Given under Articles 12, 13 and 14 of Regulation (EU) 2016/679 ("GDPR")
Language versions. This document is drafted in Italian and is also published in English. The English version is a translation provided for convenience only: in the event of any conflict or doubt as to its interpretation, the Italian version shall prevail.
Introduction: two distinct roles, and it pays not to confuse them
DoConure (with the products Composer Fly, Signer Fly and Document Fly) is a service of SDL Consulting Group S.r.l., which presents itself under the Limepeak brand. With regard to personal data we do two different things, and this notice keeps them apart:
| Who you are | Who decides why and how | What we are | Where to read |
|---|---|---|---|
| A client, its users, someone who visits the site, writes to us or is a prospective client | us | controllers | this notice, from § 1 |
| A signer or a recipient of a document sent by one of our clients, or a person named in a client's document | the client that sent you the document | processors (art. 28 GDPR), on the client's behalf | the block below and the DPA |
The distinction is not a formality. It decides whom a data subject asks for access or erasure, and who is bound to answer. The Service is reserved for businesses and professionals (§ 12): our clients are not consumers, but the people who work for them, and the people who sign, are natural persons and have all the rights of the GDPR.
For whoever receives an invitation to sign: the short notice for signers
If you have received an email or an SMS with a link to sign a document, this is what you need to know.
- Whoever decides about your data is the company that sent you the document (the "sender"): it is the controller. It chose you, decided to have you sign and decided which data to ask of you. The legal bases and the purposes are its own and it must state them to you in its own notice.
- We are its processor (art. 28 GDPR): we carry out the signing on its behalf and only according to its instructions. We do not use your data for our own purposes, we do not write to you for marketing and we do not sell it.
- What we record when you sign: your name and your email address; your mobile number only if the sender chose verification by SMS; the identity verification method actually applied; date, time, IP address and user agent (your browser program) of each step; the signature mark you choose (a typed name or a graphic stroke); the answers to the fields of the document; your acceptance and, if you choose it, your refusal to sign. Every event is recorded in a cryptographically chained list that cannot be modified afterwards. The signed document carries a certificate of completion stating the main data of the signature.
- What signature it is: a simple electronic signature. If the sender asked for the qualified electronic seal, the complete document is also sent to the seal provider (Openapi, with Namirial): the seal is the Provider's and guarantees the origin and integrity of the file, it does not turn your signature into an advanced or qualified signature.
- Who sees your data: the sender and the people it has authorised; us, as technical provider; the providers listed in the list of sub-processors (hosting, sending email and SMS). The signing pages contain no measurement tools or advertising and set no cookies (§ 10).
- For how long: the evidence of the signature (record of events, signed document, certificate) is kept for 10 years from the closing of the matter, then your personal data is irreversibly made anonymous; the text of the messages with the links and the codes is kept for much less (§ 2: 7 days for codes, 30 days from closing for invitations and reminders). The retention of the documents the sender sent you is decided by the sender within the limits of its agreement with us.
- Your rights (access, rectification, erasure, restriction, portability, objection) are exercised against the sender, who is the controller. If you write to us, at doconure@limepeak.it, we forward your request to the sender without delay and in any case within 5 working days and assist it in answering: we do not answer in its place. You may always turn to the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it).
- If you believe the document is fraudulent you can report it from
/report, without an account: in that case, and only for the report, we are the controller (§ 2.j).
1. Controller
SDL Consulting Group S.r.l. Registered office: Via Gaetano Nicolosi 13, 95019 Zafferana Etnea (CT), Italia — VAT number and tax code 05991350876 — REA CT-454777 — capitale sociale EUR 10.000 i.v. Email: doconure@limepeak.it — Certified email (PEC): sdlgroup@legalmail.it — Support: doconure@limepeak.it Requests about personal data: doconure@limepeak.it
Data Protection Officer (DPO): non nominato
We have not appointed a DPO because art. 37(1) GDPR does not require it: we are not a public authority; our core activity does not consist of regular and systematic monitoring of data subjects on a large scale (the Service records the events of a signature to prove it, it does not observe people's behaviour, and the site's measurements are optional and minimal); and it does not consist of large-scale processing of special categories of data or of data relating to criminal convictions (the Service is not intended for such data: DPA, Annex I). We review this assessment when the volumes or the nature of the service change. For any data protection matter write to doconure@limepeak.it.
