Privacy policy

Controller

Variand Furniture GmbH/Srl
Förche 36, 39040 Natz-Schabs, Italy
Email: [email protected]

Principles

We take the protection of your personal data seriously. We process personal data only to the extent necessary to operate the website, where you actively provide it to us — for example via the enquiry form or by email —, where you have given your consent, as with analytics via Google Analytics, or where we have a legitimate interest in doing so, as with cookieless audience measurement via Cloudflare Web Analytics.

Hosting and access data

This website is hosted on Cloudflare Pages (Cloudflare, Inc., USA). When the website is accessed, Cloudflare automatically records technical access data required for delivery and secure operation:

• IP address
• Date and time of access
• Page accessed
• Browser type and operating system

This data is used solely to ensure technical operation and to defend against attacks, and is not combined with other data sources. We have not set up any permanent storage of access logs. Cloudflare retains them only for as long as necessary for operation and security and deletes them afterwards; Cloudflare does not specify a fixed retention period for this.

Cloudflare processes the data as a processor on our behalf. Transfers to the USA are based on the EU-US Data Privacy Framework, under which Cloudflare is certified. Further information atcloudflare.com/privacypolicy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).

Audience measurement with Cloudflare Web Analytics

To see how many visitors the website has overall, we use Cloudflare Web Analytics (Cloudflare, Inc., USA). For this, the page loads a small script from Cloudflare which, when the page is accessed, transmits the following information:

• page accessed and origin (referrer)
• browser, operating system and device type
• country, derived from the IP address
• page load times

Cloudflare Web Analytics does not set cookies, does not store anything in your browser and does not recognise you by your IP address or any other characteristics (no fingerprinting). No user profiles are created; we only see aggregated figures. Consent is therefore not required.

Cloudflare processes the data as a processor on our behalf; the same applies to transfers to the USA as for hosting. Further information atcloudflare.com/web-analytics.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement without cookies). You can object to this under Art. 21 GDPR.

Cookies and consent

On your first visit, we ask whether you consent to analytics. We store your decision in your browser's local storage (vs-einwilligung) so that we do not have to ask again on every page view. This entry is technically necessary, contains only your choice and the time it was made, and is not transmitted to us. After six months, we ask again.

Closing the banner via × counts as refusal. You can change or withdraw your decision at any time via the cookie settings (also in the footer of every page).

Legal basis for storing the decision: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (demonstrating consent).

Analytics with Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It shows us which pages are viewed, how visitors reach the website and whether enquiries are submitted — so that we can improve the website. Without your consent, Google Analytics is not loaded.

In particular, the following is processed:

• pages viewed, time spent on the page, origin (referrer)
• clicks on contact and enquiry links, and whether the enquiry form was started or submitted — without the content you enter
• device, browser, operating system, screen resolution
• approximate location (country, region), derived from the IP address; Google Analytics 4 does not store the IP address itself

For this purpose, Google Analytics sets the cookies _ga and_ga_1HRMMHLYRY with a lifetime of up to two years. Data in Google Analytics is deleted after 14 months. Google Signals and advertising features are deactivated; the data is not linked to your Google account and is not used for advertising.

Google processes the data as a processor. A transfer to Google LLC in the USA is possible; it is based on the EU-US Data Privacy Framework, under which Google is certified. Further information atpolicies.google.com/privacy.

Legal basis: your consent under Art. 6(1)(a) GDPR and Art. 122 of the Italian Personal Data Protection Code (Legislative Decree No. 196/2003). You can withdraw it at any time with effect for the future via the cookie settings; the cookies are then deleted.

Contact form

If you use the enquiry form, the data entered there is transmitted to us: name and email address, your message and — depending on the path chosen — details of the project (type of property, scope, planning stage, timeframe, location, budget range) or of the business (company, website, region, planned sales channel). This data is stored and used exclusively to process your enquiry.

If you reached us via a link on another website or a link with campaign tags (so-called UTM parameters), the form also sends where you came from: the name of the referring website, the campaign tags and the page on which you entered the site. This shows us through which channels enquiries arise. Until you send the form, your browser keeps this information in its session storage (vs-herkunft); it is deleted when you close the tab and is only transmitted to us together with an enquiry.

Technically, our hosting provider Cloudflare receives the enquiry and passes it to the email service Resend (Resend, Inc., USA), which delivers it as an email to our mailbox. Resend processes the data as a processor; the data processing agreement forms part of Resend's terms of service. Transfers to the USA are based on the EU-US Data Privacy Framework, under which Resend is certified, and additionally on the EU Standard Contractual Clauses. Further information atresend.com/legal/privacy-policy. The data is not otherwise disclosed to third parties.

We delete your enquiry once it has been dealt with, unless statutory retention obligations apply — for example, if it leads to an order.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (your consent when submitting the form — which you may withdraw at any time).

Contact by email

If you contact us by email, the data transmitted (name, email address, content) is stored and used exclusively to process your enquiry. It is not disclosed to third parties. Deletion is handled in the same way as for the contact form.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).

Obligation to provide data

You are under no obligation to provide us with personal data. Without a name and email address, however, we cannot respond to an enquiry. No automated decision-making or profiling takes place.

Your rights

Under the GDPR, you have the right to:

• access to the personal data stored about you
• rectification of inaccurate data
• erasure of your data
• restriction of processing
• data portability
• object to processing (Art. 21 GDPR)
• withdraw consent given, with effect for the future (Art. 7(3) GDPR)

For requests, please contact:[email protected]

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is the Garante per la protezione dei dati personali (Italian Data Protection Authority).

Last updated

Version: October 2026

This privacy policy is updated whenever the website changes — for example, when new services are integrated.