Last update October 29, 2026
Privacy Policy
Notice provided pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Article 122 of Legislative Decree 196/2003 (Italian Privacy Code) as amended by Legislative Decree 101/2018, to users browsing the website and using its contact channels. This notice is also provided in compliance with the Italian Data Protection Authority Cookie Guidelines of June 10, 2021.
1. Data Controller
- The Data Controller is Aumatex SRLS, Via Umberto Biancamano 25 - 00185 Rome (RM), VAT No. IT15617831001, PEC: aumatex@pec.it.
- Privacy contacts: privacy@aumatex.it, info@aumatex.it.
- The Controller determines the purposes and means of processing and remains responsible for GDPR, Italian Privacy Code and ePrivacy compliance.
- No Data Protection Officer (DPO) has been appointed as the processing does not fall within the mandatory cases under Article 37 GDPR.
2. Categories of data processed and specific purposes
- Browsing and system log data: IP address (also anonymized), request date/time, requested URL, user agent, browser, OS, language, referrer. Automatically collected by Vercel (hosting and edge network) and application server for security, troubleshooting, rate limiting and site operation. Cloudflare manages the domain’s DNS and does not proxy the site: from the browser it only receives the Cloudflare Web Analytics visit statistics (see below) and, if enabled, the Turnstile check on the form.
- Data voluntarily provided via forms: name, email address, company/organisation, message content. Sent via email to the Controller; not stored in database.
- Security data: the IP address of whoever submits the form and the number of submissions, kept in the server’s memory for about 10 minutes to prevent spam and abuse.
- Visit statistics with Cloudflare Web Analytics: page visited, referrer, country, browser, operating system and device type, page load times. The script uses no cookies or localStorage, creates no visitor identifier and does not follow the visitor across other sites; Cloudflare does not store the IP address and shows the Controller aggregate data only. As it installs nothing on the device, it requires no consent. The website does not use Google Analytics or any other statistics tool.
3. Purposes and legal bases
- The Controller processes personal data only for specific, explicit and legitimate purposes, applying minimisation, storage limitation, integrity, confidentiality and accountability principles.
| Purpose | Data | Legal basis |
|---|---|---|
| Deliver the website, pages, cache, CDN, DNS and network security. | Browsing data and technical logs. | Legitimate interest in website security and operation, Art. 6(1)(f) GDPR. |
| Reply to requests submitted through forms, email or contact links. | Identification/contact data and message content. | Pre-contractual or contractual measures requested by the user, Art. 6(1)(b) GDPR. |
| Prevent spam, abuse, bulk submissions and unauthorised access. | IP, user agent, request metadata, temporary rate-limit counters. | Legitimate interest in protecting the website and systems, Art. 6(1)(f) GDPR. |
| Comply with tax, accounting, administrative or authority requests. | Data necessary for the request or relationship. | Legal obligation, Art. 6(1)(c) GDPR. |
| Count visits and measure page load times in aggregate with Cloudflare Web Analytics, without cookies. | Page visited, referrer, country, browser, operating system, device, load times; no cookies or visitor identifiers, IP not stored. | Legitimate interest of the Controller in knowing, in aggregate, how the website is used and how it performs, Art. 6(1)(f) GDPR. |
4. Data provision
- Technical browsing data is necessary to access the website.
- Providing form data is optional, but name, email and message are required to send a request and receive a reply.
- The website uses no analytics, preference or marketing cookies and therefore asks for no consent: visit statistics are collected without cookies through Cloudflare Web Analytics.
5. Processing methods and security
- Data is processed through IT tools and organisational procedures consistent with the stated purposes, applying privacy by design and by default principles.
- Technical measures adopted: HTTPS/TLS 1.3, security headers (CSP, HSTS, X-Frame-Options), two-factor authentication on access to systems, development environment separate from production, a limit on form submissions, server-side data validation, anti-spam honeypot, structured logs without message content.
- No cookies: the website installs no cookies of its own and no analytics, preference or marketing cookies, and loads no third-party widgets that would install them. Cloudflare Web Analytics installs no cookies or identifiers on the device.
- Minimisation: Visit statistics are aggregate only and Cloudflare does not store the visitor’s IP address.
- System access is limited to authorised Controller personnel and technical providers qualified as Processors under Article 28 GDPR.
6. Retention periods and deletion criteria
- Form/email messages to Controller: 12 months from last contact, unless contractual relationship established (then up to 10 years for tax/accounting obligations) or early deletion requested.