2. What data we process, why, on what basis and for how long
There is a single table: each row says who we are for that processing (C = controllers, P = processors on the client's behalf), the purpose, the legal basis and the retention period. The general criterion is in § 9.
| Data | Role | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| First name, surname, business email, role, language of whoever uses the console | C | creating and managing the account | contract, art. 6(1)(b) | duration of the relationship + 30 days; then § 9.1 |
| Password (hash only), authentication factor (email address for one-time codes, or encrypted TOTP secret and hashed recovery codes) (§ 2.h) | C | authentication and security of access | contract, art. 6(1)(b), and legitimate interest, art. 6(1)(f) | duration of the relationship |
| Session and preference cookies of the console (§ 10) | C | keeping the access open; remembering the state of the navigation bar | technical necessity: art. 122 of Italian Legislative Decree 196/2003 (no consent) | session: 12 hours; preference: 12 months |
| Access and activity logs (IP, date and time, action) | C | security, prevention of abuse, reconstruction of incidents | legitimate interest, art. 6(1)(f) | 365 days |
| Chained audit trails (actions on the account, sign-in attempts with IP address) (§ 2.g) | C | security and proof of what happened | legitimate interest, art. 6(1)(f) | see § 2.g |
| Billing data (company name, VAT number, tax code, address, PEC or recipient code), orders, invoices, VAT adjustments, record of the acceptance of the Terms (with IP) | C | contractual and tax obligations; proof of acceptance | contract, art. 6(1)(b); legal obligation, art. 6(1)(c); defence of legal claims, art. 6(1)(f) | 10 years from the end of the year of the last record (art. 2220 of the Italian Civil Code) |
| Data on the use of the Service and credit movements | C | invoicing, capacity planning, support | contract, art. 6(1)(b) | duration of the relationship; for the tax part 10 years |
| Data of an order to buy credits or a subscription (amount, outcome, payment reference); for saved cards: **only the payment provider's reference (token), the expiry (month and year) and the last four digits**, never the number or the security code (§ 4) | C | carrying out the purchase and the renewals; a notice before the card expires | contract, art. 6(1)(b); legal obligation, art. 6(1)(c) | orders: 10 years; saved card: until the client deletes it or the subscription ends |
| Support emails | C | support | contract and legitimate interest | 24 months |
| Account email messages (invitation, reset, credit and subscription notices): text | C | making the account work | contract, art. 6(1)(b) | 30 days |
| One-time codes by email or SMS, text of the message | C (access) / P (signing) | identity verification | contract / client's instruction | 7 days |
| Signing messages (invitation, reminder, withdrawal, expiry, signed copy): text | P | getting documents signed | client's instruction | 30 days from the closing of the matter |
| Data of each message sent (recipient, purpose, outcome, times) | C / P | proof of sending and delivery, support | legitimate interest, art. 6(1)(f) | 12 months |
| Evidence of completed signing processes (record of events with IP and user agent, signed document, certificate, signers' data) | P | proving the validity and integrity of the signature for as long as it can be challenged | standing instruction of the client (DPA § 4.3) | 10 years from closing, then personal data made anonymous in place |
| Documents produced by the Service and the data transmitted to produce them | P | returning them to the client | client's instruction | 365 days, then deleted; in the mode without retention, never written |
Test documents (isTest calls) | P | integration testing | client's instruction | 7 days |
| Uploaded files (images, PDF) | P | using them in documents or in signing | client's instruction | 30 days from upload (up to 365 at the client's request); if signed, like the signing evidence |
| Results of bulk processing | P | delivering the result | client's instruction | 30 days from the end of the job (the summary remains) |
