Privacy policy - Personal Data Processing Notice

1. Who processes your data

The Data Controller is:

2. What this notice covers

This notice describes the processing of personal data of users who visit the things5.com website, in its Italian and English language versions, fill in the forms on the site or interact with its content.

It does not apply to:

• the Things5 platform, accessible after authentication, which operates on infrastructure separate from that of the website and for which the contractual terms and the dedicated notice apply.
• third-party websites reachable via links on the site, for which please refer to the respective notices.

3. What data we collect

Browsing data. IP address, browser and operating system type and version, pages visited, date and time of the request, referring page, duration of the visit. This data is collected automatically by the IT systems that manage the site and, by its nature, could allow users to be identified through processing and association with data held by third parties.

Data you provide voluntarily. The data you enter in the forms on the site and in the calendar to book a demo: first name, last name, email address, phone number, company, role, product of interest and the content of your message or notes. Mandatory fields are marked on the form; failure to provide them prevents us from following up on the request.

Data collected through cookies and tracking tools. Information about your interaction with the site, including pages viewed, clicks and cursor movements. In addition to cookies, some tools use the browser’s local and session storage. Details of the tools used, their purposes and their duration are in the Cookie Policy.

4. Why we process your data and on what legal basis

4.1 Provision of the website and IT security

Data processed

browsing data, technical cookies.

Legal basis

the Controller’s legitimate interest in providing the requested service and ensuring the security of its infrastructure (Art. 6.1.f GDPR). Technical cookies do not require consent pursuant to Art. 122 of Legislative Decree 196/2003.

Retention

technical logs are retained for the time necessary for the operation, diagnostic and security purposes of the service, according to the retention periods set by the Controller for the infrastructure hosting the site, and are in any case deleted or anonymized when no longer necessary for such purposes, save for the need for longer retention in the event of an investigation into unlawful conduct or a request from the authorities.

4.2 Responding to requests for information and booking a demo

Tools

the forms on the site and, for demos, the Cal.com calendar, which opens over the page when you press “Book a demo”. If you have already typed your email in the field next to the button, the calendar receives it pre-filled. The demo takes place by video call on Google Meet.

Data processed

first name, last name, email, phone, company, role, message content. For demos, also the product of interest, the chosen day and time, any notes you add, the email addresses of the people you invite and any parameters in the address of the page you book from, such as campaign parameters. If you invite other people, please let them know that their data is processed in accordance with this notice.

Legal basis

performance of pre-contractual measures taken at the request of the data subject (Art. 6.1.b GDPR). Your consent is not required for this purpose: submitting the form is itself the request we act upon.

Retention

for the time necessary to handle the request and, subsequently, for 24 months for the purpose of managing the business relationship, unless you object.

4.3 Newsletter subscription

Data processed

email address. Together with your subscription we record the page you subscribed from and the text shown next to the form, as proof of your subscription.

Tool

your address is sent directly from this site to HubSpot, which manages the subscriber list and newsletter delivery.

Legal basis

your consent (Art. 6.1.a GDPR and Art. 130 of Legislative Decree 196/2003) and the Controller's legitimate interest in keeping in touch with those who have shown interest in its content and services (Art. 6.1.f GDPR). Subscribing, that is entering your email address and pressing “Subscribe” after reading the text next to the form, serves as proof of your consent and of your interest: no further confirmation steps are required.

Withdrawal and objection

you can withdraw your consent and object to the processing at any time via the unsubscribe link included in every communication or by writing to dpo@visup.it. Withdrawal does not affect the lawfulness of processing carried out before it.

Retention

until consent is withdrawn. Proof of the consent given is retained for the period necessary to demonstrate its validity and in any case for no longer than 5 years from withdrawal.

4.4 Measurement and statistical analysis of site usage

Tools

Google Analytics 4, via Google Tag Manager.

Data processed

browsing data, pages viewed, interactions and identifiers collected through tracking tools, in pseudonymized form.

Legal basis

your consent, given through the preference panel for tracking tools (Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003).

Processing of the IP address

the provider documents that Google Analytics 4 does not log or store IP addresses. Data originating from devices located in the European Union is collected through domains and servers located in the Union, and the IP address is used solely to derive approximate city- or area-level geolocation information, after which it is immediately discarded without being logged.

Retention

user- and event-level data is retained for 14 months. This period does not apply to aggregated data in standard reports, which does not allow individual users to be identified.

4.5 Analysis of browsing behavior (heatmaps and session recording)

Tool

Hotjar, provided by Hotjar Ltd, a company based in the European Union (Malta) belonging to the Contentsquare SAS group.

Data processed

interactions with pages, clicks, cursor movements, scrolling, screen size and characteristics, device type, operating system and browser, pages visited. The provider temporarily processes your IP address to monitor the performance of its own service and application errors, and automatically deletes it within thirty days.

Legal basis

your consent (Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003).

