We collect personal data that you voluntarily provide to us when contacting us for technical quotations, distributor inquiries, software evaluation requests, or customer support. This includes: full name, business email address, professional telephone number, company/institution affiliation, job title, and geographic country.

When visiting our website, technical browsing data is automatically logged by our web servers, including: IP address (anonymized where applicable), browser user-agent, operating system, referrer URL, pages viewed, time spent per page, and timestamp of the visit.

We do not collect any special categories of personal data (sensitive personal data revealing racial or ethnic origin, political opinions, religious beliefs, or health data) or data relating to minors under 16 years of age.

Fulfillment of Pre-contractual & Contractual Obligations (Art. 6(1)(b) GDPR): Processing your commercial inquiries, providing custom Shack-Hartmann sensor quotes, managing purchase orders, delivering products, and issuing SenSoft software licensing keys.

Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Fulfilling statutory tax, accounting, customs, and dual-use export control obligations under Italian and European Union trade regulations.

Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring network and IT security, preventing fraudulent transactions, analyzing aggregated website performance to improve user experience, and managing B2B customer relationships.

Consent (Art. 6(1)(a) GDPR): Sending technical newsletters, product updates, or using non-essential marketing and analytical cookies, where explicit consent has been granted through our Cookie Banner.

Our website uses cookies and similar storage technologies to ensure seamless navigation, remember user preferences, and collect anonymous traffic statistics. Cookies are classified into three distinct categories:

1. Essential & Functional Cookies: Strictly necessary for fundamental website security, load balancing, language settings, and saving your cookie consent preferences. These cookies cannot be deactivated in our systems.

2. Statistical / Analytical Cookies: Measure aggregated visitor interactions and navigation paths to help us improve page structure and technical resources without directly identifying individual users.

3. Marketing & Resource Cookies: Used to deliver relevant technical whitepapers, application guides, and distributor routing.

You can review, modify, or withdraw your cookie preferences at any time by accessing the Cookie Consent banner in the footer or adjusting your web browser settings.

SpotOptics S.r.l. does not sell, rent, or trade your personal data. We may share information with trusted third parties solely to the extent necessary to deliver services: authorized regional distributors (e.g., in China, Japan, South Korea for localized assistance), logistics and shipping carriers, IT infrastructure and hosting providers, and accounting/legal advisors.

All external service providers act as Data Processors bound by strict data processing agreements (DPAs) in compliance with Article 28 of the GDPR.

If personal data is transferred outside the European Economic Area (EEA) to our authorized distributors, such transfers are governed by European Commission Standard Contractual Clauses (SCCs) or applicable adequacy decisions ensuring an equivalent level of data protection.

We retain personal data only for as long as necessary to fulfill the specific purposes for which it was collected, or as required by applicable statutory limitation periods and legal obligations.

Commercial & Accounting Records: Stored for a minimum of ten (10) years in compliance with Italian civil and fiscal laws (Art. 2220 Italian Civil Code).

Customer Support & Inquiries: Retained for up to twenty-four (24) months after the last active communication unless an ongoing commercial or warranty relationship exists.

Website Analytical Logs: Automatically anonymized or deleted within twelve (12) months.

SpotOptics implements industry-standard technical and organizational security measures to protect personal data from accidental loss, unauthorized access, destruction, disclosure, or alteration.

These measures include HTTPS/TLS encryption for all web transmission, strict access control mechanisms with multi-factor authentication for internal systems, regular security audits, automated backups, and secure server hosting environments located in high-grade data centers within the European Union.

Despite rigorous precautions, no electronic transmission over the Internet can be guaranteed 100% secure. In the unlikely event of a security breach affecting your rights, SpotOptics will notify affected users and supervisory authorities in accordance with GDPR Articles 33 and 34.

Under Chapter III of the GDPR, you have the following fundamental rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Obtain confirmation as to whether your data is being processed and receive a copy of your personal data.

• Right to Rectification (Art. 16 GDPR): Request the correction of inaccurate or incomplete personal information.

• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request deletion of your data when it is no longer needed or if processing was unlawful, subject to legal retention obligations.

• Right to Restriction of Processing (Art. 18 GDPR): Limit the processing of your data under specific conditions.

• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, and machine-readable format.

• Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests or direct marketing at any time.

• Right to Withdraw Consent (Art. 7(3) GDPR): Revoke previously given consent without affecting the lawfulness of prior processing.

If you believe that our processing of your personal data infringes the provisions of the GDPR or national data protection legislation, you have the statutory right to lodge a complaint with a competent Data Protection Supervisory Authority.

In Italy, the lead supervisory authority is the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, Italy; www.garanteprivacy.it). You may also submit a complaint to the supervisory authority in your EU Member State of habitual residence or place of work.

We reserve the right to modify or update this Privacy Policy periodically to reflect changes in our operational practices, technological enhancements, or regulatory requirements.

Any amendments will be published on this page with an updated "Last Updated" and "Effective Date" timestamp. We encourage visitors to review this page periodically to remain informed about our data protection standards.

To exercise any of your statutory privacy rights, submit a data access request, or obtain further details on our data protection safeguards, please contact our privacy desk directly:

SpotOptics S.r.l. – Privacy Office Via Turazza 48 35128 Padova (PD), Italy Phone: +39 049 8078529 Email: privacy@spot-optics.com / contact@spot-optics.com Website: www.spotoptics.com