| Encrypted backup copies | C / P | restoring the Service | legitimate interest, art. 6(1)(f) | 30 days, then they leave the cycle |
| Requests sent from the contact form: full name, email, phone and company if given, topic, message, IP address and user agent (§ 2.i) | C | answering; protecting the form from abuse | pre-contractual measures, art. 6(1)(b), and legitimate interest, art. 6(1)(f) | 24 months from sending, then deleted |
Abuse reports sent from /report: message, reference given, the reporter's email if given, IP address and user agent (§ 2.j) | C | identifying and stopping fraudulent use of the Service | legitimate interest, art. 6(1)(f) | 24 months from closing, then deleted |
| Registration requests not completed, or awaiting approval | C | verifying the address and assessing the request | pre-contractual measures, art. 6(1)(b) | request not completed: 24 hours; registration pending or refused: 30 days |
| Email, name and role | C | marketing communications (§ 2.a) | consent, art. 6(1)(a) and art. 130 of Italian Legislative Decree 196/2003; or legitimate interest (soft spam), art. 6(1)(f), towards those who are already clients | until withdrawal or objection, and in any case no longer than 24 months from the last contact |
| Metrics of the use of the Service linked to the account (functions used, frequency, volumes, formats) | C | profiling for tailored proposals (§ 2.b) | consent, art. 6(1)(a) | until withdrawal, and in any case no longer than 24 months |
| Register of consents (yes and no, with date, time, IP and version of the text) (§ 2.c) | C | demonstrating consent, art. 7(1) | accountability obligation, art. 6(1)(c) and 6(1)(f) | for as long as the account exists |
| Origin of the registration: campaign, first and last touch, path of the first page, referring site, click identifier (§ 2.d) | C | measuring which campaigns lead to a registration | legitimate interest, art. 6(1)(f) | click identifier: 90 days, then deleted; the rest in statistical form |
| Referrals between clients and payment fingerprint (§ 2.e) | C | granting the reward and preventing its abuse | legitimate interest, art. 6(1)(f) | for as long as the account exists; then in anonymous form |
| Usage counters per access key (§ 2.f) | C | security, capacity planning, support | contract, art. 6(1)(b), and legitimate interest | 400 days (daily counters, without personal data) |
| Only with consent: identifiers and browsing data collected by measurement and advertising tools on the public site (§ 10) | C, with the providers stated in the cookie policy as independent controllers or processors depending on the tool | measuring visits and campaigns; measuring advertising conversions | consent, art. 6(1)(a) and art. 122 of Italian Legislative Decree 196/2003 | according to the cookies: from 90 days to 24 months; the consent is remembered for 6 months |
The legitimate interest relied on for logs, audit trails and reports is the security of the service and the ability to reconstruct what happened after an incident. It is balanced by the fact that the logs do not feed the profiling of § 2.b and are not used to assess people. They are two distinct stores and stay that way. The balancing test is available on request. In any case, you have the right to object to processing based on legitimate interest (§ 8): we say so here, separately, because art. 21(4) GDPR requires that it be explicitly brought to the data subject's attention.
Source of the data and data not collected from you (art. 14). As a rule the data is provided by the person themselves. The exceptions are: a colleague's data, entered by the client's coordinator when inviting them into the account (name, email, role); the signers' data, which is provided to us by the client (and in that case we act as processors, as in the block for signers); the outcome of the VAT number check, which we obtain from the European Commission's VIES service; the outcome and the reference of a payment, which we obtain from the payment provider. We do not obtain data from lists or commercial sources. We inform you of these processing operations at the first contact and at the latest within one month; the information is this page.
