Provided under Article 122 of Legislative Decree 196/2003 (the Italian Privacy Code), Article 5(3) of Directive 2002/58/EC and the Guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali) on "Cookies and other tracking tools" of 10 June 2021
Language versions. This document is drafted in Italian and is also published in English. The English version is a translation provided for convenience only: in the event of any conflict or doubt as to its interpretation, the Italian version shall prevail.
In brief
- Without your consent we use only what you need in order to use the Service: the cookie that keeps your session open after you sign in, one console preference and the cookie that remembers your choice about cookies.
- With your consent, and only on the public website, statistics tools (Google Analytics 4) and advertising tools (Google Ads, OpenAI, LinkedIn, Meta) may be activated, to understand which visits and which campaigns lead to a registration. These are two separate choices, both switched off until you give them.
- No request is sent to these providers before you make your choice, and rejecting everything is as easy as accepting everything.
- The signing pages, the app, the console and the administration area contain no measurement or advertising tool whatsoever. A person who receives an invitation to sign receives no cookie from this service.
The controller is SDL Consulting Group S.r.l. (see the Privacy Notice).
How the choice works
On the pages of the public website (home, legal pages, guide, contacts, registration) a banner appears, served from our own domain, with no third-party service used to manage consent:
- it has buttons of equal prominence, "Reject all" and "Accept all", and a "Customise" button that opens the Cookie preferences panel with a choice for each purpose (statistics and advertising; technical cookies cannot be chosen, because the Service needs them);
- continuing to scroll or browse is not consent: no tool is activated until you choose, and the Service works in the same way whatever your choice (there is no cookie wall);
- your choice is remembered in a cookie of our own for 6 months; once that period has passed, or if the text of the banner changes, we ask you again;
- you may change or withdraw your choice at any time from the "Manage cookies" link at the bottom of every public page: withdrawing is as easy as consenting; if you had consented, the cookies of the tools that sit on our domain are removed and their tags stop from the next page onwards (those on the providers' domains you can delete from your browser);
- the banner appears only when at least one measurement tool is active on the website: if none is, there is nothing to ask consent for and it does not appear.
Consent and Google tools. Before you make your choice, all four of Google's consent signals (Consent Mode v2: ad_storage, ad_user_data, ad_personalization, analytics_storage) are set to denied, and the tools are not even loaded. With "Statistics" allowed, analytics_storage is activated; with "Advertising", ad_storage, ad_user_data and ad_personalization are activated. On withdrawal, the signals return to denied.
Technical cookies (no consent required)
Cookies that are strictly necessary to provide a service expressly requested do not require prior consent (Article 122(1) of Legislative Decree 196/2003 and the 2021 Guidelines of the Garante). There are no third parties.
| Name | Where | Purpose | Duration | Notes |
|---|---|---|---|---|
session | app, console and registration form (signing in and registration need it to protect the forms) | keeps the user authenticated from one request to the next | 12 hours | signed; HttpOnly, Secure, SameSite=Lax; contains a signed reference to the user and the forms' anti-forgery token, not the password nor the permissions (the role and status of the account are read again on every request) |
lp_rail | console (only if the user narrows or widens the navigation bar) | remembers the state of the navigation bar, as chosen by the user | 12 months | interface preference requested by the user; contains mini or full |
doconure_consent | public website and registration | remembers your choice about cookies (banner version, choice for statistics and for advertising, date) | 6 months | our own cookie, on the doconure.com domain; contains no personal identifiers. If you reject, it is the only one that remains |
doconure_internal | only in the browsers of authorised staff, set by the administration area | excludes our staff's visits from measurement | 180 days | never set for visitors |
Technical cookies are necessary to sign in to the console: if session is blocked, signing in is not possible. The public pages and the signing pages remain usable.
Cookies and tools with your consent
They are activated only after the corresponding choice, and only on the public website. The identifiers and durations are those declared by each provider as at the date of this version and may be changed by that provider; for details, please refer to its notice, given in the last column.
Statistics
| Tool and controller | Cookie | Purpose | Duration | Provider's notice |
|---|---|---|---|---|
| Google Analytics 4 — Google Ireland Ltd | _ga | distinguishing visits and counting visitors in aggregate form | 2 years | policies.google.com/technologies/cookies |
_ga_<ID> (one cookie per data stream) | maintaining the state of the browsing session | 2 years | as above |
Google's tags may be loaded directly (gtag.js) or through Google Tag Manager, always only after consent.
Data processed: pages viewed, origin (website and campaign), type of device and of browser, approximate geographical area, conversion events (registration, contact, purchase). Our tag does not send your name, your email or your telephone number. Purpose: measuring the use of the website and the effectiveness of campaigns.
