Privacy notice
Notice pursuant to Article 13 of Regulation (EU) 2016/679 ("Regulation") for the website mosibbox.com. In case of discrepancy, the Italian version prevails.
1. Data controller
The controller of the personal data collected through the website mosibbox.com is:
MOSI S.r.l.
Via Statale 116, 42013 Sant'Antonino di Casalgrande (RE), Italy
Tax code and VAT number 02643460351
For any request concerning the processing of personal data and to exercise the rights described in section 7, please write to privacy@mosibbox.com. For business enquiries, info@mosibbox.com remains available.
The controller has not appointed a Data Protection Officer (DPO), as none of the cases requiring an appointment under Article 37 of the Regulation applies.
2. Data processed, purposes and legal bases
MOSI processes personal data only for the purposes listed below, each with its own legal basis under Article 6 of the Regulation.
| Purpose | Data processed | Legal basis |
|---|---|---|
| Replying to a consultation request sent through the form on the Contacts page | Name and surname, email, phone, company or organisation, role, type of structure, need, message, language of the site used | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b)) |
| Sending the datasheets requested through the dedicated form | Name and surname, company or organisation, email, language of the site used | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b)) |
| Handling correspondence sent to the email addresses published on the site | Email address and data contained in the message | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest in replying to messages received (Art. 6(1)(f)) |
| Ensuring the operation and security of the site | Browsing data: IP address, browser type, pages requested, date and time, technical cookies | Legitimate interest in security and in the proper delivery of the service (Art. 6(1)(f)) |
| Producing aggregate, anonymous statistics on site use | Page visited, referrer, device type, country; no cookies and no persistent identifiers | Legitimate interest in improving the site (Art. 6(1)(f)) |
| Measuring the effectiveness of Google Ads campaigns | Google cookies and advertising identifiers, ad click identifier (gclid) associated with any request sent | Consent of the data subject (Art. 6(1)(a) and Art. 122 of the Italian Privacy Code), which can be withdrawn at any time |
| Knowing where the requests received come from | Campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_term, utm_content) associated with the request | Legitimate interest in assessing the channels that generate requests (Art. 6(1)(f)) |
| Documenting the choices made about cookies | Date and time of the choice, preferences expressed, banner and notice version, random browser identifier; no IP address | Obligation to demonstrate consent (Art. 6(1)(c) in connection with Art. 7(1)) |
| Establishing, exercising or defending legal claims | Relevant data among those listed above | Legitimate interest (Art. 6(1)(f)) |
Use of form data. Data sent through the forms are used solely to reply to the request and to manage any resulting business relationship. MOSI does not use them for newsletters or unsolicited promotional communications and does not share them with third parties for marketing purposes. The data are not stored in a database of the site: they reach the company mailbox by email.
Click identifier (gclid). When a visitor reaches the site from a Google Ads ad, the page address contains a click identifier. The site associates it with the request sent only if the visitor has consented to marketing cookies.
Legitimate interest. In the cases indicated, MOSI has assessed that its interest in the security of the site, in improving it and in knowing which channels generate requests does not override the rights of the data subject, since the processing is limited, expected by anyone visiting a company website and, for statistics, free of persistent identifiers. The data subject may object at any time as described in section 7.
Automated decision-making. The data are not subject to decisions based solely on automated processing, including profiling, producing legal effects on the data subject.
Minors. The site is addressed to companies, organisations and professionals and is not intended for persons under 18.
3. Provision of data
In the forms, the fields marked as mandatory are needed to reply to the request: without them MOSI cannot follow up on the contact or send the datasheets. The optional fields (phone, company or organisation, role, message in the Contacts form) help provide a more relevant reply, and leaving them empty does not prevent sending.
Consent to marketing cookies is optional: refusing it does not limit browsing or the use of the forms in any way.
4. Recipients of the data
Within MOSI, data are processed by authorised and instructed staff pursuant to Article 29 of the Regulation, only as far as necessary to handle requests.
