Privacy Policy
Last updated: 17 September 2026
This notice describes the processing of personal data carried out through the website panarubox.com (the “Site”), pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and applicable Italian law.
This notice concerns browsing the Site, sending enquiries through the contact form and, subject to consent, receiving promotional communications and measurement and remarketing activities. It does not concern the subsequent processing related to the confirmation and fulfillment of orders, which is governed by a separate notice.
1. Data controller
The data controller is:
SAGEXIA SRL
Via Resistenza Partigiana 31A, 97015 Modica (RG), Italy
VAT No. 01809990888
Email: info@panarubox.com
Requests concerning the protection of personal data may be sent to the address above.
2. Personal data processed
2.1 Data provided through the contact form
The form collects:
- required fields: full name, company, email address, box of interest, requirements or message content;
- optional fields: phone number and indicative quantity.
Users are asked not to enter into the free-text field any data belonging to special categories, such as information relating to health, religious or political beliefs, ethnic origin, biometric data or other data not necessary for the enquiry.
The data submitted is not stored in the WordPress database: the form sends it to the company mailbox info@panarubox.com, managed through the Aruba email service.
2.2 Data relating to promotional consent
If the user ticks the optional marketing box, the date, time, IP address, source and version of the consent text are recorded, in order to document the choice made. Proof of consent is kept in the email received through Aruba.
For sending newsletters, only name, company and email address are shared with Brevo. The phone number, if provided, is not added to the Brevo list and may be used directly by the controller for promotional communications by phone or WhatsApp only where the same consent is present.
2.3 Browsing data
The IT systems that enable the Site to operate may acquire technical data such as IP address, date and time of the request, page requested, response outcome, browser type, operating system and device information. This data is processed to enable browsing, ensure the security of the Site and diagnose any anomalies.
2.4 Cookies and tracking tools
The Site uses technical cookies and, only after the user’s consent, analytics and advertising tools provided by:
- Google Analytics 4, for statistics on the use of the Site;
- Google Ads, for advertising and remarketing activities;
- Meta Pixel, for advertising and remarketing activities on Meta platforms;
- LinkedIn Insight Tag, for advertising and remarketing activities on LinkedIn.
Cookie preferences are collected and managed through CookieYes. Non-technical tools remain disabled until consent is given. Users can change or withdraw their preferences at any time through the “Manage cookie preferences” command available on the Site.
Up-to-date information on individual cookies, their durations and providers is available in the Cookie Policy accessible from the banner and the footer of the Site.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Enable the operation, security and correct delivery of the Site | Legitimate interest of the controller in making the Site available and protecting it, Art. 6(1)(f) GDPR; for technical cookies, the special rules on electronic communications apply |
| Respond to enquiries and prepare information or proposals requested by the user | Performance of pre-contractual measures taken at the data subject’s request, Art. 6(1)(b) GDPR |
| Send promotional communications about PANARU BOX by email, phone and WhatsApp | Consent of the data subject, Art. 6(1)(a) GDPR |
| Document consent or its withdrawal | Compliance with the accountability and demonstration obligations under the GDPR, Art. 6(1)(c) GDPR |
| Produce statistics through Google Analytics 4 | Consent of the data subject, Art. 6(1)(a) GDPR |
| Carry out advertising measurement and remarketing through Google Ads, Meta Pixel and LinkedIn Insight Tag | Consent of the data subject, Art. 6(1)(a) GDPR |
Consent to marketing and tracking tools is optional, may be refused without any consequence for submitting the form, and can be withdrawn at any time.
4. Nature of the provision of data
Providing the data marked as required in the form is necessary to identify the enquiry and enable the controller to respond. Without this data it will not be possible to send or handle the enquiry.
Providing the phone number and quantity is optional. Consent to promotional communications is also optional and does not affect the ability to contact PANARU BOX or receive a reply.
