Privacy Policy

Last updated: 2 August 2026

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the “Privacy Code”), this notice describes how the personal data of users who visit the website brixiatech.com and who contact the company are processed.

1. Data Controller

The Data Controller is SAL-FER Srl (of which BrixiaTech is a commercial brand), in the person of its legal representative pro tempore, Roberto Goffi:

  • Registered office: Via G. Di Vittorio 15, 25037 Pontoglio (BS), Italy
  • Operational office: Via F.lli Calvi 19, Palazzolo sull’Oglio (BS), Italy — San Pancrazio
  • VAT no. 03726890985 — Brescia Companies Register, REA BS-558109
  • Email: info@brixiatech.com
  • Certified email (PEC): salfersrl@gigapec.it

No Data Protection Officer (DPO) has been appointed, as the conditions set out in Article 37 GDPR do not apply. For any matter relating to the processing of your data and to exercise your rights, you may write to the contacts above.

2. Types of data processed

a) Browsing data. In the course of their normal operation, the IT systems and software procedures responsible for running the website acquire certain data whose transmission is implicit in the use of Internet communication protocols (for example IP addresses, browser type, request times, technical security data). This data is processed automatically by the infrastructure that delivers the website and is not used to identify users.

b) Data voluntarily provided by the user. The website contains no data-collection forms. Contact takes place through the channels indicated (email, telephone, WhatsApp). When a user chooses to contact the company, they provide the data contained in the communication: typically name, email address or telephone number, and the content of the message, including any project details.

c) Cookies. The website uses only necessary technical cookies (see Section 4).

d) Statistical measurement data. To understand in aggregate form which content is of interest, the site uses Umami, an open-source statistics tool installed on a virtual server operated by the Controller (data.brixiatech.com, located in Germany). The tool uses no cookies, does not track users across different sites and does not allow individual persons to be identified. For each page view it records: the page visited and any parameters contained in the address, the page title, the referring site or search engine, browser type and language, operating system, device type and screen resolution, approximate geographic location derived from the IP address (country, region and city), some technical measurements of page loading speed, and a session identifier that cannot be traced back to the user. Some interactions with page elements are also recorded in anonymous and aggregate form, such as the choice of a contact channel (email, telephone, WhatsApp) and the page from which it occurs. If the visit comes from an advertisement or a campaign, the tracking parameters contained in the link are also recorded (for example utm_source or utm_campaign and the click identifiers used by advertising networks). The IP address is not stored in the tool’s database: it is used transiently to derive the geographic location and to compute the session identifier.

e) Technical logs of servers operated by the Controller. Requests sent to the statistics server referred to in point d) are recorded by its web server in a technical log containing the date and time, the resource requested, the referring page, the browser identifier and the IP address in truncated form: the final digits are zeroed at the moment of writing, so that the full address is never stored and individual connections cannot be traced. The server that delivers the site’s video content (media.brixiatech.com), operated by the Controller on the same infrastructure, likewise records a technical log containing the full IP address, which is necessary for the security and diagnostics of content delivery. Both logs serve solely for the security and diagnostics of the servers and are deleted automatically within fifteen days through the periodic rotation of the log files.

3. Purposes and legal bases of processing

Responding to contact and quotation requests

Art. 6(1)(b) GDPR — performance of pre-contractual measures taken at the data subject’s request.

Providing, operating and securing the website (technical logs)

Art. 6(1)(f) GDPR — the Controller’s legitimate interest in the continuity and security of the service.

Aggregate statistical measurement of site usage

Art. 6(1)(f) GDPR — the Controller’s legitimate interest in understanding, in aggregate form, how the site is used and in improving its content.

Compliance with legal obligations (tax, accounting) where a contractual relationship arises

Art. 6(1)(c) GDPR — legal obligation.

4. Cookies

The website uses only necessary technical cookies, for which consent is not required under Article 122 of the Privacy Code. There are no profiling, analytics or third-party advertising cookies; for this reason no consent banner is present. The statistical measurement tool referred to in Section 2, point d), operates without cookies and without storing identifiers on the user’s device.

The technical cookies used relate to the security and content-delivery infrastructure (Cloudflare), for example:

  • __cf_bm — anti-bot protection; expires after 30 minutes of continuous user inactivity (duration per official Cloudflare documentation; not configurable).
  • cf_clearance — set only after a security check (challenge) has been passed; default duration 30 minutes, configurable by the Controller via Challenge Passage (duration per official Cloudflare documentation).

5. Recipients of data and data processors

Data may be processed, on behalf of the Controller, by the following parties acting as data processors (Art. 28 GDPR) or as independent controllers, each for their own technical purposes:

  • Cloudflare, Inc. — website hosting, content delivery (CDN) and security services; processes browsing data and IP addresses. Based in the USA.
  • Hostinger International Ltd — email hosting (email data on a server in the Netherlands, backups in Lithuania: no extra-EU transfer) and provision of the virtual server, located in Germany (EU), on which the Controller directly operates the statistics tool and the delivery of video content. EU-based company, acting as data processor (Art. 28 GDPR).
  • Meta Platforms (WhatsApp service) — only where the user chooses to contact the company via WhatsApp; processes the number and the content of the conversation in accordance with its own privacy notice. Based in the USA.
  • Google LLC — Search Console service for site-ownership verification and technical monitoring; processes data mainly in aggregated form. Based in the USA.
  • Consultants and professionals (e.g. the accountant) and competent authorities, where necessary to comply with legal obligations.

Data is neither disseminated nor transferred to third parties for marketing purposes.

6. Transfers of data outside the EU

Some of the providers listed above are based or have infrastructure in the United States (Cloudflare, Meta, Google). Any transfers of data to third countries take place in compliance with Articles 44 et seq. GDPR, on the basis of:

  • the EU-US Data Privacy Framework (DPF) adequacy decision: Cloudflare, Meta and Google are listed with an active EU-U.S. DPF certification on the official U.S. Department of Commerce list (dataprivacyframework.gov) as of the date of this notice;
  • residually, Standard Contractual Clauses (SCC) approved by the European Commission, together with adequate supplementary measures.

7. Retention period

  • Contact requests without a subsequent contractual relationship: data is retained for the time necessary to handle the request and in any case no longer than 24 months from the last exchange, save for any defensive needs.
  • Where a contractual relationship is established: for the entire duration of the relationship and, thereafter, for the period required by tax and civil-law obligations (generally 10 years, pursuant to Art. 2220 of the Italian Civil Code).
  • Browsing data processed by the infrastructure providers: for the technical periods set by the respective providers.
  • Technical logs of servers operated by the Controller: deleted automatically within fifteen days through the periodic rotation of the log files.
  • Statistical measurement data: retained in aggregate form that cannot be traced back to the person, with no predetermined time limit.

8. Data subject rights

You may exercise at any time the rights set out in Articles 15-22 GDPR: access to your data, rectification, erasure, restriction of processing, portability, objection to processing, as well as withdrawal of consent where the processing is based on it.

Requests should be addressed to info@brixiatech.com or salfersrl@gigapec.it.

You also have the right to lodge a complaint with the supervisory authority — the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) — or, if you are located in the EEA, with your local supervisory authority, should you consider that the processing infringes applicable law.

9. Nature of the provision of data

Providing your contact data is optional. Failure to provide it means the company will be unable to respond to your requests.

10. Automated decision-making

The Controller does not carry out any automated decision-making, including profiling, within the meaning of Article 22 GDPR.

11. Changes to this notice

The Controller reserves the right to update this notice to reflect regulatory or organisational changes. The version in force is the one published on this page, with the date of last update indicated.