Personal data processing notice.

1. Data controller
Veltrom Group S.r.l., registered office at Viale Luigi Majno 21, 20122 Milan (MI), Italy, VAT and Tax ID 13874160966, REA MI-2749215. Contacts: info@veltromgroup.com; certified e-mail (PEC) veltromgroupsrl@lamiapec.it.

2. Browsing, aggregate statistics, hosting and security data
The systems that provide this website acquire technical data such as IP address, browser and device type, requested URL, date and time, request outcome and information needed for security. Cloudflare may also use the technical __cf_bm cookie to distinguish legitimate traffic from automated traffic and protect the website against bots and abuse; further details are available in the Cookie Policy. The website also records daily aggregate counts by page, referring domain or campaign, country and device category. These counts do not use cookies, IP addresses, full user agents or persistent identifiers and cannot reconstruct an individual visitor’s journey; they are retained for 14 months. The hosting platform may produce additional aggregate statistics such as unique visitors and page views. This data is processed to provide the website, evaluate its effectiveness and operation, prevent abuse and secure the systems. The legal basis is the Controller’s legitimate interest in service continuity, measurement and security under Article 6(1)(f) GDPR. This aggregate measurement is separate from Google Analytics 4 and does not enable the GA4 tag.

3. Contact requests
We process name, company, e-mail address, optional VAT number and telephone number, selected interest and message. Processing is necessary to receive, manage and answer the request and, where relevant, take pre-contractual steps requested by the data subject under Article 6(1)(b) GDPR. Required fields are necessary to submit the form. Upon receipt, the submitted data is transmitted through Resend to the authorised company address so that staff can immediately review and handle the request.

4. Request retention and deletion
Contact-form data, including the related notifications held in the company mailbox, is retained for as long as needed to handle the request and for no more than 12 months after receipt. A daily automated procedure deletes website-database requests older than 12 months; e-mail notifications must be deleted within the same period, and data may be deleted earlier when no longer necessary. If a commercial relationship starts, necessary data is managed in the relevant company systems under the applicable retention periods; copies held on the website and in the notification are not used as a contractual archive.

5. Cookie choices and evidence
The website stores the cookie choice in the browser for six months and records a pseudonymous receipt in its database containing a random identifier, the choice, notice version, date and expiry. The receipt does not contain the IP address, name or e-mail. Processing is necessary to respect and document the user’s choice under Articles 5(2) and 7 GDPR and Article 122 of the Italian Privacy Code. Expired receipts are deleted.

6. Google Analytics 4
Only after consent, the website activates Google Analytics 4 to measure page usage and improve the service. The legal basis is consent under Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code. Google signals and advertising personalisation are disabled, event and user data is retained for up to 14 months, and data entered into the contact form is not sent to Google. Without consent, the Analytics tag is not loaded. The choice can be withdrawn or changed at any time through “Cookie settings” in the footer, without affecting processing performed before withdrawal. See the Cookie Policy for details.

7. Recipients and processors
Data may be processed by authorised staff and managed-hosting, infrastructure, database, maintenance and technical-service providers to the extent needed for their functions and, where required, as processors. Cloudflare, Inc. supports the website’s infrastructure and security; Resend, a service of Plus Five Five, Inc., processes the form data to the extent necessary to deliver the notification to the company mailbox; Google Workspace processes the notification in the recipient mailbox. When Analytics is accepted, technical data is disclosed to Google Ireland Limited and Google group companies involved in the service. Data may also be disclosed to authorities or other parties where required by law.

8. Transfers outside the EEA
The website’s managed hosting does not guarantee exclusive data location in the EEA. Some technology providers may therefore process data outside the European Economic Area. Such transfers must rely on an applicable adequacy decision, including the EU-US Data Privacy Framework for certified organisations, or on European Commission standard contractual clauses and any necessary supplementary measures.

9. Data-subject rights
Where applicable under Articles 15-22 GDPR, data subjects may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw consent. Requests may be sent to info@veltromgroup.com or the PEC above. The Controller responds within one month; this may be extended by two further months where Article 12 GDPR allows, but the data subject will still be informed within the first month. A complaint may also be lodged with the Italian Data Protection Authority.

10. Automated decisions, children and updates
The website is intended for business contacts and is not directed at children. It does not make solely automated decisions that produce legal or similarly significant effects. Notice version: 2026-08-14.1. Last updated: 14 August 2026.