Privacy Policy

on the processing of personal data
pursuant to article 13 of European Regulation No 2016/679 (“GDRP”)

Dear User,
this privacy policy is provided not only to comply with legal obligations relating to the protection of personal data – Regulation (EU) 2016/679 (hereinafter “GDPR”), Italian Legislative Decree (D.Lgs.) No 196/2003, as updated by D.Lgs. 101/2018 (or “Data Protection Code”) and significant orders issued by the Data Protection Authority – but also because OBL Srl(hereinafter also “OBL” or the “Company”) believes that the protection of personal data is a fundamental value of its activities and wishes to provide all information which can help you to protect your confidentiality and control the use you make of your personal data when navigating the website (hereinafter the “Website”).
Personal data are information relating to an identified or identifiable natural person defined “data subject” (hereinafter also “User”), including for example name and surname, navigation data, information concerning economic conditions, state of health, life style, etc.

Controller and Representative of the Controller in the European Union

The Controller, i.e. the party determining the purposes and means of processing of personal data who can be contacted to exercise the rights recognised by the GDPR, is OBL Srl, VAT#: IT 02312220151, Via Kennedy, 12 – 20090 Segrate (MI), Italy.
The Controller may be contacted by sending an e-mail to or forwarding notification by ordinary post to the Controller’s address, specifying the reason for the request.
The Controller has appointed its representative in the European Union, pursuant to Article 27 of the GDPR. The Controller’s representative in the European Union is OBL Srl, VAT#: IT 02312220151, Via Kennedy, 12 – 20090 Segrate (MI), Italy and can be contacted by sending an e-mail to or notification by ordinary post.

Sources and categories of data processed, nature of the provision of data and methods of processing

The processed personal data is collected mainly on the User’s device when navigating on the Website or using the services made available by the website. This privacy policy analyses the personal data processed in the different sections of the Website and governs exclusively the processing of personal data on the Website and not any other websites the User may be redirected to. The data collected by the Website are processed mainly using electronic means, with software and IT procedures suited to guaranteeing the technical and IT security measures (e.g. the implementation of the https transmission protocol to transfer information entered in the Website).

Navigation data

Types of data and nature of the provision of data

During normal operation, the computer systems and software procedures for the operation of this Website acquire some personal data which is implicitly transmitted in the use of Internet communication protocols. This information is not gathered in order to be associated to the identified Data Subjects, but which by its very nature could, if processed and associated to data held by third parties, lead to the identification of the users. This category of data includes the IP addresses or names of computer domains used by the users when connecting to the Website, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in reply, the numerical code indicating the state of the reply given by the server (OK, error, etc.) and other parameters concerning the operating system and computer environment of the user (including for example the name and type of device connecting to the Website). The provision of these data is not mandatory, as the User is free to decide not to provide such data and not to navigate the Website and does not have to access the functions made available by it.

Purposes of the processing

(i) These data are used to obtain anonymous statistical information on the use of the Website, to check that it is working properly and to improve the quality of the services offered and optimise the Website functionality.
(ii) These data are processed as far as is strictly necessary and proportionate to guarantee the security of the networks and the information transiting on them.

Legal basis

Art. 6 (1) (f) of the GDPR
Legitimate interest of the Controller to maintain the security of the Website and ensure that this is not used in a way which may harm the rights of others or as a channel for the commission of crimes or fraud (see recital 47 of the GDPR).

Retention period

The personal data referred to in this section are kept for up to 6 months following collection, unless the data subject objects to this at any time in the methods indicated in the “Rights of the data subject” section of this privacy policy.

Download, Product Configurator and Academy Areas

Types of data and nature of the provision of data

The Site hosts a Download area (, an area dedicated to the Commercial Configurator ( and an area dedicated to the Academy ( Through these areas, the User can submit specific requests to OBL. These sections collect the following types of data:

  • Name;
  • Surname;
  • Company
  • Country;
  • E-mail address;
  • Phone
  • User’s message.

OBL cannot perform any type of control on the information entered in the “Message” field.
The Company invites Users to avoid entering information from which, even indirectly – it may be possible to obtain data belonging to special categories as referred to in Article 9 of the GDPR. If this type of data is entered, OBL shall not consider such information in any answers provided and shall proceed to erase such data in a secure manner that does not allow them to be recovered. Provision of data in this area is optional. The fields that must be filled in to correctly forward the request are marked with an asterisk “*”. If the User decides not to provide such data, he or she may not forward requests for information to OBL, who will therefore not be able to reply.

Purposes of the processing

Responding to the requests for information submitted by Users.
For the purposes of defence before the courts, according to the legitimate interests of the Controller

Legal basis

Art. 6 (1) (b) of the GDPR
processing is required to perform some pre-contractual measures adopted at the request of the data subject.
Art. 6 (1) (f) of the GDPR
Legitimate interests of the Controller in protecting its own rights before the courts.

Retention period

For the whole time required to respond to the requests submitted by Users and for a period of 6 months from receiving the User’s request, in order to correctly manage any subsequent requests from the same User or further information relating to the same issue or similar issues.

Only in the event of complaints forwarded via this area, up to 10 years pursuant to art. 2946 of the Italian Civil Code or up to the maximum period of limitation of the rights.