2.a Marketing communications
If we are given consent, we send by email news about the service, new functions and commercial proposals. The consent is:
- optional: refusing it does not prevent opening an account nor changes a single function of the Service;
- separate from every other box, and never pre-ticked;
- revocable at any time, from one's profile in the console or from the link at the bottom of every message, without having to explain why and as easily as it was given (art. 7(3) GDPR). Withdrawal does not affect the lawfulness of the messages already sent.
To those who are already our clients we may send communications about services similar to those bought even without consent, on the basis of legitimate interest and within the limits of art. 130(4) of Italian Legislative Decree 196/2003 (soft spam): in this case too every message carries the link to stop them.
We do not hand the email address to third parties for their marketing purposes. We have never done so and it does not appear among the purposes above: should it one day appear, this notice will be updated before and not after.
2.b Profiling for tailored proposals
If we are given consent, we analyse how the account uses the Service — which functions, how often, with what volumes and formats — to understand which plan suits it and which content is relevant, instead of offering everyone the same thing.
It is worth being precise about what this is not:
- it does not cross-reference third-party data, does not use external sources and does not reconstruct behaviour outside the Service;
- it does not look inside the clients' documents or the signers' data. That data is processed as processor, on the client's behalf, and using it for a purpose of ours would be a breach of the DPA even before being one of this notice;
- it produces no automated decisions with legal or similarly significant effects within the meaning of art. 22 GDPR: no price, no limit and no suspension depends on it;
- it does not condition the Service: refusing or withdrawing it changes nothing of what can be done.
This consent too is optional, separate, never pre-ticked and revocable at any time from one's profile.
2.c How consents are recorded
Every answer — the yes and the no — is written in a register with the date, the time, the IP address and the version of the text in force at that moment. Everyone can see their own history from their profile. It serves us to demonstrate consent as art. 7(1) GDPR requires, and serves the data subject to check that what they remember matches what is recorded. Consent to the cookies and measurement tools of the public site (§ 10) is remembered in the browser. When you register we keep a copy of it with the organisation, as proof: the purposes allowed or refused, the date and the version of the banner, without IP address, for as long as the account exists. Only if you consented, the copy includes the browser identifiers needed to link the registration to the campaign (the identifier of the _ga cookie, the click identifiers), which are deleted after 90 days.
2.d Origin of the registration (attribution)
To understand which campaigns lead to a registration we record, for each account: the campaign labels (the UTM parameters of the link), the first and last touch, the path of the first page visited, only the name of the referring site and any click identifier of an advertising platform. The click identifier is deleted after 90 days (the period is a platform setting and may be set to zero). We use no cookie for this measurement, we record neither IP address nor user agent for this purpose and this record is not transmitted to third parties. It is a measurement of our own, distinct from the measurement and advertising tools of § 10, which are active only with consent. You may object at any time (§ 8).
2.e Referral programme
The programme, currently not active, rewards with credits whoever brings a new client. The reward is in credits only, not money, and is limited to 1,000 credits per single reward and 10,000 credits per referrer. A reward is credited only once and only after a real payment. To prevent abuse we compare data we already keep for other purposes (the email domain, the phone number, the billing data, the addresses of recent sign-ins) and a payment fingerprint: a code obtained with a secret key (keyed hash) from the brand, last digits and expiry of the card, as communicated by the payment provider; it is not a card number, it cannot be read backwards, and it is kept only for payments made through a real provider. A suspicious signal only brings in a person: no automatic refusal.
2.f Usage statistics per access key
For each API key we keep daily counters (number of requests and outcomes), deleted after 400 days. They contain neither the content of the requests nor data from documents.
2.g Audit trails
We record, in cryptographically chained audit trails, the relevant actions on the account and on the service, including sign-in attempts with the related IP address. Precisely because they are chained, a row cannot be modified or deleted on its own without breaking the chain: this is why they remain even after the anonymisation of the account (§ 9.1). No automatic deletion of the trails is provided for today: they remain for the life of the account and, after anonymisation, with no name associated any more (the IP addresses remain in the rows where they appear). The maximum retention period will be set and this notice updated before it comes into force.
