Privacy Policy

The Website collects the following categories of data:

• Browsing data: the IT systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (for example, IP address, browser type and version, operating system, pages visited, date and time of access, and server response code). These data are used to ensure the technical operation and security of the Website (for example, to prevent cyberattacks and automated access) and, only in aggregate form, for statistical purposes. They are not used to identify users, except where cybercrimes are investigated at the request of the competent authority.
• Data provided voluntarily through contact forms: name, company name, business email address, message content and any other information the user chooses to include. Providing data marked as mandatory is necessary to respond to the enquiry; failure to provide such data makes it impossible to follow up on the contact. Users are asked not to include special categories of data in their messages (for example, health data, political opinions or religious beliefs) or unnecessary data relating to third parties.
• Data provided by email: voluntarily sending messages to the email addresses listed on the Website results in the acquisition of the sender’s address and any other personal data contained in the message, which are processed to respond to the enquiry.
• Cookies and tracking tools: the Website uses technical cookies, which are necessary for the operation and security of its pages and for storing cookie preferences and, only with the user’s prior consent, third-party statistical and marketing cookies (Google Analytics and Google Ads), described in the “Cookies” section below.

Cookies are small text files that websites store in the user’s browser during a visit. The Website uses the following categories of cookies and similar tools.

Users’ cookie preferences are collected and managed through Cookiebot, a consent-management platform provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen (Denmark), which acts as a Processor. When users first access the Website, Cookiebot displays the banner, automatically blocks non-technical cookies until consent is given and records the choice made (consent identifier, date and time, consent status, browser user agent and truncated IP address) so that consent can be demonstrated as required by Article 7 of the GDPR. The user’s choice is stored in a technical cookie (CookieConsent) for up to 12 months. Data are processed within the European Union/European Economic Area (EU/EEA). Provider privacy policy: https://www.cookiebot.com/en/privacy-policy/

Closing the banner using the “X” or choosing to reject retains the default settings, and only technical cookies are installed. Users can change or withdraw their consent at any time through the “Cookie preferences” link in the footer of every page of the Website. The banner will not be shown again for six months after the choice is made, unless there are significant changes to the processing conditions (for example, the introduction of new third parties) or the user deletes their cookies.

The up-to-date, detailed list of cookies installed by the Website, including name, provider, purpose and duration, is available in the “Cookie preferences” panel, which is automatically generated and updated by Cookiebot on the basis of periodic scans of the Website.

• Consent-management cookies (Cookiebot), to store the user’s cookie preferences.
• Security cookies (Cloudflare, e.g. _cfbm), used by the Website’s network and security infrastructure to distinguish legitimate traffic from automated traffic and protect the Website from attacks. Duration: 30 minutes.

The Website uses, or may use, Google Analytics 4, a statistical analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 (Ireland) (“Google”), to understand in aggregate form how the Website is used (for example, most visited pages, visit duration, approximate geographical origin and device type) and to improve its content and functionality.

• Google Analytics is activated only after the user has consented to the “Statistics” category.
• The Website implements Google Consent Mode: without consent, Google tags neither set nor read cookies.
• According to Google, Google Analytics 4 does not log or store the IP addresses of users in the European Union; these are used solely to derive an approximate location (for example, country or city) and are then discarded.
• Data-sharing features for Google advertising purposes (Google Signals) and the User-ID feature are disabled; ICOA does not send Google Analytics any data that could directly identify the user (such as name or email address).
• Main cookies: ga, ga_<ID>. Duration: up to two years from the last visit (unless deleted by the user). User-level and event-level data are retained by Google for a maximum of 14 months, after which they are automatically deleted.

Google’s privacy policy: https://policies.google.com/privacy?hl=en How Google uses data from partner sites: https://policies.google.com/technologies/partner-sites?hl=en

The Website may use Google Ads, provided by Google Ireland Limited, for:

• conversion tracking, namely measuring whether a user who reaches the Website through an ICOA advert performs a relevant action (for example, submitting a contact form), in order to assess campaign effectiveness;
• where applicable, remarketing, namely displaying ICOA adverts to people who have already visited the Website while they browse other websites or Google services.

These tools are activated only after the user has consented to the “Marketing” category and, through Google Consent Mode, neither set nor read cookies without consent. Main cookies: gclau, gclaw (duration up to 90 days) and cookies set by Google on its own domains (for example, IDE, test_cookie, with a duration of up to 13 months). ICOA does not send Google the data entered in contact forms (name, email or message) for advertising purposes.

In addition to using the “Cookie preferences” panel, users can manage Google advert personalisation at https://myadcenter.google.com/

• Google Fonts: the Website uses typefaces supplied by Google. To display them, the user’s browser connects to Google’s servers, transmitting the IP address and technical information about the browser. Google states that it does not set cookies or use such data to profile users. Legal basis: the Controller’s legitimate interest in presenting the Website with consistent typography.
• External links: the Website contains links to third-party websites (for example, LinkedIn and Ecologi). These are simple links that do not set cookies on the Website; once users reach those websites, the privacy policies of their respective operators apply.