Advertising and conversion measurement
| Tool and controller | Cookie | Purpose | Duration | Provider's notice |
|---|---|---|---|---|
| Google Ads — Google Ireland Ltd | _gcl_au | measuring the conversions of a Google campaign | 90 days | policies.google.com/technologies/cookies |
_gcl_aw | stores the click identifier of a Google ad in order to attribute the registration | 90 days | as above | |
| OpenAI Ads measurement pixel — OpenAI Ireland Ltd | __oppref and the tool's own identifiers | measuring the conversions of campaigns on ChatGPT | as set by OpenAI | openai.com/policies/cookie-policy |
| LinkedIn Insight Tag — LinkedIn Ireland Unlimited Company | li_fat_id (on our domain); on LinkedIn's domain: bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, lms_ads, lms_analytics | measuring the conversions of LinkedIn campaigns | li_fat_id 30 days; UserMatchHistory, AnalyticsSyncHistory, lms_ads, lms_analytics 30 days; bcookie 1 year; lidc 1 day | linkedin.com/legal/cookie-policy |
| Meta Pixel — Meta Platforms Ireland Ltd | _fbp, _fbc | measuring the conversions of campaigns on Facebook and Instagram | 90 days | facebook.com/policies/cookies |
For us these tools serve to measure campaigns, that is, to know whether an advertisement you saw or clicked led to a registration; according to the provider, they may also serve to show more relevant advertisements. Each provider may also process the data for its own purposes, in accordance with its notice. If you do not want this, do not give consent to "Advertising": nothing in the Service changes.
Providers may also set their own cookies on their own domains (for example google.com, doubleclick.net, linkedin.com, facebook.com) when your browser contacts their servers after consent. Their names and durations are set out in the notices indicated. No tool in this section is active until one of our operators has entered its identifier in the website's configuration: the tools listed may therefore not all be in use.
Events sent from our server
To measure a registration or a purchase that takes place after the visit, we send, from our server, an event to Google Analytics (Measurement Protocol) and to the conversion interfaces of OpenAI and LinkedIn. We send no event to Meta from our server. For Google Ads nothing is sent from the server: one of our operators uploads to Google Ads a file (CSV) containing the ad's click identifier, the name of the conversion, the time, any amount and currency and an order reference, only for those who consented to advertising and arrived from a Google ad. These transmissions and uploads:
- take place only for those who have given consent to the corresponding purpose (the consent, with the date and the version of the banner, is recorded together with the registration request as evidence; if you rejected, only the evidence of the rejection remains, and no identifier);
- contain only the name of the event, an identifier, the date, any amount and currency, a transaction reference and the browser identifiers that the consent allowed (the identifier of the
_gacookie, the click identifiers): never email, name, telephone number, IP address or the content of documents; - never take place for a test organisation, for an internal address or from a test environment;
- the references kept in order to send them are deleted after 90 days.
Measurement without cookies: the origin of the registration
To understand which campaign a registration comes from, we keep, without cookies, for each account, the labels of the link you clicked (the campaign's UTM parameters), the referring website (its name only) and the click identifier of an advertising platform, which is deleted after 90 days (§ 2.d of the Privacy Notice). We do not record the IP address or the user agent for this purpose, and this record is not transmitted to third parties. It is a measure distinct from and independent of the tools on this page: to object, see § 8 of the notice.
Where there are no measurement tools
The pages on which a signatory opens an invitation and signs a document, the public verification of a document, calls to the APIs, the app, the customers' console and the administration area load no third-party tool for measurement or advertising, and the signing pages and the APIs set no cookies. Calls to the APIs authenticate with a key.
Payments
Payment for a package of credits takes place on a page of the payment collection provider. For a subscription paid by card, the card form belongs to the provider (Revolut) and is loaded by our order page, within the console, only while you pay: it may use its own cookies or local storage, technical and necessary for the transaction and for fraud prevention, governed by its notice. No payment cookie is set on our pages.
How to change your choice or disable cookies
- From the "Manage cookies" link at the bottom of every public page, at any time.
- From your browser: every browser allows cookies to be blocked or deleted. Blocking those in the "Technical cookies" section may prevent access to the console.
- For Google, you may also use the tools made available by Google; for the other providers, the settings indicated in their respective notices.
Transfers and providers
Google, OpenAI, LinkedIn and Meta are Irish companies: the data may be transferred to the United States. For Google, the transfer is based on the EU-US Data Privacy Framework; for the others, on the safeguards each of them declares. The list, with the location and the safeguards, is in subresponsabili.md; your rights and the right to lodge a complaint with the Garante are in the Privacy Notice, § 8.
Changes
The introduction of a new cookie or a new tool entails updating this page before it is activated and, for a new purpose, a new request for consent (the version of the banner changes and your choice is asked again).
Contacts
doconure@limepeak.it — see also the Privacy Notice.