COOKIE POLICY

BAMBINI S.r.l., (Tax Code and VAT No.: 02578750347) (hereinafter “BAMBINI”), in the person of its pro tempore legal representative, with registered office in Reggio Emilia, via A. Gramsci, 54/S, in its capacity as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), sets out below the cookie policy (Policy) applicable to this website (Website).

1. Legal framework of reference.

1.1. The Policy is based on the following EU and/or national regulatory provisions (first and/or second level): (i) Directive No. 2002/58/EC of 12 July 2012 (the so-called ePrivacy Directive), as amended by Directive No. 2009/136/EC; (ii) Article 122 of the amended Legislative Decree No. 196/2003 (Privacy Code), which transposed the ePrivacy Directive into national law; (iii) GDPR: Articles 4(11), 7, 12, 13, 25 and 95 (in addition, in particular, to Recitals 30, 32 and 173); (iv) Guidelines No. 5/2020 adopted on 4 May 2020 by the EDPB, replacing the Guidelines of 10 April 2018 signed by WP Art. 29; (v) Provision No. 231 of 10 June 2021 [web doc. No. 9677876] signed by the Italian Data Protection Authority (Garante Privacy); (vi) Recommendation No. 2/2001 of the WP Art. 29; (vii) Opinion No. 2/2010 of WP Art. 29; (viii) Opinion No. 4/2012 of WP Art. 29; (ix) Guidelines No. 8/2020 of the EDPB; (x) Measures No. 224 of 9 June 2022 [web doc. no. 9782890], no. 243 of 7 July 2022 [web doc. no. 9806053] and no. 254 of 21 July 2022 [web doc. no. 9808698] signed by the Data Protection Authority.

2. Cookies and other tracking tools: definition and classification.

2.1. Cookies are, as a rule, strings of text that a website (‘publisher’ or ‘first party’) visited by the user or a different website (‘third party’) places and stores, directly (in the case of the first-party website) or indirectly (through the latter, in the case of the third-party website), on a terminal device available to the user. In this regard, the Data Protection Authority has specified that the information encoded in cookies may include both personal data pursuant to Article 4(1) of the GDPR (e.g. IP address, username; email address; unique identifier) and non-personal data pursuant to Article 3(1) of EU Regulation No. 1807/2018 (e.g. language; type of device used).

Alongside (or in addition to) these, there may be (and therefore be used) ‘other tracking tools’, which can be divided into ‘active’ (which have almost the same characteristics as cookies) and ‘passive’ (e.g. fingerprinting).

2.2. Beyond the intrinsic characteristics described above, cookies (and other tracking tools) may have different characteristics in terms of time (and therefore be considered ‘session’ or “permanent” , depending on their duration), from a subjective point of view (depending on whether the publisher acts independently or on behalf of a “third party”) and, finally (but in particular), based on the purpose of the processing pursued, so that they can be divided into two different (macro) categories:

• “technical”, used for the sole purpose of “carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary for the provider of an information society service explicitly requested by the contractor or user to provide that service” (Article 122(1) of the Privacy Code).

In this regard, the Privacy Guarantor has highlighted, in Provision no. 231 of 10.6.2021 (in line with the previous Provision on the subject of 2014), that “analytics cookies” may well be included within the scope of cookies (or other tracking tools) of a “technical” nature (and, therefore, may be used without the prior consent of the data subject), under certain conditions, aimed at precluding the possibility that their use could lead to the direct identification of the data subject (single out) .

• “profiling”/”marketing” cookies (so-called non-technical cookies), used to trace specific actions or recurring behavioural patterns in the use of the features offered (patterns) back to specific, identified or identifiable individuals, in order to group the various profiles into homogeneous clusters of varying sizes, so that the Data Controller can, , among other things, to tailor the provision of the service in an increasingly personalised manner beyond what is strictly necessary for the provision of the service, as well as to send targeted advertising messages (i.e., in line with the preferences expressed by the user when browsing the web).

3. Cookies installed on the Website.

3.1. The following types of cookies have been installed (or may be installed, subject to obtaining the user’s specific consent) on the Website:

4. Browser settings.

4.1. BAMBINI highlights the possibility for the user to delete and block the operation of the cookies described in Article 3 above at any time by using the appropriate settings within the browser used: in this regard, BAMBINI adds that, if the user decides to disable the technical cookies referred to in Article 2.2. point i), the quality and speed of the services and features offered and made available on the Website may deteriorate.