- Form data: no database retention. The data travels from the server to the Controller’s email and is not written to application logs.
- Cloudflare Turnstile anti-spam checks on the contact form, if enabled: retained by Cloudflare under its own policies, with no cookies on our domain.
- Vercel hosting logs: 1-7 days for runtime logs, then automatic deletion.
- Rate-limit counters: at most 10 minutes in the server’s memory, no persistence.
- Cloudflare Web Analytics statistics: aggregate data only, without IP addresses, retained by Cloudflare under its own policies.
- General criterion: data is kept only as long as strictly necessary for the stated purposes and then deleted.
7. Data processors and authorised providers (Art. 28 GDPR)
- Providers that process data on the Controller’s behalf act as Processors under Article 28 GDPR, on the basis of the data processing agreements included in their terms of service. No transfer to third parties for their own purposes.
| Subject / service | GDPR role | Country | Transfer safeguards | Specific processing |
|---|---|---|---|---|
| Cloudflare Inc. | Processor (DNS, visit statistics and anti-spam check) | USA | Data Privacy Framework + SCC 2021/914 + supplementary measures | Domain DNS management; aggregate visit statistics with Cloudflare Web Analytics, without cookies and without storing IPs; Turnstile anti-bot check on the contact form, if enabled. Does not proxy the site. |
| Vercel Inc. | Processor (edge hosting) | USA | Data Privacy Framework + SCC 2021/914 | Site delivery, API and technical logs. Server functions in the EU (Frankfurt), distributed edge network. |
| Aruba S.p.A. | Processor (domain registrar and email) | Italy | N/A - EU | Administrative management of the aumatex.it domain; receipt and storage of Aumatex SRLS emails. |
| Resend (Resend Inc.) | Processor (transactional email) | USA | Data Privacy Framework + SCC 2021/914 | Sends the emails generated by the form to the Controller: processes the sender’s data (name, email, company) and the message text in order to deliver them. |
8. International data transfers
- Transfers to third countries (outside EU/EEA) occur exclusively to certified providers or with adequate safeguards under Articles 44-50 GDPR.
- Cloudflare Inc. (USA): EU Commission adequacy decision 2023/1795 (Data Privacy Framework) + EU Commission Standard Contractual Clauses 2021/914. Processes the domain’s DNS, the aggregate Cloudflare Web Analytics visit statistics and, if enabled, the Turnstile check on the form.
- Vercel Inc. (USA): Data Privacy Framework + SCC 2021/914. Server functions in Frankfurt; the edge network is distributed and logs may also transit temporarily through the USA.
- Resend Inc. (USA): Data Privacy Framework + SCC 2021/914. Processes the sender’s data and the text of messages sent through the form, in order to deliver them to the Controller.
- A copy of the safeguards adopted for transfers to third countries can be requested by writing to privacy@aumatex.it.
9. Cookies and tracking technologies
- The website installs no cookies of its own and no analytics, preference or marketing cookies: for this reason it shows no consent banner. Cloudflare Web Analytics visit statistics use no cookies, and the Cloudflare Turnstile check on the contact form, if enabled, loads from challenges.cloudflare.com without cookies on our domain.
- Full details are available in the Cookie Policy published on the website.
10. Data subject rights and exercise methods
- Rights under Articles 15-22 GDPR: access (Art. 15), rectification (Art. 16), erasure/right to be forgotten (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), consent withdrawal (Art. 7.3).
- Methods: Written request to privacy@aumatex.it with subject "GDPR Request - [your name/surname]". Attach ID document for verification.
- Response time: Within 1 month of receipt (extendable to 3 months for complexity, with motivated communication within 1 month).
- Consent withdrawal: Where processing is based on consent, it may be withdrawn at any time by writing to privacy@aumatex.it. Withdrawal does not affect lawfulness of prior processing.
- Complaint: Right to lodge complaint with Italian Data Protection Authority (www.garanteprivacy.it) or supervisory authority of residence/workplace Member State.
11. Complaint
- A complaint may be lodged with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or another competent supervisory authority.
12. Protection of minors
- The website is not intended for children under 14 and does not knowingly request data from minors.
- Forms do not include age verification but are not designed to attract underage users.
- Persons with parental responsibility who believe a minor has provided personal data may contact privacy@aumatex.it to request verification, rectification or immediate deletion.
13. Updates
- Aumatex SRLS may update this notice due to legal, technical or organisational changes. The applicable version is the one published on the website with its last update date.