Users can also block or delete cookies through their browser settings. Disabling technical cookies may affect the proper functioning of the Website.

Data are processed for the following purposes:

• to ensure the proper functioning and security of the Website, including protection against cyberattacks and automated access (legal basis: the Controller’s legitimate interest, Article 6(1)(f) GDPR);
• to respond to enquiries submitted through contact forms or by email and, where requested by the user, to provide information, quotations or proposals relating to ICOA’s services (legal basis: performance of pre-contractual measures taken at the data subject’s request, Article 6(1)(b) GDPR, and the Controller’s legitimate interest in responding to enquiries received, Article 6(1)(f) GDPR);
• to prevent spam, abuse and fraud relating to contact forms, including through artificial intelligence systems, as described in the dedicated section (legal basis: the Controller’s legitimate interest in the security of its systems and the prevention of fraud, Article 6(1)(f) and Recitals 47 and 49 GDPR);
• to enrich and qualify enquiries received (data augmentation), including through artificial intelligence systems, as described in the dedicated section (legal basis: the Controller’s legitimate interest in understanding and managing enquiries received effectively, Article 6(1)(f) GDPR; users may object at any time);
• to carry out statistical analysis of Website usage through Google Analytics (legal basis: the user’s consent, Article 6(1)(a) GDPR and Article 122 of the Privacy Code);
• to measure advertising campaign effectiveness and, where applicable, carry out remarketing through Google Ads (legal basis: the user’s consent, Article 6(1)(a) GDPR and Article 122 of the Privacy Code);
• to collect and document cookie consent through Cookiebot (legal basis: compliance with a legal obligation, Article 6(1)(c) GDPR, in relation to Article 7(1) GDPR and Article 122 of the Privacy Code);
• to comply with legal obligations, regulations or requests from authorities (legal basis: applicable legal obligations, Article 6(1)(c) GDPR);
• to establish, exercise or defend a right of the Controller in judicial or extrajudicial proceedings (legal basis: the Controller’s legitimate interest, Article 6(1)(f) GDPR).

Where processing is based on legitimate interest, the Controller has assessed that this interest is not overridden by the rights and freedoms of data subjects, taking into account the nature of the data (mainly professional contact details) and the reasonable expectations of anyone contacting a company through its website. Users may nevertheless object to such processing on grounds relating to their particular situation, as explained in the “Your rights” section.

Data submitted through contact forms are used exclusively for the purposes for which they were provided, namely to manage and respond to the user’s enquiry and for the closely related purposes described in this notice (security, spam and fraud prevention, and enquiry qualification).

In particular, ICOA:

• does not use data submitted through forms to send newsletters or unsolicited promotional or advertising communications;
• does not sell or share data with third parties for their marketing purposes;
• does not use form data for commercial or advertising profiling.

Should ICOA wish in future to send users commercial or promotional communications, or otherwise process their data for marketing purposes other than responding to an enquiry received, it will always request specific, freely given and explicit consent, which will be separate from the enquiry submission process and entirely optional. Any consent given may be withdrawn at any time, as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal.

ICOA may also process data submitted through contact forms using artificial intelligence (AI) systems, exclusively for the following purposes:

• Anti-spam and anti-fraud: automated analysis of the content and metadata of enquiries (for example, message text, email address, originating domain and submission frequency) to identify and filter unwanted, automated, fraudulent or malicious messages (for example, phishing, attempted scams or harmful content).
• Enquiry enrichment and qualification (data augmentation): classification of enquiries by topic and service of interest, message summarisation, normalisation of data entered and, where useful in providing a relevant response, supplementation with professional information about the enquirer’s company obtained from publicly accessible sources (for example, the company website, public registers or public professional profiles), such as the company’s industry, size or location, or the enquirer’s professional role.

In relation to such processing, ICOA guarantees that:

• data are processed only to the extent necessary for the stated purposes, and no special categories of data are collected or inferred (Article 9 GDPR);
• no decisions are based solely on automated processing where such decisions produce legal effects or similarly significantly affect the user (Article 22 GDPR). Enquiries flagged as possible spam or fraud may be reviewed by ICOA staff; users who believe that a legitimate enquiry has gone unanswered may write to [email protected] to request human intervention;
• the AI service providers used act as Processors under a contract pursuant to Article 28 GDPR and are contractually prohibited from using ICOA’s data to train or improve their models;
• information obtained through enrichment is used solely to manage the enquiry received and not for marketing or advertising profiling;
• users may object at any time to the enrichment of their data by writing to [email protected].

Processing is carried out using IT tools, with appropriate organisational and technical measures to ensure the security and confidentiality of data (for example, encryption of communications through the HTTPS protocol, access controls and multi-factor authentication on management accounts).

