legitimate interest

4. Provision of data

Provision of data for contractual, legal and accounting purposes is necessary: refusal makes it impossible to establish or perform the relationship. Provision for marketing purposes is optional and refusal does not affect access to services.

5. Recipients of the data

Data may be disclosed to the following categories of recipients, always consistently with the stated purposes and under appropriate contractual safeguards (Arts. 28 and 46 GDPR):

• Ricolfi Group companies (R&R S.r.l., Errelogistica S.r.l., Ricolfi Group Inc., Ricolfi & C. Perú S.A.C.) for internal administrative and operational coordination purposes.
• Carriers, shipping lines, airlines, terminal operators, customs warehouse keepers, shipping agents and foreign correspondents for the performance of requested services.
• Customs and port authorities, national and foreign tax and administrative bodies, in compliance with legal obligations.
• Insurance companies and brokers for cargo coverage.
• Legal, tax, labor consultants and auditors, bound by professional confidentiality.
• IT, cloud, hosting, e-mail, ERP and antispam service providers, as processors under Art. 28 GDPR.
• Judicial and public security authorities, exclusively upon legitimate request.

An updated list of processors is available on request through our contact form.

6. Transfers outside the EU

Due to the inherent nature of international freight forwarding, data may be transferred to countries outside the European Economic Area (in particular USA, Peru, China, South Korea, India, Turkey, Jordan, United Kingdom and other shipment origin/destination countries).

Such transfers take place on the basis of:

• European Commission adequacy decisions (e.g. EU-US Data Privacy Framework for the USA, decision of 10 July 2023);
• Standard Contractual Clauses (SCC) approved by Commission Decision (EU) 2021/914, supplemented where necessary by a transfer impact assessment (TIA) in light of the Schrems II ruling;
• Derogations under Art. 49 GDPR where applicable (e.g. transfers necessary for contract performance).

The maps published on the site are provided by Esri ArcGIS Online (Esri Inc., USA): to display them, the browser sends Esri the IP address and the technical data of the request. The legal basis is the legitimate interest in showing the location of our offices (Art. 6(1)(f) GDPR); the transfer to the USA relies on the EU-US Data Privacy Framework, to which Esri adheres. Further information is available in the Esri privacy statement.

7. Retention period

Category	Retention
Contractual and tax data	10 years from termination (Art. 2220 Italian Civil Code, tax law)
Customs documentation	Terms set by EU and national customs law (at least 3 years from the end of the year in which the declaration was accepted, under Art. 51 of the Union Customs Code; the same documents are also kept for up to 10 years as tax records)
Contact and quotation requests not followed by a contract	24 months from the request
CVs and applications	24 months from receipt, unless earlier withdrawn
Commercial communications to non-clients	Until consent is withdrawn, with biennial interest check
Website and system access logs	Maximum 12 months

8. Data subject rights

At any time the data subject may exercise the following rights against the Controller (Arts. 7, 15-22 and 77 GDPR):

• Access to personal data and the information referred to in Art. 15 GDPR.
• Rectification of inaccurate data and completion of incomplete data (Art. 16).
• Erasure ("right to be forgotten") in the cases set out in Art. 17.
• Restriction of processing in the cases set out in Art. 18.
• Portability of provided data in a structured, machine-readable format (Art. 20).
• Objection to processing based on legitimate interest or for direct marketing purposes (Art. 21).
• Not to be subject to automated decisions, including profiling, producing legal effects (Art. 22). Ricolfi does not use automated decision-making under Art. 22 GDPR and does not employ high-risk AI systems under Regulation (EU) 2024/1689 (AI Act).
• Withdrawal of consent, at any time, without affecting the lawfulness of processing based on consent before withdrawal.
• Lodging a complaint with the Supervisory Authority: Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.

Requests may be submitted through our contact form or sent to the contact details given in section 1. Ricolfi will reply within 30 days, extendable by 60 days in complex cases with prior justification (Art. 12 GDPR).

9. Data security

Ricolfi adopts appropriate technical and organizational measures under Art. 32 GDPR, including: pseudonymization and encryption of data in transit and at rest, access controls based on the least-privilege principle, multi-factor authentication on critical systems, access logging, periodic backups and recovery tests, staff training, vendor assessment and selection, documented incident-management procedures (data breach) with notification to the Authority within 72 hours where required, pursuant to Art. 33 GDPR.

The Controller adheres, where applicable, to the principles of Directive (EU) 2022/2555 (NIS2), transposed in Italy by Legislative Decree 138/2024.

10. Tracking pixels in communications

In compliance with the Italian DPA guidelines of 17 April 2026 (decision no. 284), any tracking pixels in commercial e-mails are used only with the data subject's explicit consent, given after transparent information on the purposes and recipients of the tracking data. Consent may be withdrawn at any time.

11. Changes to the Notice

This Notice may be updated at any time to reflect regulatory, organizational or technological changes. The current version is always available at www.ricolfi.com/en/privacy-policy.html. Material changes will be notified to data subjects by appropriate means.

Last update: September 2026