Privacy & Cookie Policy
Version 1.0 – 31 July 2026
PART I – PRIVACY NOTICE
Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
Controller: Spoon Brands S.r.l.
Registered office: Viale L. Bodio 37, 20158 Milan, Italy
VAT number: 13641930964
Privacy contact: info@spoonbrands.it
Website: https://spoonbrands.it/
Spoon Brands has not appointed a Data Protection Officer (DPO), based on the organisational circumstances currently declared.
2. Scope
This notice covers data processed when users browse the website, send enquiries by email, submit unsolicited job applications and, subject to consent, interact with measurement, advertising and embedded-media technologies. Portfolio brand websites and other linked websites operate under their own privacy notices.
3. Categories of personal data
Browsing and security data. IP address, request date and time, requested URL, response status, user agent, referrer, technical identifiers and diagnostic information recorded by the website systems and hosting provider.
Corporate and commercial communications. Email address, name, organisation, message content and attachments.
Unsolicited job applications. Identification and contact details, CV, experience, qualifications and any other information voluntarily provided. Applicants should not provide irrelevant sensitive information.
Preferences and consent records. Banner choices, date, notice version, accepted or rejected categories and the technical identifier required to evidence the choice.
Online usage data. Pages visited, events, traffic source, interactions and online identifiers collected only after consent through Google Analytics 4, LinkedIn Insight Tag, Meta Pixel and YouTube.
4. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Website delivery, security, abuse prevention and diagnostics | Legitimate interests (Art. 6(1)(f) GDPR) | Technical logs: up to 6 months, unless required for security or legal purposes |
| Responding to corporate, commercial, real-estate or partnership enquiries | Pre-contractual steps (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) | 12 months after closure, unless a relationship or dispute follows |
| Managing unsolicited job applications | Pre-contractual steps (Art. 6(1)(b)); where necessary, Art. 9(2)(b) | 24 months from receipt, unless employment or legal duties require longer |
| Legal compliance and protection of rights | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) | For the period required by law or necessary to protect rights |
| Audience measurement through Google Analytics 4 | Consent (Art. 6(1)(a) and cookie rules) | User/event data configured to 14 months; cookies as stated below |
| Campaign measurement, remarketing and audiences through LinkedIn and Meta | Consent (Art. 6(1)(a) and cookie rules) | Until withdrawal; cookies and data under provider configuration and terms |
| Displaying embedded YouTube videos | Consent (Art. 6(1)(a) and cookie rules) | For the session and under player-cookie durations |
| Evidence of cookie preferences | Accountability obligations and legitimate interests | As necessary to evidence the choice, ordinarily no longer than 5 years |
5. Whether data must be provided
Information required to answer an enquiry or assess an application must be provided for that purpose. Consent to analytics, advertising and external-media technologies is optional. Refusal does not prevent access to ordinary website content, but may limit measurement, advertising personalisation or embedded-video playback.
6. Recipients and processors
Data may be processed by authorised Spoon Brands personnel and, within their respective roles, by hosting, maintenance, email, security, advisory and digital-service providers. Sinapps, as the website hosting, maintenance and technical-management provider, must act as a processor under Article 28 GDPR under the applicable agreement. An up-to-date list of processors is available from info@spoonbrands.it.
Data may also be disclosed to public authorities, legally entitled recipients and professional advisers protecting the Controller's rights. Data is not publicly disclosed. Contact details received through enquiries or applications are not used for marketing without a separate lawful basis.
7. Third-party digital services
Google Analytics 4 and Google Tag Manager. Tag Manager controls tag activation. Google Analytics 4 measures traffic and interactions. Measurement tags must fire only after analytics consent.
LinkedIn Insight Tag. Measures LinkedIn conversions, supports aggregated campaign reporting and, where configured, remarketing. It activates only after advertising consent.
Meta Pixel. Measures Facebook and Instagram events and campaigns and may support advertising audiences. It activates only after advertising consent. Advanced matching with contact data must not be enabled without a separate assessment.
YouTube. Videos must be displayed behind a placeholder and loaded only after external-media consent, using youtube-nocookie.com where possible and without autoplay.
Google Fonts. Fonts must be self-hosted before launch. If direct Google requests remain, this notice and the consent configuration must be reassessed.
8. International transfers
Google, Meta and LinkedIn services may involve transfers to, or access from, countries outside the European Economic Area, including the United States. Depending on the service and recipient, transfers rely on applicable adequacy decisions, the EU-U.S. Data Privacy Framework for certified participants, European Commission standard contractual clauses or other safeguards under Articles 44 et seq. GDPR.
9. Processing and security
Processing is carried out electronically and, where necessary, manually, in line with data-minimisation, integrity and confidentiality principles. Spoon Brands applies organisational and technical safeguards proportionate to risk and requires appropriate contractual and security commitments from providers.
