Privacy Policy

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to users of the website wahuwater.it and to customers and contacts of WAHU S.r.l.

Last updated: 29 September 2026.

1. Data Controller

The Data Controller is WAHU S.r.l., registered office at Via G. Brodolini 4, 47922 Rimini (RN), Italy, VAT and Tax Code 04768000400, represented by its legal representative pro tempore.

  • Email: info@wahuwater.it
  • Certified email (PEC): wahuwater@pec.it
  • Phone: +39 388 996 3253

WAHU has not appointed a Data Protection Officer (DPO). Appointment is not mandatory under Art. 37 GDPR, since WAHU’s core activity does not consist of regular and systematic large-scale monitoring of individuals, nor of large-scale processing of special categories of data.

2. What data we process and where it comes from

We process the data you provide directly and the data we receive through the channels you use to contact us:

  • phone calls to +39 388 996 3253 and e-mails to info@wahuwater.it, including through the “Call” and “Email” buttons on the site (the site has no contact or sign-up forms);
  • “Lead Ads” forms filled in within Facebook or Instagram (Meta): the data you enter is transmitted to us by Meta. For the collection and transmission of these forms, WAHU and Meta normally act as joint controllers under Art. 26 GDPR, under the terms Meta applies to Lead Ads as part of its Business Tools (“Controller Addendum” incorporated in the Meta Business Tools Terms): Meta remains responsible in particular for collecting the form and for platform security, while WAHU is responsible for handling the commercial request it receives, for the legal basis of its own use of the data, and for data-subject rights towards WAHU (WAHU remains the point of contact for these). The essential content of this joint-controller arrangement is made available by Meta to users in its own privacy policy; we invite you to review it. WAHU has not negotiated a specific joint-controller agreement different from Meta’s standard one.
  • messages received on WhatsApp, when you write to +39 388 996 3253 via the site’s WhatsApp button or on your own initiative. WhatsApp is a service of Meta Platforms Ireland Ltd.: the content of the conversation is also governed by WhatsApp’s privacy policy;
  • data you provide to enter into and perform a contract (sale, rental, maintenance), by phone or in person.

The personal data typically processed includes: first and last name or company name, address, city, phone number, email, and, for customers, the data needed for invoicing (tax code, VAT number, bank and payment details).

3. Purposes and legal basis

We process your data for distinct purposes, each with its own legal basis. Purposes a) and b) below do not require your consent; purposes c) and d) do.

a) Responding to requests and arranging the free survey

When you call us, write to us on WhatsApp or by e-mail, or ask us for a free survey or a service visit, we process your data to reply, assess your request and, if you wish, arrange the survey and prepare a quote. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). Providing this data is necessary for us to respond; without it we cannot handle your request.

b) Performance of the contract and legal obligations

If you become a customer (sale, rental or maintenance), we process your data to perform the contract, arrange delivery and installation, manage maintenance, issue invoices and comply with accounting, tax and civil-law obligations. Legal basis: performance of a contract to which you are a party (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)). Providing this data is necessary for the performance of the contract; without it we cannot deliver the service.

c) Marketing communications (only with consent)

If you give us a specific, separate consent, we may send you commercial communications, offers and promotions about our products and services, by email, SMS, WhatsApp or phone. Legal basis: consent (Art. 6(1)(a) GDPR). Consent is optional, does not affect the services described in a) and b), and can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

d) Website statistics and online advertising (cookies and similar tools, only with consent)

If you consent via the site’s cookie banner, we use Google Analytics 4 to obtain aggregate statistics on site traffic, and the Meta Pixel (Facebook/Instagram) to measure the effectiveness of our campaigns and show you relevant ads on Meta’s social networks (remarketing).

The Meta Pixel involves profiling for advertising purposes: based on your browsing on the site (pages viewed, requests submitted), Meta may associate you with a profile used to show you targeted ads, including through “lookalike” audiences built from other users with similar behaviour. This is separate from, and in addition to, purposes a), b) and c): it is only activated if you give specific consent via the cookie banner, and it is always revocable. Legal basis: consent (Art. 6(1)(a) GDPR).

