Privacy policy

Data controller

The data controller is Cobaltica snc, Via La Louvière 2, 06034 Foligno (PG), Italy — VAT IT02790300541.

For any request concerning personal data, use the contact form at the foot of this page, call +39 0742 321231 or write to the registered address given above.

No data protection officer (DPO) has been appointed: none of the conditions in Article 37 GDPR applies, since Cobaltica is not a public body and its core activity involves neither large-scale systematic monitoring nor large-scale processing of special categories of data.

Data collected through the contact form

The contact form at the foot of every page collects the data the visitor enters voluntarily:

• first and last name
• email address
• company and telephone number, if provided
• the selected request type and the message text
• any attached files, including their name and contents

The data is delivered by email to a company mailbox. It is not stored in any database, marketing automation tool or third-party CRM: the site keeps no copy of the messages sent. Attachments are never saved on the server: they stay in the temporary folder for as long as it takes to compose the message and are deleted when the request ends, so there is no address on this site from which they could be downloaded again.

Whether providing the data is required

Name, email address, message text and the consent checkbox are required: without them the form will not submit and the enquiry cannot be handled. Company, telephone number and attachments are optional and only serve to reply in whatever way suits the sender best.

Using the form is not compulsory in any case: you can always call +39 0742 321231 or write by post to the registered address.

Legal basis and purpose

Processing of form data is based on the consent given when it is submitted (Art. 6(1)(a) GDPR) and on pre-contractual measures taken at the data subject's request (Art. 6(1)(b)).

That data serves the first contact only: reading the enquiry received, replying to it and managing any relationship that follows. It is not used for promotional mailings, newsletters, profiling or behavioural analysis, and it is not disclosed or sold to third parties for their own purposes.

The visit statistics described below rest on a different, self-standing legal basis: the consent given on the cookie banner (Art. 6(1)(a)), which can be withdrawn at any time.

CVs and job applications

One of the options in the “What do you need” menu is sending a CV. Anyone who chooses it and attaches their CV is sending data with a purpose different from the commercial one: assessing a job application. The legal basis is pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR), alongside the consent given on submission.

CVs received stay in the company mailbox, are read by the partners, and are neither disclosed to anyone else nor entered into candidate databases or third-party recruitment services. Where no suitable position is open, they are kept for at most twelve months from submission and then deleted; deletion can be requested sooner, at any time, through the contact form or by phone.

Please do not include in your CV or attachments any data belonging to the special categories of Article 9 GDPR — ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, health, sex life or sexual orientation — nor any criminal-offence data: none of it is needed to assess an application, and none of it is requested. If it arrives anyway, it is deleted together with the rest at the point stated above.

As with every other message from the form, CVs are not used to train artificial intelligence models and are not put through automated assessment: a person reads them.

Visit statistics

The site uses Google Analytics 4 to know how many people visit it, which pages they arrive from and which they read. It is the only third-party service present, and it is on only for those who have accepted it on the banner: until you accept, no measurement cookie is written and no identifier is assigned.

The data collected covers pages viewed, the approximate length of the visit, the type of device and browser, the rough geographic area and the referring site. It does not include names, email addresses or anything else you may have sent us: measurement is never cross-referenced with messages received through the form, and for Cobaltica it remains a count, not a list of people.

The IP address is used by Google to derive the approximate geographic area and is not recorded in the reports. Advertising consent is explicitly denied by the site's configuration: the data feeds no personalised ads, no remarketing lists and no commercial profiling.

For completeness: Google's tag is loaded even before the choice is made, in consent-denied mode — no cookies, no identifiers, just an anonymous count. It is still a connection to Google's servers, which in making it see the visitor's IP address. The technical detail, and how to avoid it altogether, are in the cookie policy.

No individual profiling, no model training

No automated decision-making takes place within the meaning of Article 22 GDPR. The statistics measure the aggregate behaviour of visits and produce no decisions, assessments or predictions about individual people.

Messages received through the form are not used to train artificial intelligence models, nor fed into automated analysis systems: a person reads them, and they serve to reply. The same applies to any data that emerges in the conversation that follows.

