Legal
Privacy policy
This is a courtesy translation of the Italian original. In case of any discrepancy, the Italian version prevails.
This notice explains how TetraOne S.r.l. processes the personal data of people who visit the website www.tetraone.ai and of those who contact us, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
01Data controller
The data controller is TetraOne S.r.l., with the following contact details:
- Company name
- TetraOne S.r.l.
- Registered office
- Viale dello Scalo di San Lorenzo 10, 00185 Rome (Italy)
- VAT no.
- [DATO DA INSERIRE]
- info@tetraone.ai
- Certified email (PEC)
- [DATO DA INSERIRE]
- Phone
- +39 352 000 6401
The controller has not appointed a Data Protection Officer (DPO), as it is not required to do so under Art. 37 GDPR.
02What data we process
- Browsing data
- Technical data sent by your browser while using the site (IP address, browser type, pages visited, time of the request). It is used to run the site and keep it secure; the IP address is only stored in pseudonymised form (hash).
- Data you provide
- Full name, company, email, phone number, services of interest and message entered in the form on the Contact page, or sent by email, phone or WhatsApp.
- Cookie preferences
- Unique consent ID, accepted categories, date and policy version. Details in the Cookie policy.
- Analytics data
- Only if you give your consent: usage data collected in aggregate form through Google Analytics 4.
03Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering requests sent through the form, email, phone or WhatsApp and sending the confirmation email | Pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR) | 24 months from the last contact, unless a contractual relationship is established |
| Managing the contractual relationship, invoicing and legal obligations | Contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR) | 10 years from the end of the relationship, for civil and tax obligations |
| Keeping the site secure and preventing abuse (e.g. automated spam submissions) | Legitimate interest of the controller (Art. 6(1)(f) GDPR) | 12 months |
| Recording and proving cookie choices | Legal obligation to demonstrate consent (Art. 7(1) GDPR) | 6 months for the technical cookie; the anonymised consent history for as long as needed to prove it was collected |
| Site usage statistics (Google Analytics 4) | Consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) | Until consent is withdrawn; data kept in GA4 for 14 months |
04How we process data
Data is processed electronically, by authorised staff and with appropriate technical and organisational measures: encrypted connections (HTTPS), database access restricted to backend systems only, pseudonymisation of IP addresses, logging of email deliveries. We do not carry out profiling or automated decision-making.
05Who we share data with
Data is not disclosed to the public. It may be processed on behalf of the controller, under an agreement pursuant to Art. 28 GDPR, by the following providers:
| Provider | Service | Place of processing |
|---|---|---|
| Supabase Inc. | Application database (contact requests, consent register) | EU (project region: [TO BE ENTERED]) — SCCs for any transfers |
| MailerSend (MailerLite Limited) | Sending transactional emails (confirmations and notifications) | EU (Ireland / Lithuania) |
| Vercel Inc. | Website hosting | USA — EU-US Data Privacy Framework / SCCs |
| Google Ireland Ltd. | Google Analytics 4 (only with consent) and Google Maps (only with consent) | EU / USA — EU-US Data Privacy Framework |
Data may also be shared with advisers (e.g. our accountant) and authorities, where required by law.
06Transfers outside the European Union
Some providers may process data in the United States. In these cases the transfer is based on the EU-US Data Privacy Framework adequacy decision or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).
07Your rights
At any time you can ask the controller for:
- access to your data and a copy of it (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data (Art. 17);
- restriction of processing (Art. 18);
- portability of your data in a structured format (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw the consent you have given, without affecting the lawfulness of prior processing (Art. 7(3)).
To exercise your rights write to info@tetraone.ai. We reply within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
08Whether providing data is mandatory
Providing the data marked as mandatory in the form is necessary to answer your request: without it we will not be able to get back to you. All other data is optional.
09Minors
The site and services are aimed at businesses and professionals. We do not knowingly collect data from people under 18.
10Changes to this notice
We may update this notice to reflect new regulations or changes to our services. The version in force and the date of the last update are shown at the top of the page.