10. Data-subject rights
Individuals may request access, rectification, erasure, restriction, portability and objection and may withdraw consent at any time without affecting prior lawful processing. Requests may be sent to info@spoonbrands.it. Individuals may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or another competent supervisory authority.
11. Updates
This notice may be updated following legal, organisational or technological changes. The version published on the website states its last-update date. Last updated: 31 July 2026.
PART II – COOKIE POLICY
Information on cookies and similar technologies used on https://spoonbrands.it/.
1. Cookies and similar technologies
Cookies are small files stored on a user's device. Similar technologies, including online identifiers, pixels and local storage, may perform comparable functions. Some technologies are required for the website to operate; others require the user's prior choice.
2. Categories used
Necessary. Enable essential functions, security, language management and storage of privacy preferences. They are always active.
Analytics. Allow Google Analytics 4 to produce traffic and usage statistics. They activate only after consent.
Advertising. Allow LinkedIn and Meta to measure campaigns, attribute conversions and, where configured, create audiences. They activate only after consent.
External media. Allow the YouTube player and related identifiers to load. They activate only after consent.
3. Expected technologies and cookies
Necessary and analytics cookies
| Category / provider | Cookie or technology | Purpose | Indicative duration |
|---|---|---|---|
| Necessary - Spoon Brands/CMP | Consent preference (name defined by the CMP) | Store acceptance, refusal and selected categories | 6 months, subject to compliance evidence needs |
| Necessary - website | Session, security or language cookies, if enabled | Website delivery, security and essential preferences | Session or strictly necessary period |
| Analytics - Google Analytics 4 | _ga | Distinguish users pseudonymously | 2 years |
| Analytics - Google Analytics 4 | _ga_<ID> | Persist session state | 2 years |
| Tag management - Google Tag Manager | Normally no dedicated visitor cookie | Conditionally manage tag activation | Google HTTP logs: up to 14 days |
Advertising and external-media cookies
| Category / provider | Cookie or technology | Purpose | Indicative duration |
|---|---|---|---|
| Advertising - LinkedIn | li_fat_id | LinkedIn click and conversion attribution | 30 days from the latest click |
| Advertising - LinkedIn | AnalyticsSyncHistory / UserMatchHistory | Identifier matching and campaign measurement | Up to 30 days |
| Advertising - LinkedIn | bcookie / lidc / li_gc, where present | Security, routing and LinkedIn consent storage | From 1 day to 1 year |
| Advertising - Meta | _fbp | Advertising measurement and pseudonymous browser identification | 3 months |
| Advertising - Meta | _fbc, when the visit follows an ad click | Store the click identifier and attribute conversions | 3 months |
| External media - YouTube | YSC | Player session operation and measurement | Session |
| External media - YouTube | VISITOR_INFO1_LIVE / VISITOR_PRIVACY_METADATA | Player settings, security and bandwidth estimation | Up to 6 months |
| External media - YouTube | PREF, where present | Player preferences | Up to 8 months |
4. Consent management
On the first visit, the banner allows users to accept all optional technologies, reject them with equal ease or choose by category. Only necessary technologies remain active without consent, and optional categories are not preselected.
Users may change their choice at any time through the permanent “Cookie preferences” link in the footer. Consent is not requested again before 6 months, unless there is a significant change, the previous choice cannot be recognised or preferences have been deleted from the device.
5. Browser settings
Users may delete or block cookies through browser settings. Blocking necessary cookies may affect certain functions. Browser settings do not replace the website preference centre for granular management of optional services.
6. Contact and updates
For information, contact info@spoonbrands.it. This Cookie Policy will be updated when services, cookies or configurations change. Last updated: 31 July 2026.
SOURCES AND REFERENCES
Regolamento (UE) 2016/679 – GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Garante – Linee guida cookie e altri strumenti di tracciamento: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876
Garante – Informativa e trasparenza: https://www.garanteprivacy.it/temi/informativa
Google – Cookie usage for Google Analytics: https://developers.google.com/analytics/devguides/collection/ga4/tag-options
Google – Tag Manager data privacy and security: https://support.google.com/tagmanager/answer/9323295
LinkedIn/Microsoft – First-party click ID and li_fat_id: https://learn.microsoft.com/en-us/linkedin/marketing/conversions/enabling-first-party-cookies
Meta – Cookie settings for Meta Pixel: https://www.facebook.com/business/help/471978536642445
Meta – Privacy Policy: https://www.facebook.com/privacy/policy/
YouTube – Privacy-enhanced embedding: https://support.google.com/youtube/answer/171780
European Commission – Adequacy decisions: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en