Last updated: October 2026
This policy explains how Eurostar processes the personal data of visitors to www.eurostar.it and of anyone who contacts us or sends a job application through the forms on the website, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”), as amended by Legislative Decree 101/2018.
1. Data controller
EUROSTAR S.R.L.
Registered office: Via Donizetti, 23 – 20122 Milan, Italy
Operational headquarters: Regione Leiso, 86 – 14050 San Marzano Oliveto (AT), Italy
VAT no. IT01233470051 – Tax code 02506310040
Phone: +39 0141 856032
Email: eurostarinfo@eurostar.it
2. What data we process
2.1 Browsing data
During normal operation, the systems running the website collect some data whose transmission is inherent in the use of Internet communication protocols, such as the IP address, browser and device type, pages requested, and the date and time of the request. This data is used to ensure that the website works properly and securely, and is not used to identify users.
2.2 Data you provide through the forms
- Contact and quotation requests: type of request, first name, last name, company, country, email, phone, subject, information on the product and containers to be handled, approximate production capacity and any message.
- Job applications (speculative or for an open position): first name, last name, email, area of interest or position, CV and any message.
Together with the request, the website automatically records the date and time of submission, the page from which the form was sent, the IP address and the browser type, for security purposes and to prevent misuse.
Please do not include special categories of data in your CV or messages (for example data concerning health, political or religious beliefs) unless strictly necessary. Any such data will only be processed within the limits permitted by law (Article 9(2)(b) GDPR).
2.3 Cookies
The website only uses technical cookies, described in section 9.
3. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Responding to requests for information, quotations or support sent through the website | Steps taken at your request prior to entering into a contract and, if you are already a customer, performance of the contract (Article 6(1)(b) GDPR) |
| Assessing applications and managing any recruitment process | Pre-contractual steps at the request of the data subject (Article 6(1)(b) GDPR); for speculative applications, Article 111-bis of the Privacy Code |
| Ensuring the operation and security of the website, including protection against automated submissions and misuse of the forms | Legitimate interest of the controller (Article 6(1)(f) GDPR) |
| Recording the choices made in the cookie banner, so that they can be documented | Legitimate interest of the controller (Article 6(1)(f) GDPR) |
| Complying with legal obligations and, where necessary, establishing, exercising or defending legal claims | Legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f) GDPR) |
The “I have read and accept the Privacy Policy” checkbox in the forms confirms that you have read this policy: no separate consent is required for the purposes listed above.
4. Provision of data
Fields marked with an asterisk are required to handle your request or application: without this data we will not be able to follow up. All other fields are optional.
5. How we process data
Data is processed electronically by authorised and trained Eurostar staff, using appropriate technical and organisational measures to protect it against unauthorised access, loss or disclosure. Data sent through the forms is delivered to the company mailbox and also stored in the restricted area of the website. CVs, however, are only sent as email attachments and are not stored on the website. No decisions are taken based solely on automated processing.
6. Who we share data with
Data is not disclosed to the public. It may be processed on behalf of Eurostar, acting as data processors, by:
- the website hosting provider: Aruba S.p.A., with servers in Italy;
- Elementor Ltd., which provides the service that delivers the emails generated by the forms (Site Mailer) and the cookie banner, including the record of the choices made (Cookie Consent);
- the provider of the company email service: Microsoft Ireland Operations Limited (Microsoft 365);
- suppliers responsible for developing and maintaining the website and the company’s IT systems;
Where necessary to follow up on sales or support requests from abroad, data may be shared with Eurostar’s distributors and agents in the user’s country, who process it as independent controllers. Data may also be shared with advisers and authorities where necessary to comply with legal obligations or to protect the controller’s rights. The up-to-date list of processors is available on request.
7. Transfers outside the European Union
The email delivery service and the recording of cookie choices are provided by Elementor Ltd., a company based in Israel, a country for which the European Commission has adopted an adequacy decision (Article 45 GDPR). The Microsoft 365 email service stores data in the European Union; any transfers to the United States take place on the basis of the EU-U.S. adequacy decision (EU-U.S. Data Privacy Framework) or of standard contractual clauses. Where a request has to be forwarded to a distributor based outside the European Economic Area, the transfer takes place in order to follow up on your request (Article 49(1)(b) GDPR) or on the basis of the European Commission’s standard contractual clauses.
8. How long we keep data
- Contact and quotation requests: for as long as needed to handle them and for a further 24 months; if the request leads to a contract, for the period required by civil and tax law (10 years).
- Job applications: 24 months from receipt, unless you ask for earlier deletion.
- Browsing data: for as long as strictly necessary for website security, normally no longer than 12 months.
- Record of the choices made in the cookie banner: for as long as needed to document them, according to the settings of the Elementor service.
After these periods, data is deleted or anonymised.
9. Cookies
Cookies are small text files that a website stores in your browser to make it work or to remember certain choices. This website uses only technical cookies, which do not require consent (Article 122 of the Privacy Code and the Italian Data Protection Authority’s Guidelines of 10 June 2021). We do not use profiling, analytics or third-party cookies.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| wp-wpml_current_language | Eurostar (first party) | Remembers the selected browsing language | 1 day |
| cookiez-user-consent | Eurostar (first party) | Remembers the choices made in the cookie banner | 180 days |
When you make a choice in the banner (accept, deny or customise), in addition to saving it in the cookiez-user-consent cookie, the website sends a record of it to Elementor Ltd., the banner provider: a random identifier, the page where you made the choice, the choices themselves and the browser type. As with any Internet connection, Elementor also receives the IP address. The record is only used to document the choices made and is not used to profile you.
The links to Eurostar’s social media profiles (LinkedIn, Facebook, Instagram, YouTube, TikTok) and to WhatsApp are plain links: no content from these platforms is loaded until you open them. Once on the platform’s website, its own privacy rules apply.
You can delete or block cookies in your browser settings; blocking technical cookies may prevent some features of the website from working properly. You can review your choices at any time using the cookie banner button.
10. Your rights
At any time you can ask Eurostar for access to your data, its rectification or erasure, restriction of processing, data portability, and object to processing based on legitimate interest (Articles 15-22 GDPR). To exercise these rights, write to eurostarinfo@eurostar.it.
If you believe that the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
11. Changes to this policy
This policy may be updated, for example following changes to the website or to the law. The version in force is always the one published on this page, with the last updated date shown at the top.