Zelda Group

Privacy Notice

Last updated: October 20, 2026

This notice describes how we process the personal data of users who visit this website and use its forms and services, as well as of the professionals and companies that receive commercial communications from Zelda Group, pursuant to Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection law.

1. Data controller

Data is processed by:

  • Zelda Group S.r.l. — registered office: Via Bruno Buozzi 10, 60033 Chiaravalle (AN) — operations office: Via Delle Fiammiferaie 2/A, 60035 Jesi (AN) — VAT no. 02978850424 — tel. +39 0731 256154
  • Konke S.r.l. — registered office: Via del Rame 85, 06134 Perugia (PG) — VAT no. 03486710548 — tel. +39 075 5915036

For the commercial communication activities described in section 4, the data controller is Zelda Group S.r.l.

For any request concerning the processing of your data, you can write to: hello@zeldagroup.com.

2. Types of data collected

The personal data processed by this website, either directly or through third parties, include: first and last name, company name, email address, phone number, information on logistics and business operations provided by the user, browsing data (IP address, browser and device type, pages visited) and cookies.

Data is collected mainly through:

  • Contact form: name, email, company, subject and message;
  • 3PL quote request form: company name, name, email, phone and optional logistics information (type of goods, volumes, shipments, integrations, etc.);
  • Cookies and similar technologies during browsing;
  • External sources, as described in section 4, solely for the business contact data of companies that receive our commercial communications.

Providing the data marked as mandatory in the forms is necessary to process the request; failure to provide it makes it impossible to deliver the requested service.

3. Purposes and legal bases of processing

  • Responding to contact and quote requests — legal basis: performance of pre-contractual measures requested by the data subject and/or consent;
  • Delivering the requested services and managing the relationship — legal basis: performance of a contract;
  • Compliance with legal obligations (tax, accounting) — legal basis: legal obligation;
  • Website security and prevention of abuse and spam — legal basis: legitimate interest of the controller;
  • Direct commercial communication to companies and professionals — legal basis: legitimate interest of the controller, as described in section 4;
  • Aggregate browsing statistics — legal basis: user consent, given through the cookie banner.

4. Business-to-business commercial communications: data sources and right to object

This section concerns professionals and companies that receive a commercial communication from Zelda Group S.r.l. without having filled out any form on this website.

Data processed. Business contact data (first and last name, job title, work email address, business phone number, public professional profile) and information on the company’s commercial activity on marketplaces. For this purpose, we do not process special categories of data or data relating to individuals’ private lives.

Data sources. The data comes from:

  • publicly accessible sources: product listings and storefronts published on marketplaces, in particular Amazon.it; the public “Verified by GS1” barcode registry, which links a product code to the company that owns it; company websites and public professional profiles;
  • B2B professional databases operated by specialized providers, which collect and make available business contact data.

Purpose and legal basis. The data is used to offer professional services relevant to the recipient company’s business. The legal basis is the controller’s legitimate interest in carrying out direct commercial communication activities towards businesses (art. 6, par. 1, lett. f, GDPR). In balancing this against the rights of data subjects, we took into account that the processing concerns business contact data only, that the communication is relevant to the recipient’s business activity, and that every message includes an immediate, free-of-charge means of objecting.

Retention. The data is retained until the data subject objects, and in any case for no longer than 24 months from the last relevant contact, unless a contractual relationship has been established in the meantime.

Right to object. You may object to the processing at any time, free of charge and without having to give any reason, by using the unsubscribe link included in every communication or by writing to hello@zeldagroup.com. Following an objection, the data is deleted, except for the minimum information strictly necessary to ensure that the data subject is not contacted again.

5. Processing methods and retention periods

Data is processed using IT and electronic tools, with appropriate technical and organizational security measures to prevent loss, unlawful or improper use and unauthorized access.

Contact data collected through the website forms is retained for 24 months from the last relevant contact, unless otherwise required by law or unless a contractual relationship is established; at the end of this period it is deleted or anonymized. Data processed for commercial communications follows the retention periods set out in section 4. Data needed for tax and accounting obligations is retained for the period required by applicable law.

6. Services and third parties

The website and the activities described in this notice rely on the following third-party services, which may process personal data for the purposes indicated:

  • Aruba S.p.A. — website hosting, with servers located in Italy/the EU;
  • Cloudflare Turnstile (Cloudflare, Inc.) — protection of forms against spam and abuse, involving the processing of browsing data;
  • Google Analytics 4 (Google Ireland Ltd) — aggregate browsing statistics, activated only with prior consent through the cookie banner;
  • Odoo — management of business contacts (CRM) and sending of email communications;
  • Supabase (Supabase Inc.) — database used to manage business contacts, with data hosted on infrastructure located in the European Union;
  • Express couriers and logistics operators — for the performance of logistics and shipping services, limited to the data needed for delivery.

Providers that process data on behalf of the controller act as data processors, under an agreement entered into pursuant to art. 28 GDPR.

7. Cookies

The website uses technical cookies and tools necessary for its operation and security, including the Cloudflare Turnstile form protection service, which do not require the user’s consent. Third-party statistics cookies (Google Analytics 4) are used only with the user’s prior consent, given through the cookie banner. The website does not use profiling or marketing cookies. Details of the cookies and preference management are available through the cookie banner and in the Cookie Notice.

8. Disclosure and dissemination of data

The data is not disseminated. It may be disclosed to providers acting as data processors (hosting, IT, data management and logistics services) and to the competent authorities where required by law.

9. Transfers of data outside the EU

Some providers (for example Google and Cloudflare) may also process data outside the European Economic Area. In such cases, the transfer takes place in compliance with the safeguards set out in Chapter V of the GDPR, in particular through the standard contractual clauses approved by the European Commission and, where applicable, the provider’s participation in the EU–U.S. Data Privacy Framework.

10. Data subject rights

As a data subject, you have the right to obtain access to your data, its rectification or erasure, the restriction of processing and data portability, as well as the right to object to processing — in particular where it is based on legitimate interest, including commercial communications — and to withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before its withdrawal.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

To exercise your rights, you can write to hello@zeldagroup.com. We respond within one month of the request.

11. Changes to this notice

The controller reserves the right to modify or update this notice at any time, giving notice on this page and indicating the date of the last update.