This Privacy Policy governs the processing of technical, commercial, and personal data collected by IOVES SPA ("IOVES", "we", "our") through its digital platforms and corporate communications. In compliance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), we adhere to strict standards of transparency, confidentiality, and data minimization designed to safeguard both enterprise partners and individual users.
1. Data Controller
The entity responsible for processing corporate and personal data is:
- Company Name
- I.O.V.E.S. SPA
- Corporate Headquarters
- Viale dell'Industria, 9 — 32040 Lozzo di Cadore (Belluno), Italy
- VAT / Tax Identification
- IT00054960257
- Corporate Communications
- [email protected] | (+39) 0435 76321
2. Data Processing Principles
Our operational model is built around core manufacturing accountability. In compliance with European standards, all processing activities honor:
- Lawfulness, Fairness, and Transparency: Personal data is processed solely under valid legal bases with clear disclosure to data subjects.
- Purpose Limitation: Collected data is utilized exclusively for agreed business interactions, quotation requests, engineering inquiries, and contract fulfillment.
- Data Minimization: We request only technical, institutional, and commercial details strictly required to evaluate production viability or execute manufacturing agreements.
- Accuracy and Storage Limitation: Records are maintained accurately and held only for periods justified by production cycles, tax documentation, or legal statutes.
- Integrity and Confidentiality: Industrial-grade technical safeguards prevent unauthorized disclosure, safeguarding trade specifications and proprietary OEM frame drawings.
3. Purposes of Processing & Legal Bases
We process information submitted by international optical buyers, distributor representatives, and visitors under distinct legal criteria:
3.1 Processing Inquiries and OEM/Private Label Requests
When prospective clients, eyewear distributors, or retail brands submit technical specs, CAD files, or quotation requests, we collect representative names, business emails, company entities, and order requirements.
Legal Basis: Performance of pre-contractual steps taken at the request of the client (Article 6(1)(b) GDPR).
3.2 Contractual Execution & Industrial Production
Following purchase orders, we process corporate billing details, VAT identifiers, customs delivery coordinates, and designated logistics contacts.
Legal Basis: Fulfillment of legal obligations and contractual delivery execution (Article 6(1)(b) & (c) GDPR).
3.3 Digital Optimization & Technical Analytics
Aggregated telemetry and technical identifiers may be processed to measure web server stability, prevent malicious activity, and optimize user navigation.
Legal Basis: Legitimate interest in maintaining web infrastructure security and explicit consent where analytics cookies are active (Article 6(1)(a) & (f) GDPR).
4. B2B Discretion & Intellectual Property Protection
As a heritage manufacturer operating in Cadore since 1950, IOVES treats client design blueprints, 3D prototypes, material compositions, and branding assets with strict corporate non-disclosure. Technical files submitted for engineering review are never shared with third-party vendors without explicit bilateral OEM non-disclosure agreements (NDAs).
5. Data Retention Schedules
Data is stored in accordance with institutional accounting regulations and contractual necessity:
- Procurement & Inquiries: Unconverted commercial briefs and contact records are archived or securely deleted after 24 months.
- Production & Commercial Contracts: Commercial invoices, shipping manifests, and technical declarations of conformity are maintained for 10 years to satisfy Italian statutory commercial code and CE/ISO medical device compliance.
- Server Logs: Temporary security access logs are recycled within standard 90-day maintenance windows.
6. Authorized Processors & Service Providers
To ensure high manufacturing efficiency and reliable digital operations, specific trusted third parties act as authorized data processors:
- Enterprise Hosting: Certified European cloud infrastructure maintaining encrypted databases.
- Freight & Logistics Partners: International courier and customs brokers receiving shipping consignments and export documentation.
- Financial & Legal Counsel: Certified Italian public accounting firms and legal consultants assisting with international cross-border compliance.
7. Cross-Border Transfers
IOVES maintains all primary corporate databases within the European Economic Area (EEA). When logistics coordination requires transmission of shipment details to non-EEA destination jurisdictions (e.g., global logistics hubs), such transfers are governed by European Commission Standard Contractual Clauses (SCCs) or applicable international adequacy frameworks.
8. Statutory Data Subject Rights
Under Chapter III of the GDPR, authorized business contacts and individuals possess full statutory rights regarding their personal records:
- Right of Access (Art. 15): Obtain confirmation regarding whether personal data concerning you is being processed.
- Right to Rectification (Art. 16): Request correction of inaccurate company contact details or outdated specifications.
- Right to Erasure (Art. 17): Request deletion of records no longer required for statutory accounting or contract defense.
- Right to Restriction (Art. 18): Restrict active processing pending inquiry resolution.
- Right to Data Portability (Art. 20): Receive your technical and inquiry records in an interoperable, structured format.
- Right to Object (Art. 21): Object at any time to communications based on legitimate commercial interest.
Requests can be submitted directly to our Compliance Officer at [email protected].
9. Technical & Organizational Security
We deploy robust multi-layered perimeter defenses, encrypted HTTPS protocols (TLS 1.3), controlled physical access to our manufacturing plant in Lozzo di Cadore, and strict authorization workflows to prevent unauthorized inspection, breach, or destruction of commercial information.
10. Regulatory Authority & Updates
If you believe our data processing does not comply with applicable regulations, you have the right to lodge a complaint with the competent supervisory authority: Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy) or your national European Data Protection Authority.
IOVES SPA reserves the right to revise this Privacy Policy to reflect changing industrial regulations or evolving corporate workflows. Revisions will be published on this URL with an updated effective date.