Information on how to manage cookies with some of the most popular browsers can be found on the following web pages:

https://support.google.com/chrome/answer/95647?hl=it

https://support.mozilla.org/it/kb/Gestione%20dei%20cookie?redirectlocale=enUS&redirectslug=Cookies

https://support.microsoft.com/it-it/help/17442

https://support.microsoft.com/it-it/help/4468242/microsoft-edge-browsing-data-and-privacy-microsoft-privacy

https://support.apple.com/it-it/guide/safari/sfri11471/mac

https://support.apple.com/it-it/HT201265

https://help.opera.com/en/latest/security-and-privacy/#clearBrowsingData

Furthermore, BAMBINI indicates below the main web pages of the third parties described in Article 3 above:

https://www.cookiebot.com

https://www.youtube.com

https://www.google.com

https://www.linkedin.com

https://it-it.facebook.com/

5. Rights of the data subject.

5.1. With regard to the user’s personal data, BAMBINI informs that the data subject pursuant to Article 4(1) of the GDPR has the right to exercise the following rights, which may be subject to the limitations provided for in Articles 2-undecies and 2-duodecies of the Privacy Code: right of access pursuant to Article 15 of the GDPR: the right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, storage period); right to rectification pursuant to Article 16 of the GDPR: the right to correct, update or supplement personal data; right to erasure pursuant to Article 17 of the GDPR: right to obtain the erasure or destruction or anonymisation of personal data, where the conditions listed in the same article are met; right to restriction of processing pursuant to Article 18 of the GDPR: right with a markedly precautionary connotation, aimed at obtaining the restriction of processing where the conditions governed by Article 18 itself are met; right to data portability pursuant to Article 20 of the GDPR: the right to obtain personal data provided to the joint controllers in a structured, commonly used and machine-readable format (and, where requested, to transmit them directly to another data controller), where the specific conditions indicated in the same article are met (e.g. legal basis of consent and/or performance of a contract; personal data provided by the data subject); right to object pursuant to Article 21 of the GDPR: right to obtain the permanent cessation of a specific processing of personal data; right to lodge a complaint with the Supervisory Authority (i.e., the Italian Data Protection Authority) pursuant to Article 77 of the GDPR: right to lodge a complaint where it is believed that the processing under analysis violates national and EU legislation on the protection of personal data. 

5.2. In addition to the rights described in Article 5.1 above, BAMBINI specifies that, in relation to the personal data of the data subject, there is, where possible and appropriate, the right to exercise, on the one hand, the (sub) right provided for in Article 19 of the GDPR (“The controller shall communicate any rectification or erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall communicate those recipients to the data subject upon request”), which is to be considered connected and related to the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, BAMBINI specifies that, in relation to the personal data of the data subject, where possible and appropriate, the right provided for in Article 22(1) of the GDPR (“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”), subject to the exceptions provided for in paragraph 2 below.

5.3. In accordance with Article 12(1) of the GDPR, BAMBINI undertakes to provide the user with the communications referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other electronic means or, at the user’s request, shall be provided orally, provided that the user’s identity is verified by other means.

5.4. In accordance with Article 12(3) of the GDPR, BAMBINI informs that it undertakes to provide the user with information regarding the action taken in response to a request pursuant to Articles 15 to 22 of the GDPR without undue delay and, in any case, no later than one month after receipt of the request; this period may be extended by two months if necessary, taking into account the complexity and number of requests (in this case, the joint controllers undertake to inform the user of this extension and the reasons for the delay within one month of receiving the request).

5.5. The user may exercise the above rights at any time (with the exception of the right under Article 77 of the GDPR) by using the contact details provided in Article 6.

6. Contact details.

6.1. BAMBINI can be contacted at the following address:bambinisrl@legalmail.com

6.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by BAMBINI, can be contacted at the following address:dpo@educademi.org

Reggio Emilia (RE), 27 February 2026 (date of last update).

BAMBINI S.r.l.

(in the person of its pro tempore legal representative)