2.h Access protected by a second factor
Every user of the console signs in with a password and a mandatory second factor: a one-time code sent by email or a TOTP application of the user's choice. Recovery codes are kept as hashes.
2.i Contact form
Whoever writes to us from the site's contact form (/contatti) gives us their full name, an email address, the topic and the message and, if they wish, a phone number and a company; we also record the IP address and the user agent the message came from, to protect the form from automated submissions. We use this data only to answer: the request reaches our mailbox by email and we answer from there. We send no confirmation email to the address given, we do not use this data for marketing communications and we do not link it to an account. The legal basis is the performance of pre-contractual measures taken at the data subject's request (art. 6(1)(b)) when the writer is evaluating the Service, and otherwise our legitimate interest in answering those who contact us (art. 6(1)(f)). The request and the notification concerning it are deleted 24 months after sending; a request to exercise rights is kept, like any other request, for the same period, also as proof of the answer given.
2.j Abuse reports
Anyone who receives through the Service a document they believe fraudulent can report it from /report, without an account. We keep the message, the reference given, the reporter's email only if given (it is optional), the IP address and the user agent. They serve to identify and stop fraudulent use of the Service, on the basis of our legitimate interest and that of the recipients in not being deceived (art. 6(1)(f)). The report is read by a person and on its own suspends or blocks nothing. The report and the notification concerning it are deleted 24 months after closing (when it is archived as handled or as unfounded); while it is open, that is still to be examined, it is not deleted. If it led to a measure that may be needed in a dispute, the necessary data stays in the file of the account concerned under that account's rules.
3. Provision of data
The account data is necessary: without it the service cannot be provided, and the billing data is also required by legal obligations. In the contact form name, email and message are necessary to be able to answer; phone and company are optional. The consents of §§ 2.a and 2.b and the one to cookies and measurement tools are optional and refusing them has no consequence on the Service.
4. Recipients and sub-processors
Internally: only the people authorised and instructed by the controller, on the principle of least privilege.
Externally, the parties listed in subresponsabili.md, where the services, the location and the safeguards of each are also found. In summary:
| Who | Role | What they see | Where |
|---|---|---|---|
| OVHcloud (OVH SAS, FR) | sub-processor (hosting) | the infrastructure hosting the service and the backup copies | servers in Warsaw (PL), copies in Gravelines (FR) |
| Brevo SAS (FR) | sub-processor | all outgoing messages, email and SMS: recipient, number, subject, text | EU |
| Revolut | payment provider: an independent controller for the payment data, under its own notice | name and billing data, amount and outcome. Card details do not pass through our systems: they are typed into the provider's page or form; we receive and keep only a reference (token), the expiry and the last four digits | EU |
| Openapi S.p.A. Unipersonale (Rome), intermediary | sub-processor | for the qualified electronic seal and the timestamp, only if requested: the whole document (for the seal) and its fingerprint (for the timestamp) | EU (data in Belgium); one of its sub-processors is in the United Kingdom (§ 5) |
| Namirial S.p.A. (Senigallia), qualified trust service provider behind Openapi | second-level sub-processor; independent controller for its own client data | issues the seal's certificate and the timestamp | EU |
| European Commission (VIES) | public service | a business's VAT number, to check it | EU |
| Italian Revenue Agency (Exchange System, SdI), the tax adviser and the provider of the accounting and e-invoicing software | recipients by legal obligation or processors | billing data and orders | Italy |
| Judicial and supervisory authorities | when the law requires it | only the data requested, after informing the client where permitted (DPA § 2.4) | — |
| Google Ireland Ltd, OpenAI Ireland Ltd, LinkedIn Ireland Unlimited Company, Meta Platforms Ireland Ltd | only with consent to the cookies and measurement tools of the public site (§ 10) | identifiers and browsing data of those who consented | Ireland; § 5 for the United States |
5. Transfers of data to third countries
We do not transfer personal data outside the European Economic Area to provide the Service, with the two clarifications that follow, which we state expressly.
