1. Data controller
The data controller is CODENEX SRLS, registered office at Via Resuttana 360 - 90146 Palermo (PA), Italy, VAT number IT07425080822, tax identification number 07425080822, REA PA-457974, certified e-mail codenex@pecsicura.com and e-mail hello@codenex.eu.
This notice reflects Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018, and the applicable Italian rules on personal data protection, electronic communications and cookies.
2. Categories of data
- identity and contact details submitted through forms: name, surname, e-mail, phone number, company, message and project preferences;
- data needed to manage quote or consultation requests;
- newsletter data: e-mail address and consent/opt-in logs;
- technical and security data: IP address, user agent, timestamp, anti-spam checks and Turnstile verification result;
- navigation data processed through Google Analytics 4: viewed page, source, interaction events, browser and device information, approximate location, consent state and online identifiers generated when analytics cookies are accepted;
- any data voluntarily included by the user in the message body.
3. Purposes and legal bases
- replying to contact, quote and consultation requests: Article 6(1)(b) GDPR, pre-contractual steps requested by the data subject;
- managing the newsletter: Article 6(1)(a) GDPR, consent;
- measuring website use and performance with Google Analytics 4: Article 6(1)(a) GDPR, consent for non-essential analytics cookies and identifiers. When consent is denied, advanced Google Consent Mode keeps analytics storage denied and may send limited cookieless signals for aggregate measurement and modelling;
- preventing abuse, spam and malicious traffic: Article 6(1)(f) GDPR, legitimate interest in site and service security;
- complying with legal and tax obligations: Article 6(1)(c) GDPR;
- managing contractual relationships: Article 6(1)(b) GDPR.
Form-submission events do not send names, e-mail addresses, phone numbers or message contents to Google.
4. Mandatory or optional data
Data marked as required in forms are necessary to process the request. Failure to provide them may prevent us from replying or delivering the requested service. Newsletter subscription data are optional.
5. Recipients and processors
Data may be processed, on behalf of the controller and within the stated purposes, by technical and organisational service providers, including hosting and web infrastructure providers, e-mail systems, anti-spam/security services, the Brevo newsletter platform, Codenex CRM/calendar infrastructure, Google Ireland Limited for Google Analytics 4, Google Consent Mode and Google Maps and, where enabled, Cloudflare Turnstile for form protection.
Data are not publicly disclosed. Further information is available in the Google Privacy Policy.
6. International transfers
Some providers may process data outside the EEA. Where this happens, the controller adopts appropriate safeguards under GDPR, such as adequacy decisions or standard contractual clauses, where applicable.
7. Retention periods
- contact, quote and consultation requests: up to 24 months from the last interaction, unless longer retention is required for contractual or defence purposes;
- newsletter data: until consent is withdrawn or the user unsubscribes;
- technical security and anti-spam data: normally up to 12 months, unless longer retention is required for protection purposes;
- Google Analytics cookies: up to 13 months under the website configuration; event data according to the retention period configured in the GA4 property;
- administrative, accounting or contractual data: for the period required by applicable law.
8. Data subject rights
Users may exercise the rights granted by Articles 15-22 GDPR at any time: access, rectification, erasure, restriction, objection, portability and withdrawal of consent where processing is based on consent.
Requests may be sent to hello@codenex.eu. Users also have the right to lodge a complaint with the competent supervisory authority, in particular the Italian Data Protection Authority.
9. Supervisory authority
Italian Data Protection Authority
Piazza Venezia 11 - 00187 Rome, Italy
Telephone: +39 06.696771
E-mail: protocollo@gpdp.it
Certified e-mail: protocollo@pec.gpdp.it
Website: www.garanteprivacy.it
10. Automated decision-making
The website does not use solely automated decision-making producing legal or similarly significant effects on users. Any anti-fraud or anti-spam tools are used only for security purposes.