This privacy notice, provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), describes the personal data processed by Setek S.r.l. through this website, together with the purposes, legal bases and services involved.
Personal data processed
This is an institutional (showcase) website and does not use any profiling, statistical or marketing tools. The only personal data processed are those voluntarily provided by the user through the contact form:
- Contact form — First name, Last name, Email, Phone number (optional) and message content
- Technical browsing data — IP address (full, not anonymised), requested URL, HTTP method, status code, user-agent, referer, date and time, and approximate geographic area derived from the IP address
Server access logs
For information security, abuse and fraud prevention, diagnostics and service statistics, the website records and stores access logs (the technical browsing data listed above, including the full IP address). The legal basis is the Controller's legitimate interest (Art. 6(1)(f)): processing is limited to the data indicated, is not aimed at profiling, and the logs are accessible only to authorised personnel on a need-to-know basis. Logs are stored on Google Cloud infrastructure (Cloud Storage and BigQuery) with data residency exclusively within the European Union, with no transfers outside the EU, and are retained for 12 months with automatic deletion. The data subject may object at any time to processing based on legitimate interest pursuant to Art. 21 of the GDPR.
Purposes and legal bases
- Responding to enquiries submitted through the contact form — legal basis: pre-contractual measures and the Controller's legitimate interest in responding (Art. 6(1)(b) and (f))
- Ensuring the proper operation and security of the website, including anti-bot protection of the contact form — legal basis: legitimate interest (Art. 6(1)(f))
Services and data processors
To deliver the service, Setek S.r.l. relies on the following providers, appointed as data processors:
- Google (Google Cloud Run) — website hosting, with data center located in the European Union (Milan, Italy)
- Google Cloud EMEA Limited — storage and retention of the navigation logs (Cloud Storage and BigQuery), appointed as data processor pursuant to Art. 28 GDPR, with data center in the European Union
- Google (Gmail / Google Workspace) — sending and delivery of emails generated by the contact form
- Cloudflare, Inc. — Turnstile anti-bot service protecting the contact form
Transfer of data outside the EU
The Cloudflare anti-bot service may involve processing of data in the United States. Such transfer is governed by the Standard Contractual Clauses adopted by the European Commission and by the applicable adequacy mechanisms (EU-US Data Privacy Framework).
Retention period
Data submitted through the contact form is retained for the time necessary to handle the request and to comply with legal obligations; navigation logs are retained for 12 months with automatic deletion, solely for the security and diagnostic purposes indicated.
Rights of the data subject
The data subject may exercise at any time the rights set out in Articles 15-22 of the GDPR (access, rectification, erasure, restriction, portability, objection and withdrawal of consent) by writing to the Controller (privacy@setek.it) or to the Data Protection Officer (dpo@setek.it). A complaint may also be lodged with the Italian Data Protection Authority (Garante).
Data Controller
Setek S.r.l., Strada Prati 12/3, 65124 Pescara. Email address of the Data Controller: privacy@setek.it