Measures adopted

the tool is configured to exclude the content of text input fields from recording, so that the data you type into forms is not captured.

Tracking tools used

Hotjar’s code installs first-party cookies and also uses the browser’s local and session storage. Durations range from a few milliseconds, for cookies that verify browser functionality, to three hundred and sixty-five days for the user identifier. The full list is in the Cookie Policy.

Retention

session recordings and heatmaps are retained for 365 days from the date of capture, after which the provider initiates an automatic deletion process that removes the data from its servers, including backups, in a non-recoverable manner. Any associated user attributes are deleted after 365 days of inactivity for users with an identifier and after three months for unidentified users.

4.6 Marketing and advertising campaign measurement

Tools

Meta Pixel (Meta Platforms Ireland Limited) and Google advertising features (Google Ireland Limited).

Data processed

browsing data, device information, identifiers collected through tracking tools.

Purpose

measuring the effectiveness of advertising campaigns, reconstructing conversions and presenting relevant advertising communications on the platforms of the providers indicated.

Legal basis

your consent (Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003).

4.7 Display of video content

Tool

YouTube (Google Ireland Limited), in enhanced privacy mode.

Data processed

browsing data and tracking tools set by the provider when the video is started.

Legal basis

your consent (Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003). The video content is not loaded until you give consent; until then, a static preview image is shown.

4.8 Defense of the Controller’s rights

Legal basis

the Controller’s legitimate interest in establishing, exercising or defending a legal claim (Art. 6.1.f GDPR).

Retention

for the duration of the dispute and until the appeal deadlines expire.

5. Who can access your data

Your data is processed by the Controller’s authorized personnel, who have received appropriate instructions, and may be disclosed to the following parties acting as data processors pursuant to Art. 28 GDPR:

Your data may also be disclosed to public authorities where required by law. It is not disseminated or transferred to third parties for their own purposes.

5.1 Sub-processors

The processors listed above may engage additional providers (sub-processors), bound by contractual obligations no less stringent than those undertaken toward the Controller. The updated list of sub-processors is made available by each provider and can be requested by writing to dpo@visup.it.

6. Links to third-party sites and platforms

The site contains links to company profiles on YouTube and LinkedIn and to technical documentation. The mere link does not involve the transmission of personal data to the operators of such platforms: processing begins only if you decide to follow the link. In that case, the notices of the respective controllers apply, over which VISUP S.r.l. exercises no control.

7. Transfers to third countries

Some of the providers listed in point 5 are based in the United States or may transfer data there. In these cases, the transfer takes place on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, for entities that are certified, or on the basis of the Standard Contractual Clauses adopted by the European Commission, supplemented by additional safeguards where necessary. You can request a copy of the safeguards adopted by writing to dpo@visup.it.

8. Cookies and tracking tools

The site uses cookies and similar tools. Technical cookies, necessary for operation, are installed without requiring consent. All others are installed only after your consent, given through the banner shown on your first visit.

You can change or withdraw your choices at any time via the “Cookie Preferences” link in the footer of every page of the site. Details of the tools used, their purposes and the duration of each are in the Cookie Policy.

Details of the tools used, their purposes and the duration of each are in the Cookie Policy.

9. How we process your data

Processing is carried out using IT and telematic tools, with logic strictly related to the purposes indicated, and adopting technical and organizational measures appropriate to ensure a level of security suited to the risk, including encryption of communications, access control and limitation of processing to authorized personnel.

No automated decision-making processes are carried out that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.

10. Your rights

With regard to the data processed, you may exercise the following rights at any time:

• access to your personal data and information about its processing (Art. 15)
• rectification of inaccurate data or completion of incomplete data (Art. 16)
• erasure of data, in the cases provided for (Art. 17)
• restriction of processing (Art. 18)
• portability, i.e. receiving the data in a structured, commonly used format and having it transmitted to another controller (Art. 20)
• objection to processing based on legitimate interest (Art. 21)
• withdrawal of consent at any time, for processing based on it, without prejudice to the lawfulness of processing carried out previously (Art. 7.3)

To exercise these rights, simply write to dpo@visup.it. You will receive a response within one month of the request, extendable by two months in cases of particular complexity, with notice of the reasons for the extension.

If you believe that processing is taking place in violation of the applicable regulations, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome — garante@gpdp.it — www.garanteprivacy.it) or to bring the matter before a court.

11. Minors

The site is aimed at a professional audience and is not intended for minors under 16 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with their data, please write to dpo@visup.it and we will delete it.

12. Changes to this notice

This notice may be updated to reflect regulatory changes, the introduction of new tools, or changes in processing methods. The version in force is always the one published at this address, with an indication of the date of the last update. In the event of substantial changes affecting processing based on consent, we will inform you again and, where necessary, new consent will be requested.

In the event of a discrepancy between the Italian version and the English translation of this document, the Italian version shall prevail.