Types of data and nature of the provision of data

In the Website homepage there is a box indicating “DON’T MISS OUT ON ANY NEWS! SUBSCRIBE TO OUR NEWSLETTER” that redirects the User to the page where he or she can submit a request for subscription to the promotional newsletter relating to the products marketed by the Company. This section collects the following types of data:

  • Name;
  • Surname;
  • Gender (Sex);
  • Age;
  • Country;
  • E-mail address;

Provision of data in this area is optional. The fields that must be filled in to correctly forward the request are marked with an asterisk “*”. If the User decides not to provide these data, it will not be possible to forward the OBL newsletter subscription request, and the Company will not be able to comply with the User’s request.

Purposes of the processing

Subscription to the Company newsletter relating to the products marketed by OBL.

Purposes of the processing

Art. 6 (1) (a) of the GDPR
Consent of the User having entered his or her e-mail address in the specific box. This consent can be withdrawn at any time, without compromising the lawfulness of the processing performed prior to withdrawal, following the instructions given in the “Rights of the data subject” section

Retention period

Until withdrawal of consent by the User.

Cookie Policy

The Website installs different types of Cookies. Go to the Cookie Policy with the detail of the information processed using these instruments by clicking here.
Any recipients or categories of recipients of the personal data and transfer of personal data to a Third country or outside the European Economic Area (EEA).
Access to these data is permitted exclusively to duly authorised and trained persons (also in relation to the compliance with the security measures and confidentiality obligations) pursuant to Article 29 of the GDPR (for example: employees of the Company required to respond to the Users’ requests submitted using the form on the Website).
Access to the data is also permitted to persons authorised as autonomous controllers or data processors pursuant to Art. 28 of the GDPR, professionals and consultants appointed by the Controller.
In particular, persons permitted to access the data include, but are not limited to, the following:

  • Persons providing IT system and communication network management services to the Company (including e-mail accounts);
  • Companies supporting OBL in the Website administration (e.g. Internet services provider) or providing services requested by the User;
  • Competent authorities for the fulfilment of legal obligations and/or orders issued by public bodies, where explicitly requested;
  • other companies belonging to the business group for internal administrative purposes, according to the legitimate interests of the Company;
  • other companies during corporate acquisitions and spin-offs, on condition that it is contractually guaranteed that such information remain confidential and protected;

To obtain an updated list of the persons who may come into contact with the personal data, send a request by e-mail to, specifying the reason for the request.


OBL is a leader company in the toy sector and is reasonably sure that this Website is also visited by minors. In relation to information society services, i.e any service provided normally against payment, remotely, electronically and at the individual request of a recipient of services, as defined in Directive (EU) 2015/1535 (including but not limited to subscription to the newsletter, completion of the questionnaire or the request for information concerning the products of the Company) is intended exclusively for persons aged at least 14, as concerns Italian legislation. Children aged under 14 must not provide information or personal data to the Company without the consent of the persons holding parental responsibility over them. The Company therefore invites anyone holding parental responsibility for minors to inform them of the safe and responsible use of the Internet and the Web and to implement any procedures indicated on a case-by-case basis in relation to the initiatives for which the Company intends to process the data of minors.

Rights of the data subject

You may exercise the rights indicated in this section in any form and free of charge, with the exception of any manifestly unfounded or excessive requests, pursuant to Art. 12 (5) of the GDPR.
In relation to the processing described in this privacy policy and pursuant to the GDPR, the User may exercise the following rights:

  • the right of access to the data subject’s own personal data and all the information listed in Art. 15 of the GDPR,
  • the right to the rectification of incorrect personal data or the integration of incomplete data,
  • the right to have his or her data erased, with the exception of those contained in deeds which must obligatorily be kept by
  • the Company and as long as there is no other prevailing legal ground for the processing;
  • right to restriction of processing in one of the hypotheses laid down in Art. 18 of the GDPR.
  • the right to object to the processing of his or her personal data, without prejudice to the need or obligatory nature of the processing for the purposes of establishing the relationship
  • the right to withdraw any consent given for the optional processing of data, without compromising the lawfulness of processing based on consent given prior to withdrawal.

The Data Subject also has the right to submit a complaint to the Data Protection Agency ( or the Data Protection Agency of the EU member state in which he or she habitually resides or works, or in the place in which the presumed breach took place, in relation to any processing he or she considers to be non-compliant.
For all these requests, the User may contact the Controller by forwarding notification by ordinary post to Via Kennedy, 12 – 20090 Segrate (MI), Italy or by e-mail to


This privacy policy includes some processing for which the User’s consent is required. This consent may be expressed by ticking the specific boxes at the bottom of the forms on the website in which the Users’ personal data is collected.

Amendments to this privacy policy

This privacy policy was updated on 29/01/2020. Any future amendments made to this privacy policy will be published on this page. OBL invites Users to regularly read this page, in order to keep updated on any amendments. If necessary, the amendments made to this privacy policy will be notified to the User by e-mail.

This website uses cookies, including from third parties. In addition to technical cookies to guarantee the user correct navigation on the site, we use marketing cookies, analytical / statistical cookies and cookies that guarantee you to interact with the main social media (such as Facebook and Youtube). You can accept these cookies by clicking on "Accept", or click or click in the footer "manage cookies '' More information

Questo sito utilizza i cookie per fornire la migliore esperienza di navigazione possibile. Continuando a utilizzare questo sito senza modificare le impostazioni dei cookie o cliccando su "Accetta" permetti il loro utilizzo.