- Qualified seal (only if requested): one of Openapi's sub-processors, Mcloud Ltd, is established in the United Kingdom. The transfer is based on the European Commission's adequacy decision for the United Kingdom (art. 45 GDPR), which at the time of this notice is in force (renewed in December 2025, expiring on 27 December 2031); should it lapse, the standard contractual clauses (art. 46 GDPR) would apply or the seal would not be offered. Another of Openapi's sub-processors, Google Ireland Ltd, also belongs to a group whose parent is outside the EU: the data stays in Belgium (region europe-west1).
- Measurement and advertising tools (only with consent): the Irish companies of § 4 may transfer data to the United States. For Google the transfer is based on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023); for the other providers we rely on the safeguards each declares (an adequacy decision for certified companies or standard contractual clauses), stated in their respective notices. If you do not consent, no data is sent to these parties.
The criterion of preferring providers with a European contracting entity guides our choice of providers (in particular the mail provider, in 2026, to reduce exposure to the CLOUD Act). Should another transfer become necessary, this notice will be updated before it takes place. A copy of the safeguards is available on request at doconure@limepeak.it.
6. Automated decision-making
We carry out no automated decision-making that produces legal effects on data subjects, or that similarly significantly affects them, within the meaning of art. 22 GDPR.
The profiling described in § 2.b — which exists only for those who have expressly consented to it — does not fall under art. 22: it decides nothing, does not determine prices, limits or suspensions, and only produces which content and which proposals are shown. The right to object to it and to withdraw consent at any time remains. The security measures that block a suspicious sign-in or limit excessive requests act on the address and on the access key, do not assess people, and are reviewed by an operator on request.
7. Security measures
The measures in place are described in Annex II of the DPA: encryption of files at rest and of data in transit, a mandatory second factor, isolation between clients, encrypted backup copies, tamper-evident logs. It is not a list of intentions: it is checked against the system in operation. A personal data breach is handled under art. 33 GDPR: we notify the Garante within 72 hours when we are the controller and, when we are the processor, the controlling client within the periods of the DPA, with communication to the data subjects where art. 34 requires it.
8. The data subject's rights
Under arts. 15-22 GDPR one may ask for: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interest — always, and without giving reasons, for direct marketing — and one may withdraw consent at any time, without affecting the lawfulness of processing already carried out.
For the processing based on consent (§§ 2.a and 2.b) the quickest way is not to write to us: withdrawal is a switch in one's profile, takes effect immediately and stays recorded. For consent to the site's cookies and measurement tools the "Manage cookies" link at the bottom of every public page applies (§ 10). Art. 7(3) GDPR requires that withdrawing be as easy as consenting, and a form to fill in is not.
Requests are sent to doconure@limepeak.it. There is no cost. We answer within one month of the request, extendable by two in complex cases, with notice within the first month (art. 12 GDPR). If we have reasonable doubts about the identity of the writer, we may ask for information to confirm it. If the data is processed by us as processor (the block for signers above), we forward the request to the controller within 5 working days.
Complaint: it is always possible to turn to the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — garanteprivacy.it), or to the authority of the State of residence or where the alleged infringement took place (art. 77 GDPR), without prejudice to any other administrative or judicial remedy.
9. Retention: the criterion, not only the numbers
We keep the data for the time necessary for the purpose for which it is collected, and for the further period required by law or necessary to establish, exercise or defend a legal claim (art. 5(1)(e) GDPR). The table in § 2 states the periods for each category; the periods are applied by daily automatic procedures. At expiry the data is deleted or made anonymous.
