Privacy Policy for the website www.nature4.org pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Last updated: October 5, 2026.

This Privacy Policy describes how personal data is processed when users visit the website www.nature4.org (hereinafter, the “Website”) and when they submit a request through the contact form.

The Website is intended for informational and showcase purposes only: it does not allow online purchases and does not require users to create an account.

The Data Controller is Nature 4.0 SB SRL, Società Benefit, with its registered office at Via della Chimica, 7, 01100 Viterbo (VT), Italy, VAT No. 02507200224.

For any questions regarding the processing of personal data, or to exercise the rights described below, you may contact us at: massi@nature4.org.

The Data Controller has not appointed a Data Protection Officer (DPO), as the mandatory requirements set out in Article 37 of the GDPR do not apply.

For any request, you may contact the Data Controller directly at the address indicated in Section 1.

3.1 Browsing Data

The IT systems and platforms used to operate the Website, provided by Wix.com Ltd. (see Section 7), automatically collect certain data whose transmission is implicit in the use of Internet communication protocols (such as IP address, browser and device type, operating system, pages visited, and date and time of access).

This data is collected in aggregated and anonymous form for statistical and security purposes and is not used by the Data Controller to identify users. However, by its nature, such data could potentially allow users to be identified through processing and cross-referencing with data held by third parties.

​

3.2 Data Voluntarily Provided Through the Contact Form

If the user chooses to complete the contact form, the following data may be processed:

• first name and email address (mandatory fields);

• last name, telephone number, country, company, and postal address (optional fields);

• any other information the user chooses to include in the message.

Users are asked not to include special categories of personal data in their messages (such as health data, political opinions, or religious beliefs), as such information is not necessary to respond to their requests.

Personal data that users choose to submit through the contact form (first name, email address and, where provided, last name, telephone number, country, company and postal address) is processed by Nature 4.0 SB SRL solely for the purpose of responding to requests received and providing the information requested.

This processing is based on the data subject’s consent, given when the form is submitted, pursuant to Article 6(1)(a) of the GDPR. Where the request concerns information about the Data Controller’s products or services and may lead to the conclusion of a contract, the processing is also based on the performance of pre-contractual measures taken at the data subject’s request, pursuant to Article 6(1)(b) of the GDPR.

Browsing data, collected automatically by the platform hosting the Website, is processed to ensure its proper technical operation and security. In this case, the legal basis for processing is the Data Controller’s legitimate interest in ensuring a stable service and protecting the Website against unlawful use, pursuant to Article 6(1)(f) of the GDPR.

Providing a first name and email address is mandatory in order to receive a response; without this information, the request cannot be submitted.

Providing any other personal data is optional, and failure to provide such information will not affect the ability to respond to the request.

Submitting the contact form requires acceptance of this Privacy Policy. Consent may be withdrawn at any time (see Section 10).

Personal data is processed using electronic and IT-based tools, according to procedures strictly related to the purposes specified herein and with appropriate technical and organizational measures designed to ensure the security and confidentiality of the data, in accordance with Article 32 of the GDPR.

Messages submitted through the contact form are received in the Data Controller’s corporate email inbox and are accessible only to personnel who are authorized and appropriately instructed to process personal data.

Personal data is not disclosed or transferred to third parties for their own purposes. It may be communicated to:

• Internal company personnel, authorized to process personal data;

• Wix.com Ltd. and its affiliated companies, as providers of the platform hosting the Website and managing the contact form, appointed as Data Processors pursuant to Article 28 of the GDPR;

• IT and email service providers supporting the activities of the Data Controller, also appointed as Data Processors, as well as professional advisors, where necessary;

• Public authorities, where disclosure is required by law.

Wix.com Ltd. is headquartered in Israel and uses affiliated companies and sub-processors located outside the European Economic Area (EEA), including, for example, in the United States. Such transfers are carried out on the basis of the safeguards provided for under Articles 45 and 46 of the GDPR, such as European Commission adequacy decisions or Standard Contractual Clauses approved by the European Commission, as specified in the data processing agreements provided by the service provider.

Personal data provided through the contact form is retained for as long as necessary to handle the request and for an additional 36 months, in order to respond to any subsequent communications. If the request results in a contractual relationship, the data will be retained for the duration of the relationship and thereafter for the period required by applicable law (including, for example, accounting and tax obligations) and for the protection of the Data Controller’s rights.

Once these retention periods have expired, the data will be deleted or anonymized.

Browsing data is retained by the platform provider for the periods specified in its applicable policies.

Data subjects may exercise, at any time, the following rights provided for under Articles 15–22 of the GDPR:

• Right of access to their personal data and information concerning its processing (Article 15);

• Right to rectification of inaccurate data or completion of incomplete data (Article 16);

• Right to erasure of personal data, where the applicable conditions are met (Article 17);

• Right to restriction of processing, where the applicable conditions are met (Article 18);

• Right to data portability of the data provided, in a structured and machine-readable format (Article 20);

• Right to object to processing based on the legitimate interest of the Data Controller (Article 21);

• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given prior to its withdrawal (Article 7(3)).

Requests should be sent to massi@nature4.org. The Data Controller will respond without undue delay and, in any event, within one month of receiving the request. This period may be extended by up to two additional months in cases of particular complexity.

To protect data subjects, the Data Controller may request information necessary to verify the identity of the person making the request.

If the data subject believes that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with the competent supervisory authority, which in Italy is the Italian Data Protection Authority (Garante per la protezione dei dati personali), located at Piazza Venezia 11, 00187 Rome, Italy, or to bring legal proceedings before the competent judicial authority.

The Data Controller does not carry out solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects data subjects, within the meaning of Article 22 of the GDPR.

The Website is intended for adults and professional users. The Data Controller does not knowingly collect personal data relating to minors. If the Data Controller becomes aware that it has received such data, it will take steps to delete it.

The Website contains an embedded video provided by a third-party platform and links to the Data Controller’s social media channels.

Links to social media platforms are provided solely as links: the Data Controller does not receive any data from users until they access the relevant social media platform. Once on the social media platform’s website, the privacy and cookie policies of the relevant provider apply, and the provider acts as an independent data controller.

Similarly, playing the embedded video may involve the transmission of certain data (such as the user’s IP address) and the installation of cookies by the platform providing the video. For further information, please refer to the Cookie Policy and the privacy notices of the relevant platform.

The Data Controller may update this Privacy Policy, for example, in response to changes in applicable legislation or in the services used. The version currently in force is always the one published on this page, together with the date of the most recent update.