1. Scope of this notice
This notice, provided under Article 13 of Regulation (EU) 2016/679 (GDPR), covers browsing the public pages of www.pinaxo.com, the contact form and the form for requesting and activating a trial account.
It does not provide a complete description of processing associated with use of the restricted area after signing in, subscriptions or third-party websites reached through external links.
2. Controller and contact details
The controller is Kalei S.r.l., Via M. K. Gandhi 18, 42123 Reggio Emilia, Italy, VAT no. IT02519320358. Paolo Bertani is the controller’s contact person. For information about processing or to exercise your rights, you can write to support@pinaxo.com or to the postal address above.
No data protection officer (DPO) has been appointed.
3. What data we collect
Contact form: first name, last name, company, business activity, email address, telephone number, preferred contact time if provided, message and information about the source of the request.
Trial form: first name, last name, company, business activity, email, country and how you heard about Pinaxo; when the account is created, also a username and password. The password is stored as a hash. The system generates the data required for email verification and access, and derives an indication of gender from the first name.
Browsing and technical checks: IP address, date and time, pages and actions, referring URL when available, language, browser and operating system, screen characteristics and approximate location derived from the IP address. We also record cookie choices and the data needed to document them.
The forms also use a browser identifier associated with the lact cookie and a device fingerprint derived from browser, screen, font and graphics characteristics. Some checks begin when the page loads. The identifiers are compared with previous requests and accesses to detect repetition and possible abuse. While the trial form is being completed, email validity and username availability are also checked.
Do not enter health data, religious beliefs, political opinions or other special categories of personal data in free-text fields, or information about other people that is not necessary for the request.
4. Purposes and legal bases
Responding to requests and activating the trial: we process the data necessary to act on your pre-contractual request or provide the requested service under Article 6(1)(b) GDPR when you are a party to the relationship. If you act as a company representative, the legal basis is the controller’s legitimate interest in managing the relationship and responding to business contacts under point (f).
Security and prevention of technical abuse: the device fingerprint and comparisons with previous requests are used exclusively for the security of the requested service. The purpose is to protect the forms and service against abusive use, not to carry out advertising profiling. The legal basis is the controller’s legitimate interest in protecting the service under Article 6(1)(f) GDPR. The exemption from consent for accessing information on the device applies within the limits of strict necessity laid down in Article 122 of the Italian Privacy Code.
Statistics and advertising: processing activated through the Statistics and Marketing categories is based on the respective consents under Article 6(1)(a) GDPR.
Submitting a contact request or creating a new trial account does not automatically subscribe you to the newsletter. Communications necessary to respond to the request, verify your email and provide access are separate from promotional communications.
5. Providing your data
Completing the forms is optional. The fields required by the form are necessary to handle the request or activate the trial: if they are missing or fail validation checks, the process cannot be completed. The message and preferred contact time on the contact form are optional.
You can visit the website without submitting the forms. Consent to optional cookie categories is separate from a contact or trial request and is not a condition for submitting it.
6. Recipients and data processing
Requests are recorded in Pinaxo systems and communicated to the personnel responsible for handling them. Form notifications also contain technical data and information about anti-abuse checks; when the trial is activated, communications are sent to verify the email address and provide access to the service.
We use Register S.p.A. (Register.it) to send and manage email. Register processes the content of communications on our behalf and certain traffic data for its own purposes as provided for by law. Google receives the data associated with the functions described in section 11. The communications agency has access only to Google reports, not to form data.
Access is limited to the parties involved in the respective activities. Parties acting on behalf of the controller must be bound by instructions and agreements under Article 28 GDPR. You can ask the controller for information about the recipients of your data.
7. Processing locations and transfers
Pinaxo servers are located in Bologna and Reggio Emilia, Italy. Daily backups are made on the primary systems in Bologna, with remote copies on the backup systems in Reggio Emilia.
Register.it’s Email service terms specify systems in Settimo Milanese and backups at another data centre in Milan. The provider’s retention of traffic data is separate from the retention of requests and content managed by Pinaxo.
Google Analytics is provided by Google Ireland Limited, which processes data on behalf of the controller under the terms applicable to the service. The use of Google services may involve transfers outside the European Economic Area, including to the United States. For transfers to Google LLC covered by the EU–US Data Privacy Framework, Google relies on the European Commission’s corresponding adequacy decision. For other transfers, where applicable, Google’s terms provide for standard contractual clauses approved by the European Commission.
You can consult the providers’ documentation through the links below and ask the controller for information or a copy of the applicable safeguards. The fact that Pinaxo servers are located in Italy does not mean that all processing by providers takes place exclusively in Italy.
8. Retention
We retain contact and trial request data for 12 months from collection, including associated technical data, related emails and backup copies. At the end of this period, the data is deleted or irreversibly anonymised. Data necessary for any subsequent subscription relationship is subject to separate arrangements outside the scope of this notice.
Records of cookie choices are retained for 12 months. Temporary activity monitoring data expires after 30 minutes without updates; this shorter period does not apply to contact or account records or other logs.
In Google Analytics, event data retention is set to 2 months and user data retention to 14 months, with the latter period reset when the user is active again. These settings do not apply to most standard reports based on aggregated data. Cookie lifetimes in the browser, described in the Cookie Policy, are separate from the service’s data retention periods.
The period applied by Pinaxo does not remove any independent retention obligations of Register.it, for example for traffic data, nor does it correspond to the technical retention periods of the provider’s backups.
9. Your rights
You may request access to your data, rectification, erasure or restriction of processing in the cases provided for by the GDPR. For processing based on a contract or consent and carried out by automated means, you may request data portability within the scope of Article 20.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may always object to direct marketing. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; for cookies, you can use the preferences page.
Send requests to the controller using the contact details above. We may ask for the information necessary to verify your identity. You will normally receive a response within one month; any extension in the cases provided for by the GDPR will be communicated to you within that same period.
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), or with the supervisory authority where you habitually reside, work or believe an infringement has occurred. Your right to seek a judicial remedy remains unaffected.
10. Automated checks
The website automatically checks completion of the fields, the verification code against automated submissions, the availability of credentials and whether email addresses are disallowed or have already been used. These checks may prevent the submission of an invalid request or the creation of a duplicate account. Matches between identifiers and previous requests are made available to authorised personnel.
These checks are not intended to produce decisions with legal or similarly significant effects within the meaning of Article 22 GDPR. If a check prevents a request you believe to be valid, you can contact the controller to have it reviewed.
11. Cookies and visit measurement
The preferences distinguish five independent categories: Technical, Browsing experience, Statistics, Profiling and Marketing. Technical cookies remain active. The Profiling category currently does not enable any additional tools.
Consent to Statistics activates Google Analytics 4 and its cookies to measure website use. Google advertising features and Google Ads through Google Tag Manager require consent to Marketing. Authorising one category does not automatically authorise the others.
The Cookie Policy describes the cookies and their lifetimes. You can read it and change your choices using the links below.