Notice on the protection of personal data.

1. Data Controller

The Controller of the personal data collected through the website www.rerspedizioni.com and in the context of business relationships is:

Company name	R&R S.r.l. — Spedizioni Internazionali
Registered office	Viale Padre Santo, 5 — 16122 Genoa (GE), Italy
Operations branch	Via Vienna 2/4 — Interporto CEPIM, 43010 Fontevivo (PR), Italy
Genoa phone	+39 010 8690400
Parma phone	+39 0521 1563501
Email	privacy@rerspedizioni.com

R&R S.r.l. is part of the Ricolfi Group, which also includes Ricolfi & C. S.p.A. (Gricignano d'Aversa), Errelogistica S.r.l. and Ricolfi Group Inc. (Baltimore, USA), which may act as joint controllers or processors depending on the purpose.

2. Categories of data processed

R&R processes the following categories of personal data:

• Identification and contact data: name, surname, company name, address, e-mail, telephone, tax code, VAT number.
• Professional activity data: company role, employer references, industry sector.
• Browsing data: IP address, access logs, session identifiers, device and browser information, as detailed in the Cookie Policy.
• Commercial and contractual data: information contained in orders, quotations, invoices, policies, packing lists, customs documents, manifests.
• Communication data: content of e-mails, call recordings (where notified in advance), professional correspondence.
• Data from CVs and spontaneous applications: education, professional experience, references.

No special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) are processed, except where specific legal requirements arise, communicated on a case-by-case basis.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Management of the contractual relationship (quotations, contracts, performance of freight forwarding, customs clearance and warehousing services)	Art. 6(1)(b) — performance of a contract
Tax, accounting, customs and anti-money-laundering obligations	Art. 6(1)(c) — legal obligation
Service communications relating to the existing relationship	Art. 6(1)(b) — performance of a contract
Direct e-mail marketing of similar services to existing clients (soft opt-in under Art. 130(4) of Italian Legislative Decree 196/2003)	Art. 6(1)(f) — legitimate interest
Newsletters and commercial communications to non-clients	Art. 6(1)(a) — consent
Handling of job applications and recruitment	Art. 6(1)(b) — pre-contractual measures
IT security, fraud prevention, protection of company assets	Art. 6(1)(f) — legitimate interest
Defence of a right in judicial proceedings	Art. 6(1)(f) — legitimate interest

4. Provision of data

Providing data for contractual, legal and accounting purposes is necessary: refusal makes it impossible to establish or perform the relationship. Providing data for marketing purposes is optional: refusal does not affect the use of our services.

5. Recipients of the data

Data may be disclosed to the following categories of recipients, always consistently with the purposes indicated and with adequate contractual safeguards (Arts. 28 and 46 GDPR):

• Ricolfi Group companies (Ricolfi & C. S.p.A., Errelogistica S.r.l., Ricolfi Group Inc.) for internal administrative purposes and operational coordination.
• Carriers, shipping lines, airlines, terminal operators, customs warehouse keepers, shipping agents and foreign correspondents for the performance of the requested services.
• Customs and port authorities, national and foreign tax and administrative bodies, in fulfilment of legal obligations.
• Insurance companies and brokers for the arrangement and management of cargo cover.
• Legal, tax and employment advisors and auditors, bound by professional confidentiality obligations.
• Providers of IT, cloud, hosting, e-mail, management software and antispam services, acting as processors under Art. 28 GDPR.
• Judicial and law-enforcement authorities, solely upon legitimate request.

An up-to-date list of processors is available on request via our contact form.

6. Transfers outside the EU

Given the intrinsic nature of international freight forwarding, data may be transferred to countries outside the European Economic Area (in particular the USA, China, Korea, India, Turkey, Jordan, the United Kingdom and other countries of origin/destination of shipments).

Such transfers take place on the basis of:

• Adequacy decisions of the European Commission (e.g. the EU-US Data Privacy Framework for the USA, decision of 10 July 2023);
• Standard Contractual Clauses (SCC) approved by the Commission with Decision (EU) 2021/914;
• Transfer Impact Assessments (TIA) for countries without an adequacy decision, in light of the Schrems II judgment;
• Derogations under Art. 49 GDPR where applicable (e.g. transfers necessary for the performance of the contract).

7. Retention period

Category	Retention
Contractual and tax data	10 years from the end of the relationship (Art. 2220 of the Italian Civil Code, tax legislation)
Customs documentation	Periods set by EU and national customs legislation (normally 3 years from entry in the accounts, without prejudice to extended obligations)
CVs and applications	24 months from receipt, unless withdrawn earlier
Commercial communications to non-clients	Until consent is withdrawn, with a review of interest every two years
Website and system access logs	Maximum 12 months (Italian DPA decision of 27/11/2008 and subsequent measures)
Newsletter	Until the data subject opts out

8. Rights of the data subject

At any time, the data subject may exercise the following rights vis-à-vis the Controller (Arts. 15-22 GDPR):

• Access to their personal data and to the information referred to in Art. 15 GDPR.
• Rectification of inaccurate data and completion of incomplete data (Art. 16).
• Erasure ("right to be forgotten") in the cases provided for by Art. 17.
• Restriction of processing in the cases referred to in Art. 18.
• Portability of the data provided, in a structured, machine-readable format (Art. 20).
• Objection to processing based on legitimate interest or for direct marketing purposes (Art. 21).
• Not to be subject to automated decision-making, including profiling, producing legal effects (Art. 22). R&R does not use automated decision-making within the meaning of Art. 22 GDPR and does not employ high-risk AI systems within the meaning of Regulation (EU) 2024/1689 (AI Act).
• Withdrawal of consent, at any time and without affecting the lawfulness of processing based on consent before its withdrawal.
• Complaint to the supervisory authority: Garante per la protezione dei dati personali (the Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.

Requests should be made via the website's contact form. R&R responds within 30 days, extendable by 60 days in complex cases subject to justification (Art. 12 GDPR).

9. Data security

R&R adopts appropriate technical and organisational measures under Art. 32 GDPR, including: pseudonymisation and encryption of data in transit and at rest, access controls based on the least-privilege principle, multi-factor authentication on critical systems, access logging, periodic backups and restore tests, staff training, supplier assessment and selection, and documented incident (data breach) management procedures with notification to the supervisory authority within 72 hours where required, pursuant to Art. 33 GDPR.

Where applicable, the Controller adheres to the principles of Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2555 (NIS2) as transposed in Italy.

10. Tracking pixels in communications

In accordance with the Guidelines of the Italian Data Protection Authority of 17 April 2026 (decision no. 284), any tracking pixels in commercial e-mails are used only with the data subject's explicit consent, given after transparent information on the purposes and recipients of the tracking information. Consent may be withdrawn at any time.

11. Changes to this Notice

This Notice may be updated at any time to reflect regulatory, organisational or technological changes. The current version is always available at www.rerspedizioni.com/privacy-policy. Substantial changes will be notified to data subjects by appropriate means.

Last updated: September 2026