For details on the tools used, their duration, and how to withdraw consent, see the Cookie Policy.

4. First-party statistical measurement (no cookies)

In addition to the third-party tools listed under d), the site uses an internal WAHU visit counter (not a third-party tool), which:

  • does not set any cookie or persistent identifier on your device;
  • never stores your IP address in clear text: the IP is used only for the time needed to compute a fingerprint (hash), calculated by combining the IP with the current date and a secret key generated every day and deleted the following day, never published or shared with third parties: the same person’s fingerprint therefore changes from one day to the next and, once the key is deleted, can no longer be reconstructed, preventing visits on different days from being linked;
  • produces only aggregate counts (visits per page, referral source, unique visitors per day), used exclusively by WAHU to understand how many people visit the site.

Regardless of this counter, like any website, wahuwater.it may generate server-level technical security logs (IP address, time, page requested), handled by the hosting provider Aruba S.p.A. as a data processor under Art. 28 GDPR, for IT security and abuse-prevention purposes (legal basis: legitimate interest, Art. 6(1)(f) GDPR), with a limited retention period under the provider’s standard settings. This processing is distinct from the internal counter described above and is mentioned here for completeness.

Given these features, we consider this tool to fall within the statistical measurement tools assimilated to technical cookies under the Italian Data Protection Authority’s Guidelines of 10 June 2021 on cookies and other tracking tools, and therefore not to require consent: it does not track individuals over time, does not share data with third parties, and produces only aggregate statistics. We disclose it here for transparency. Legal basis: WAHU’s legitimate interest in understanding aggregate site traffic (Art. 6(1)(f) GDPR), balanced by the absence of any impact on your rights given the lack of identifiability.

5. Recipients of the data

Your data may be shared, for the purposes above, with:

  • WAHU staff authorised to process data;
  • technicians of the IM Maioli Impianti Group, for installation and maintenance of the systems, when provided for in the contract;
  • Google Ireland Ltd. (Google Analytics 4, Google Maps);
  • Meta Platforms Ireland Ltd. (Meta Pixel, Lead Ads, WhatsApp);
  • Aruba S.p.A., which hosts the wahuwater.it website;
  • the accountant, consultants and professionals assisting WAHU with administrative, accounting, tax or legal obligations;
  • banks, for payments and collections;
  • public authorities, where required by law.

6. Transfers of data outside the European Union

Google and Meta may also process data in the United States. Both providers adhere to the EU-U.S. Data Privacy Framework, the mechanism recognised by the European Commission as adequate for transfers of personal data to the United States (adequacy decision of 10 July 2023). Where certification does not apply or falls short, transfers are in any case governed by the Standard Contractual Clauses approved by the European Commission. The adequacy decision was upheld by the General Court of the European Union on 3 September 2025 (Case T-553/23, Latombe v Commission); an appeal against that judgment is pending before the Court of Justice (Case C-703/25 P) as of the last update of this notice, without suspending the decision’s effects. You can request further information by writing to info@wahuwater.it.

7. How long we keep your data

Data categoryRetention period
Requests and contacts that do not become a contract (purpose a)24 months from the last contact, then deleted
Customer data and contractual/accounting documents (purpose b)10 years from the end of the relationship, for accounting record-keeping obligations (Art. 2220 of the Italian Civil Code and tax legislation)
Marketing (purpose c)until consent is withdrawn, and in any case no more than 24 months from the last relevant interaction
Statistical and marketing cookies (purpose d)as indicated in the Cookie Policy, and in any case until consent is withdrawn

8. No automated decision-making

WAHU does not carry out any solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). The advertising profiling described under d) is only used to show you more relevant ads and does not produce such effects.

9. Your rights

You may exercise, at any time, the rights set out in Articles 15-22 and 77 GDPR: access to your data, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent. To exercise these rights, write to info@wahuwater.it or send a certified email (PEC) to wahuwater@pec.it. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), or with the supervisory authority of your own EU country of residence, if you believe the processing of your data breaches applicable law.

10. Changes to this notice

This notice may be updated over time. The last update date is shown at the top of this document.