Data are processed at the Controller’s premises by authorised and trained personnel, and by trusted third parties acting as Processors pursuant to Article 28 GDPR. The main providers are:

Resend (Plus Five Five, Inc., San Francisco, USA) – resend.com

ServiceSending emails generated by the Website’s contact forms

Data processedData entered in the form, email address, delivery metadata

Processing location and safeguardsUnited States. European Commission Standard Contractual Clauses and participation in the EU–US Data Privacy Framework

Cookiebot (Usercentrics A/S, Copenhagen, Denmark) – cookiebot.com

ServiceCookie consent management and recording

Data processedConsent identifier and status, date and time, user agent, truncated IP address

Processing location and safeguardsEuropean Union/European Economic Area

Google (Google Ireland Limited, Dublin, Ireland)

ServiceGoogle Workspace (receipt and management of email); Google Analytics and Google Ads (only with consent); Google Fonts

Data processedContent of emails received; browsing data and online identifiers

Processing location and safeguardsEU and United States (Google LLC). Google LLC’s participation in the EU–US Data Privacy Framework and Standard Contractual Clauses

Cloudflare (Cloudflare, Inc., San Francisco, USA)

ServiceNetwork infrastructure, content delivery (CDN), and Website security and protection

Data processedBrowsing data, IP address

Processing location and safeguardsEU and United States. Participation in the EU–US Data Privacy Framework and Standard Contractual Clauses

Artificial intelligence service providers

ServiceAnti-spam and anti-fraud analysis and enquiry enrichment

Data processedData entered in the form and publicly available professional information

Processing location and safeguardsEU or third countries with the safeguards described below; contractual prohibition on using data to train models

Hosting and cloud service providers

ServiceWebsite hosting and technical operation

Data processedBrowsing data

Processing location and safeguardsEU or third countries with the safeguards described below

An up-to-date list of Processors may be requested at any time by writing to [email protected].

Data may also be disclosed to consultants and professionals (for example, lawyers and accountants) to the extent necessary for them to perform their engagements, and to public and judicial authorities where required by law. Data are not made publicly available.

Some of the providers listed above are based, or process data, outside the European Economic Area (EEA), particularly in the United States. In such cases, transfers take place exclusively in accordance with the safeguards set out in Chapter V of the GDPR, and in particular:

• on the basis of the European Commission’s adequacy decision of 10 July 2023 relating to the EU–US Data Privacy Framework, for certified US providers (Article 45 GDPR); and/or
• on the basis of the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR), supplemented where necessary by additional measures.

Users may obtain information about the safeguards adopted by writing to [email protected].

Data are retained for no longer than strictly necessary to achieve the purposes for which they were collected, according to the following criteria:

• contact form and email data: for the time necessary to manage the enquiry and follow up on any further exchanges on the same matter. If the enquiry leads to a contractual relationship, the data are retained for the duration of that relationship and subsequently for the period required by civil and tax legislation (normally ten years, Article 2220 of the Italian Civil Code). Enquiries that do not lead to any further relationship are reviewed periodically and deleted when no longer useful for managing the contact and, in any event, no later than 36 months after the last contact;
• enquiries identified as spam or fraudulent: deleted as soon as their nature has been verified, unless they need to be retained to investigate or counter abuse or to defend a right in court;
• data used to enrich enquiries: retained together with the enquiry to which they relate and for the same period;
• browsing data and security logs: for the time necessary to ensure the security of the Website and identify any abuse, according to the infrastructure providers’ settings, unless it is necessary to investigate crimes or respond to requests from the authorities;
• cookies: for the duration indicated in the “Cookies” section and in the “Cookie preferences” panel; Google Analytics user-level and event-level data are retained by Google for a maximum of 14 months;
• cookie consent records: for the period necessary to demonstrate the consent given, according to Cookiebot’s settings.

In all cases, users may request the deletion of their data at any time by writing to [email protected]; ICOA will do so without undue delay, unless retention is necessary to comply with a legal obligation or to establish, exercise or defend a right in court.

At the end of the periods indicated, data are deleted or anonymised.

Under Articles 15–22 GDPR, users have the right to:

• access their data and obtain information about how they are processed;
• request their rectification or completion;
• request their erasure (the “right to be forgotten”), in the cases provided for by law;
• obtain the restriction of processing;
• receive the data they have provided in a structured, commonly used and machine-readable format and transmit them to another controller (data portability), where applicable;
• object at any time, on grounds relating to their particular situation, to processing based on legitimate interest, including anti-spam and anti-fraud analysis and enquiry enrichment;
• object at any time, without needing to give a reason, to any processing for marketing purposes;
• withdraw consent, where given (for example, for statistical and marketing cookies through the “Cookie preferences” link), without affecting the lawfulness of processing based on consent before withdrawal;
• not be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them;
• lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it) or with the supervisory authority of the EU Member State in which they habitually reside or work.

To exercise these rights, simply contact the Controller at [email protected]. ICOA will respond without undue delay and, in any event, within one month of receiving the request; this period may be extended in the cases provided for in Article 12 GDPR.

The Website and ICOA’s services are intended for businesses and professionals and are not intended for anyone under 18 years of age. ICOA does not knowingly collect data from minors; if it becomes aware that it has done so, it will delete them.

This notice may be updated periodically, for example following regulatory changes or the activation of new services (such as the actual activation of Google Analytics or Google Ads). The most recent version is always available on the Website, together with the date of the latest update. If material changes affect processing based on consent, consent will be requested again.