Personal Data Processing Notice
This notice describes how AS Aston Seals S.p.A. processes the personal data of users who visit https://astonseals.com/en/, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Italian law.
1. Data Controller
AS Aston Seals S.p.A.
Via San Giacomo 43
41012 Carpi (MO), Italy
Email for privacy enquiries and the exercise of data protection rights: SSerri@astonseals.com
No Data Protection Officer (DPO) is currently identified in this notice, as no formal appointment has been communicated.
2. Data processed
When users browse the website, the following categories of data may be processed:
- browsing and technical data, such as IP address, date and time of the request, requested page, response status and information about the browser, device and operating system;
- cookie preferences and consent data;
- data provided voluntarily by email or through other contact channels outside the website;
- security data, including technical logs concerning login attempts, anomalies and potentially harmful activity.
The website does not currently publish Contact Form 7 forms and does not collect data through such forms.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the website and its content and ensuring correct operation | Steps requested by the user and the Controller’s legitimate interest in operating the website |
| Responding to requests voluntarily sent by email or through other channels | Pre-contractual measures, performance of a contract or the legitimate interest in responding |
| Protecting the website and preventing abuse, fraud and unauthorised access | The Controller’s legitimate interest in the security of systems and data |
| Storing cookie preferences and demonstrating the choices made | Compliance with legal obligations |
| Activating non-essential content or services, such as YouTube videos, after the user’s choice | Consent |
| Complying with legal obligations or requests from public authorities | Compliance with a legal obligation |
4. Cookies and consent management
The website uses Complianz to collect and record user preferences and to block non-essential services until consent is given. Users may reject non-essential cookies and subsequently change their preferences through the banner or the relevant control available on the website.
Detailed information about cookies, detected services and their duration is provided in the Cookie Policy (EU), which forms an integral part of this notice.
5. Third-party content and links
YouTube
Some pages contain videos hosted by YouTube, a Google service. A connection to the service and any transfer of data to Google take place only after the user has consented and activated the content. Google processes data according to its Privacy Policy. Users can continue browsing the page without activating the video.
Social media links and other external websites
The website may contain ordinary links to social networks or third-party websites. Merely loading an Aston Seals page does not activate those services. Data may be communicated to the external operator only when the user chooses to follow the link. From that point, the external operator’s terms and privacy notice apply.
Michelin/NAVEX whistleblowing system
The whistleblowing link leads to the Michelin Group Ethics Line, hosted on the NAVEX platform. Reports are sent directly to Michelin through the external service: Aston Seals neither receives nor processes the data entered in a report. Before using the service, users should read the Michelin Group Alert System Data Protection Policy.
6. Security, logs and backups
The website uses security tools, including Wordfence, which may process IP addresses, technical information and event logs in order to detect and block unauthorised access, attacks and other harmful activity.
The website and its technical data are hosted by an external hosting provider, which processes data on behalf of the Controller in accordance with the instructions received and the applicable contractual terms.
Backup copies may be created to ensure system availability and recovery. Under the current configuration, backups are performed manually and stored on the website server until they are replaced or manually deleted. Access is restricted to authorised persons.
7. Recipients of personal data
To the extent necessary for the purposes described above, data may be processed by:
- personnel and collaborators authorised by the Controller;
- the hosting and technical support provider;
- IT, security and maintenance service providers;
- professional advisers, where necessary;
- public or judicial authorities where required by law.
Providers that process personal data on behalf of Aston Seals are appointed as processors under Article 28 GDPR where required. An up-to-date list of processors may be requested from the Controller.
8. Transfers to third countries
If the use of a provider involves transferring personal data outside the European Economic Area, the transfer will take place in accordance with Articles 44 et seq. GDPR, based on a European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses, supplemented by additional measures where necessary.
Processing carried out on external websites voluntarily accessed by the user, including YouTube and Michelin/NAVEX, is governed by the privacy notices of the respective controllers.
9. Retention periods
- technical and security logs: for the time necessary to ensure security, detect anomalies and document incidents, unless further retention is required by law or necessary to protect legal rights;
- consent preferences: for the period stated in the Cookie Policy and, in any event, for the time required to demonstrate the user’s choice;
- requests received by email: for the time required to respond and subsequently in accordance with any contractual, administrative or legal obligations;
- backups: until they are replaced or manually deleted, subject to recovery, security or statutory retention requirements.
At the end of the relevant periods, data is erased or anonymised unless it must be retained for the establishment, exercise or defence of legal claims.
10. Whether providing data is mandatory
Providing the browsing data required for the website to operate is necessary in order to use it. Consent to non-essential cookies and services is optional: refusal does not prevent access to ordinary content, but external content such as videos may remain unavailable.
11. Data subject rights
Where provided for by the GDPR, data subjects may ask the Controller for:
- access to their personal data;
- rectification of inaccurate data and completion of incomplete data;
- erasure of personal data;
- restriction of processing;
- data portability, where applicable;
- objection to processing based on legitimate interests;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to SSerri@astonseals.com. Before responding, the Controller may request the information necessary to verify the applicant’s identity.
12. Complaint to the supervisory authority
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it. The right to seek a judicial remedy remains unaffected.
13. Automated decision-making
The website does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.
14. Changes to this notice
This notice may be updated following legal, organisational or technical changes. The updated version will be published on this page.
Last updated: 5 August 2026.