The automated checks that defend the form against spam assess the single request against fixed rules — how many links it contains, where it comes from, whether the email domain exists — and build no profile of the sender: their outcome is not kept beyond the request itself. No message is ever discarded by a machine: at most it arrives flagged, and a person still reads it and decides.

Data collected automatically

The web server records in its technical logs the IP address, date and time of the request, the page requested and the browser type. This data is necessary for the operation and security of the service and is processed on the basis of the controller's legitimate interest in keeping the site reachable and defending it from abuse (Art. 6(1)(f)). It is not consulted to identify individual visitors, nor cross-referenced with form data.

To prevent the contact form being used by automated programs, on every submission the site notes two things and no more in a technical file: a pseudonymous fingerprint of the IP address — derived with a one-way cryptographic function and a secret key, so it cannot be traced back to the address it came from — and the date and time of the attempt. Nothing else: not the content of the message, not the fields filled in, not the browser type. The file sits outside the site root and is reachable from no web address. This processing too rests on the controller's legitimate interest in defending the form from automated submission (Art. 6(1)(f)).

Besides the measurement cookies, the site uses two technical ones: the session cookie protecting the contact form, and the one remembering the choice made on the banner. It embeds no remote fonts, maps, videos or social buttons: every other resource is served from the cobaltica.it domain. The detail, cookie by cookie, is in the cookie policy.

Pages and form submissions travel encrypted over HTTPS.

Retention

Messages received through the form stay in the company mailbox that receives them for as long as it takes to fulfil the purpose they were sent for: replying to the enquiry and managing any relationship arising from it. Once that purpose is spent, they are deleted.

If the contact leads to a contractual relationship, the data becomes part of that relationship's records and follows the retention periods required by law, in particular the ten years set by Article 2220 of the Italian Civil Code for accounting records.

Erasure can be requested at any time through the contact form or by telephone, with no need to give a reason.

Measurement data relating to an individual user or event is kept by Google for the period set on the Analytics property, in no case longer than fourteen months; the aggregate reports that remain after that term contain nothing traceable to a person. Consent, and with it measurement, lapses after six months in any case, when the banner asks again.

Server logs are rotated automatically by the hosting provider and kept for the short technical period needed to diagnose faults and attempted abuse.

The pseudonymous submission fingerprints described above are deleted automatically after twenty-four hours.

Recipients and processors

The data remains accessible only to the partners and collaborators of Cobaltica who have to answer the enquiry, and to the technical suppliers strictly needed to run the site, appointed as data processors under Article 28 GDPR:

• IONOS, hosting provider for the site, on servers located in Spain;
• Scaleway SAS, Paris, provider of the infrastructure hosting the mail service that receives form submissions;
• Google Ireland Limited, Dublin, for visit statistics only, and only where consent has been given.

No one else receives the data, save for the obligation to disclose it to judicial or public security authorities in the cases provided for by law.

Transfers outside the European Union

Contact form data does not leave the European Economic Area: hosting and mail sit in Spain and in France.

Measurement data, on the other hand, may be transferred to the United States, where the Google group companies that process it are based. The transfer is covered by the adequacy decision adopted by the European Commission on 10 July 2023 for the EU-US Data Privacy Framework, to which Google LLC adheres, and additionally by the standard contractual clauses provided for in Article 46 GDPR.

Anyone preferring that no browsing data reach the United States can simply refuse on the banner, or withdraw consent later: the rest of the site works in exactly the same way.

Rights of the data subject

Data subjects may at any time request access to their data, its rectification or erasure, restriction of processing, and data portability, and may object to processing. They may also withdraw consent, without affecting the lawfulness of processing carried out before withdrawal.

Consent to statistics can be withdrawn in one click: at the foot of every page, next to the links to the notices, there is a «Cookie choice» item.

Other requests should be sent through the contact form, by telephone or by post to the registered address, and are answered within one month, as required by Article 12 GDPR. No charge applies.

The right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or to bring the matter before a court remains unaffected.

Changes to this notice

If the tools used by the site or the suppliers involved change, this page is updated before the change takes effect, and the date at the top changes accordingly. Earlier versions can be requested through the contact form.