MOSI also relies on the following categories of providers, appointed as processors under Article 28 of the Regulation, unless otherwise stated.
| Category of recipients | Activity | Role | Location |
|---|---|---|---|
| Hosting and cloud infrastructure providers | Hosting of the site and its database, content delivery, protection against malicious traffic, technical processing of the forms | Processors; the hosting platform provider also processes certain technical operating data as an independent controller | European Union and United States |
| Email service providers | Sending, forwarding and storing the emails generated by the forms and the correspondence received | Processors | European Union and United States |
| MOSI's IT service provider | Administration of company systems and email | Processor | Italy |
| Web analytics provider (Plausible Analytics) | Aggregate site usage statistics, without cookies | Processor | European Union |
| Google Ireland Limited | Conversion measurement for Google Ads campaigns, only with consent | Independent controller | Ireland, European Union |
Data may also be disclosed to consultants and professionals assisting MOSI, for example in legal, tax or technical matters, where necessary to manage the relationship, and to the competent authorities where required by law.
The updated list of processors can be requested by writing to privacy@mosibbox.com. The data are not disseminated.
5. Transfers outside the European Union
Some of the providers listed in section 4, in particular hosting and cloud infrastructure providers and email providers, as well as Google for advertising services, are based in the United States or process part of the data there. These transfers take place on the basis of one of the safeguards provided for in Chapter V of the Regulation:
- adequacy decision of the European Commission for providers certified under the EU-U.S. Data Privacy Framework (Art. 45);
- standard contractual clauses approved by the European Commission with Implementing Decision (EU) 2021/914, supplemented where necessary by additional measures (Art. 46).
A copy of the safeguards adopted can be requested by writing to privacy@mosibbox.com.
6. Retention periods
| Data | Period |
|---|---|
| Requests sent through the forms or by email, without a contract following | 24 months from the last contact, then deleted |
| Requests leading to a contract | For the duration of the relationship and then for 10 years, as required by civil and tax obligations (Art. 2220 of the Italian Civil Code) |
| Browsing data and technical logs | For the time strictly necessary for the security of the service, according to the policies of the providers listed in section 4 |
| Usage statistics | Kept only in aggregate, anonymous form |
| Cookie choices | The preference remains stored in the browser for 6 months; the record of choices is kept for 24 months from the date of the choice, as evidence |
| Google marketing cookies | According to the durations stated in the Cookie policy |
Data may be kept longer only where necessary to establish, exercise or defend legal claims, for the time strictly necessary.
7. Rights of the data subject
At any time, data subjects may exercise the rights provided for in Articles 15 to 22 of the Regulation:
- access to their data and to information on the processing (Art. 15);
- rectification of inaccurate data or completion of incomplete data (Art. 16);
- erasure of the data, where applicable (Art. 17);
- restriction of processing (Art. 18);
- portability of the data provided, for processing based on consent or contract and carried out by automated means (Art. 20);
- objection to processing based on legitimate interest, on grounds relating to their particular situation (Art. 21);
- withdrawal of consent to marketing cookies at any time, through the "" link at the bottom of every page, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)).
Requests should be sent to privacy@mosibbox.com. MOSI replies without undue delay and in any case within one month of receipt; this period may be extended by two further months for complex or numerous requests, informing the data subject within the first month (Art. 12(3)). To handle the request, MOSI may ask for information needed to verify the requester's identity.
Complaint. Anyone who considers that the processing of their data infringes the Regulation may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, garanteprivacy.it, PEC protocollo@pec.gpdp.it, or with the supervisory authority of the Member State of their habitual residence or place of work, or bring the matter before the courts.
8. Changes to this notice
MOSI may update this notice to reflect regulatory, organisational or service changes. The version in force is always published on this page, with the date of the last update. If the changes concern cookies subject to consent, the banner is shown again to visitors.
Last updated: 21 October 2026