9.1 Inactive account: archiving and anonymisation
Only the last successful production operation charged in credits counts as activity. In the absence of activity we write to the users after 12, 18 and 23 months, and again 7 days before archiving.
- After 24 months: archiving, reversible. Access, API keys, automatic notifications and processing are suspended; the data and the credits remain. It can be reactivated on verified request.
- After 5 years in the archive (about 7 years of total inactivity), after a notice 30 days before, or at the data subject's request: anonymisation, irreversible. The operational identity (names, emails, phone, keys, templates, documents not subject to an obligation) is removed and the remaining credits are lost. It is our tool for acting on a request for erasure (art. 17).
- If the organisation has a negative balance (a debt towards us, for example after a VAT adjustment), automatic anonymisation does not take place: a person on our team assesses whether to proceed, waiving the claim, or to keep the account archived to protect our right to payment (legitimate interest, art. 6(1)(f), and defence of legal claims).
After anonymisation the following remain, each with its own period:
| What | For how long | Why |
|---|---|---|
| Orders, invoices, statements, VAT adjustments, billing data (company name, VAT number, tax code, address, PEC, recipient code) and the record of the acceptance of the Terms (with IP) | 10 years from the end of the calendar year of the last record, then deleted | legal obligation, art. 17(3)(b) GDPR and art. 2220 of the Italian Civil Code; defence of legal claims |
| Evidence of signing processes | 10 years, then made anonymous in place | DPA § 4.3 (data processed as processor) |
| Ledger of credit movements | with the anonymous shell | it contains numbers and identifiers, not people |
| Audit trails | not modifiable (§ 2.g) | integrity of the chain |
| Aggregate statistics | without limit, without personal data (the counters per key, 400 days) | they are not personal data |
The email address of whoever is anonymised is removed with the act: the last message the account receives is the notice.
9.2 Documents uploaded for signature
The PDF files the client uploads so that they are signed are its content: we process them as processor (DPA). They are kept encrypted, for 30 days from upload (up to 365 at the client's request) and, if signed in a signing process, for as long as they are needed for the evidence of that process (10 years): the ten-year period concerns data processed as processor and not as controller, and is governed by the DPA; it meets the need to prove the validity of a signature for as long as it can be challenged.
10. Cookies and similar technologies
The detail, with the names, durations and purposes of each cookie and of each tool, is in the cookie policy. In summary:
- Without consent, only what is needed to provide the service requested: the session cookie (for access and to protect forms), the preference on the console's navigation bar and, on the public site, the cookie that remembers your choice about cookies. The signing pages, the app, the console and the administration area contain no measurement tools or advertising.
- With your consent, and only on the public site (not on the signing pages nor in the console): measurement of visits and campaigns and measurement of advertising conversions (Google Analytics 4 and Google Ads; OpenAI's pixel and conversions interface; LinkedIn's Insight Tag and conversions interface; the Meta pixel). No request to these parties is sent before your choice, and until then Google's consent signals (Consent Mode) are all denied. The events we send from our server (to Google Analytics, OpenAI and LinkedIn; none to Meta) and the conversions we upload to Google Ads with a file concern only those who consented.
- You can refuse everything as easily as you accept, choose by purpose, and change your mind whenever you like from the "Manage cookies" link at the bottom of every page. The choice is remembered for 6 months; then we ask you again (Guidelines of the Garante of 10 June 2021).
11. Minors
The Service is addressed to businesses and professionals and is not intended for persons under 18. We do not knowingly collect data of minors: if we become aware of it, we delete it. A client that has a minor sign does so under its own responsibility as controller.
12. Scope: businesses and professionals only
The Service is sold only to those acting in the course of a business, commercial, craft or professional activity and is invoiced to a VAT number. This notice is therefore addressed to the natural persons acting on the client's behalf and to those who visit the site, and to signers as above.
13. Changes
Every substantial change is notified to account holders with 30 days' notice and published with the effective date and the version. Previous versions are available on request.