REFLEX · FCU / PRIVACY
Privacy notice
Updated: 7 October 2026
1. Data controller
Fabbrica Chimica Unione srl, Via Aldo Bozzi 12/14, 20832 Desio (MB), Italy, VAT 00688620962. Contact info@chimicaunione.it for privacy enquiries and rights requests. This notice covers the Reflex website and restricted SDS administration area.
2. Data and purposes
No registration is required to browse products, the catalogue or SDS files. Delivery systems may process IP addresses, browser details, requested resources, timestamps and technical events for operation and security. Emails you send provide contact details and message content used to answer your request. SDS administration uses the administrator’s account identifier, email and name where supplied by the sign-in service, plus uploader identifiers, dates and document metadata. Uploaded SDS files are public: avoid unnecessary personal data. SDS administration uses a dedicated username and password. We store the username, a salted password hash and hashed session tokens. The necessary __Host-sds_session cookie lasts at most 8 hours and is removed on sign-out; it uses HttpOnly, Secure and SameSite=Strict on the published site. Login attempts are limited in 10-minute windows. ChatGPT verifies ownership only for initial activation; platform cookies are separate.
3. Legal bases
Requested and precontractual services rely on GDPR Article 6(1)(b); security and access control on the legitimate interest in protecting the site and documents, Article 6(1)(f); legal duties on Article 6(1)(c). Providing contact information is voluntary, but necessary for a response. Identification is required only for SDS administration. The application has no shop, newsletter subscription, marketing or profiling tools. It does not request sensitive data; sending such information does not automatically authorise its processing.
4. Recipients
Authorised personnel and technical and email service providers may access data for their tasks. The proposed configuration uses Sites/OpenAI for delivery and restricted-area authentication, with Cloudflare infrastructure for the application and documents. Provider roles and terms must be checked for the final configuration. Published SDS files are accessible to visitors; internal uploader identifiers are not shown on public product pages.
5. Retention
Contact requests are kept for handling the request and resulting relationships, and where needed for legal duties or defence of rights. Administrator authorisation is needed while access remains enabled. SDS metadata relates to the published document; replacement updates the current revision. Log, backup and session retention must be confirmed with hosting and authentication services before public activation.
6. International transfers
Hosting and authentication may involve providers or infrastructure outside the EEA. Countries and applicable adequacy decisions or GDPR safeguards must be checked before publication. Request information about recipients and safeguards from the controller.
7. Your rights
Where applicable, request access, correction, erasure, restriction, portability or object to legitimate-interest processing. Consent can be withdrawn without affecting prior lawful processing where consent is used. Contact info@chimicaunione.it. You may complain to the Italian Garante or your competent supervisory authority. This application does not use automated decisions or profiling.
8. Cookies and updates
Read the cookie notice. External links open only when selected and destination sites apply their own notices. Changes will be posted with the update date.