Privacy Policy

1. Data controller

X Communication is a business unit of CodeLab S.r.l.s., which is the data controller: CodeLab S.r.l.s., Corso Giuseppe Garibaldi 22, 00034 Colleferro (RM), Italy, VAT no. 17925991006.

For any privacy question, or to exercise your rights, write to info@x-communication.it or info@codelab.email.

The controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply.

2. What data we process

• Browsing data: for technical and security reasons, the server hosting the site records the date and time of each request, the page requested, the outcome, the browser used and a partially masked IP address. We do not use this data to identify or profile you.
• Data you send us: the contact form on this site sends nothing to our servers; it opens your email app with a pre-filled message. We therefore process your data (email address, name, phone number, message content and any attachments) only when you choose to email or call us.
• WhatsApp messages: the WhatsApp button on this site is a plain link and loads no third-party scripts. If you choose to message us on WhatsApp, we process your phone number, profile name and message content.
• Usage data collected only with your consent: if you accept analytics or marketing cookies, Google Analytics 4 and Meta Pixel collect data on pages visited, device, traffic source and interactions such as clicks on email, phone or WhatsApp. Details are in the Cookie Policy.

Please do not send us special categories of data (for example health data) unless strictly necessary for your request.

3. Purposes and legal bases

• Replying to your enquiries and providing information and quotes: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Managing client relationships and the related administrative, accounting and tax obligations: performance of a contract and legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Keeping the site running and secure and preventing abuse: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
• Site usage statistics and advertising measurement: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from “Cookie preferences”.

We do not send newsletters or marketing communications without your explicit consent.

4. Is providing data mandatory?

Providing your data is optional, but without contact details we cannot reply to you.

5. How long we keep data

• Browsing data: for a limited period, typically 30 days, unless needed to establish liability in case of attacks or abuse.
• Enquiries that do not lead to a contract: for as long as needed to handle them, and no longer than 24 months after the last contact.
• Client data: for the duration of the relationship and, for accounting and tax records, 10 years as required by Article 2220 of the Italian Civil Code.
• Analytics and marketing data: for the cookie lifetimes listed in the Cookie Policy; data retention in Google Analytics is set to 14 months.

6. Who we share data with

Data is processed by the controller’s authorised employees and collaborators and may be shared, only for the purposes above, with:

• Hetzner Online GmbH (Germany), which hosts the site on servers located in the European Union, as data processor;
• Cloudflare, Inc., which manages the domain’s DNS, as data processor;
• Aruba S.p.A. (Italy), which hosts the info@x-communication.it mailbox and the domain’s mail, as data processor;
• the provider of the controller’s info@codelab.email mailbox;
• WhatsApp Ireland Limited, when you message us on WhatsApp: the service is provided by WhatsApp under the terms and privacy policy you accepted when using the app;
• Google Ireland Limited (Google Analytics 4), only if you consent to analytics;
• Meta Platforms Ireland Limited (Meta Pixel), only if you consent to marketing: the controller and Meta are joint controllers for collecting and transmitting data through the Pixel (Art. 26 GDPR);
• advisers, accountants and professionals bound by confidentiality, when needed;
• public authorities, where required by law.

Data is never published or sold to third parties.

7. Transfers outside the European Union

Cloudflare, Inc., Google LLC and the Meta group, which owns WhatsApp, are based in the United States and participate in the EU-U.S. Data Privacy Framework: transfers rely on the European Commission’s adequacy decision of 10 July 2023 and, additionally, on the Standard Contractual Clauses approved by the Commission.

8. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Articles 15-22 GDPR). Where you have given consent, you can withdraw it at any time without affecting processing already carried out.

To exercise your rights write to info@x-communication.it: we will reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Automated decisions

We do not make decisions based solely on automated processing, including profiling.

10. Changes

We may update this notice, for example when the new X Communication company takes over from CodeLab S.r.l.s. as controller. The date of the last update is shown at the bottom of the page.