5. Processing methods and security
Data is processed using electronic tools in accordance with the principles of lawfulness, fairness, transparency, data minimization and storage limitation. The controller adopts technical and organizational measures appropriate to the risk, limits access to the data and uses secure connections for transmitting information.
The mailbox info@panarubox.com is accessible only to the administrator of Sagexia Srl, save for any subsequent authorizations formalized by the controller.
6. Recipients of the data
To the extent necessary for the purposes described, the data may be processed or received by:
- Aruba S.p.A., for hosting of the Site and email;
- Brevo, for managing the list and sending newsletters;
- CookieYes, for collecting and managing cookie preferences;
- Google, for Google Analytics 4 and Google Ads;
- Meta Platforms, for Meta Pixel and related advertising activities;
- LinkedIn, for LinkedIn Insight Tag and related advertising activities;
- technical providers responsible for the maintenance or security of the Site, where necessary;
- commercial collaborators or producers involved in preparing the proposal requested by the user, limited to strictly necessary information.
These parties act, according to the role actually performed, as data processors pursuant to Art. 28 GDPR or as independent controllers. An up-to-date list of processors can be requested from the controller.
Personal data is neither disclosed nor transferred to third parties for their own purposes unrelated to those described.
7. Transfers to countries outside the European Economic Area
The use of Brevo, CookieYes, Google, Meta and LinkedIn may involve access to or transfer of data to countries outside the European Economic Area, including through sub-processors.
Where applicable, such transfers are carried out on the basis of an adequacy decision of the European Commission, the recipient’s membership of the EU-US Data Privacy Framework, the Standard Contractual Clauses approved by the European Commission or another safeguard provided for by Articles 44 et seq. of the GDPR.
The data subject may ask the controller for information on the safeguards used for the transfer of their data.
8. Retention periods
- Enquiries received through the form: up to 12 months from the last contact, unless further retention is necessary to handle a dispute or fulfill a request from the data subject.
- Data processed for promotional communications: up to 12 months from consent or from the last relevant interaction, unless withdrawn earlier.
- Proof of consent and withdrawal: for as long as necessary to demonstrate compliance with the obligations set out in the GDPR and to protect the controller’s rights; after withdrawal, only the minimum data necessary to document it and prevent further sending may be retained.
- Technical data and security logs: for the period strictly necessary for the operation and security of the Site, according to the configurations and timeframes applied by the hosting provider.
- Cookies and online identifiers: for the durations indicated in the Cookie Policy and in the preferences management panel.
Upon expiry, data is deleted or anonymized, unless further retention is required by law or needed to protect a right.
9. Withdrawal of consent
Users can withdraw consent to promotional communications using the unsubscribe link included in each newsletter. Since consent jointly covers email, phone and WhatsApp, unsubscribing results in the full withdrawal of promotional communications across all three channels.
Withdrawal does not affect the lawfulness of processing carried out before it. Preferences relating to cookies, analytics and remarketing can be changed separately through the “Manage cookie preferences” command.
10. Profiling and automated decision-making
Subject to consent, Google Ads, Meta Pixel and LinkedIn Insight Tag may use online identifiers and browsing data to include the user in audience segments and show them advertising communications about PANARU BOX after visiting the Site.
The controller does not use such information to make solely automated decisions that produce legal effects or similarly significantly affect the data subject.
11. Rights of the data subject
In the cases provided for by the GDPR, the data subject may ask the controller for:
- access to their personal data;
- rectification of inaccurate data or completion of incomplete data;
- erasure of the data;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time.
Requests can be sent to info@panarubox.com. The controller responds without undue delay and, as a rule, within one month, save for the extensions permitted by the GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), in accordance with the methods indicated on the website www.garanteprivacy.it.
12. Changes to this notice
The controller may update this notice as a result of regulatory, organizational or technical changes. The current version is published on this page with the relevant update date. In the event of material changes to processing based on consent, a new consent will be requested where necessary.