This notice describes how personal data of users visiting the gradotech.it website is processed. It is provided pursuant to art. 13 of EU Regulation 2016/679 (GDPR) and refers exclusively to this site, not to other websites that may be reached via external links.

Product privacy notices

In addition to this website notice, dedicated privacy notices are available for each GRADO platform:

• Privacy Notice — GRADO Academy LMS e-learning platform, courses, certificates and virtual classrooms.
• Privacy Notice — GRADO Security HSE management, training, risk assessment (DVR), deadlines and occupational safety.
• Privacy Notice — GRADO Assistant Platform for training providers: client companies, courses, enrolments, tests and certificates (DEMO version).
• Privacy Notice — GRADO HR HR management: employee records, time clock, shifts, absences and payslips.
• Privacy Notice — GRADO Reflow RENTRI waste traceability: registers, FIR forms, operator credentials and platform accounts.

Data Controller

The data controller is GRADO TECH Srls, registered office at Corso Umberto I, 7 — 66050 San Salvo (CH), Italy. VAT no. 02868240694. Email: info@gradotech.it — Phone: +39 378 421 3717.

Types of data processed

We process only the data strictly necessary to respond to your requests and to operate the site:

• Browsing data: IP address, browser type, operating system, pages visited, date and time of visit. This data is collected automatically by the server systems and logs and used solely to ensure the security and proper operation of the site.
• Data voluntarily provided by the user: name, surname, email, phone number, subject and message content sent through the contact form, by email, phone, or WhatsApp. When requesting the free guide, name and email address are collected to send the download link.
• Approximate geolocation data: the IP address is used once to determine the country of origin and display the most appropriate language. The result (two-letter country code, e.g. "IT") is stored in the browser session.
• Anonymous browsing statistics: via Google Analytics 4, aggregate data about site usage is collected (pages visited, session duration, traffic source, device used). The IP address is anonymised before being transmitted to Google. No personally identifiable data is collected for statistical analysis.

Purposes of processing

• Reply to information, quote, or support requests sent by the user.
• Fulfill pre-contractual and contractual obligations arising from the relationship with the client.
• Ensure the IT security of the site and prevent abuse or unauthorised access.
• Comply with obligations imposed by law, regulations, or orders from authorities.
• Anonymous statistical analysis of site usage via Google Analytics 4, to improve content and user experience (legitimate interest, art. 6(1)(f) GDPR).

Legal basis

Processing is based on the performance of pre-contractual measures requested by the data subject (art. 6(1)(b) GDPR), compliance with legal obligations (art. 6(1)(c) GDPR), and the legitimate interest of the controller in ensuring the security of the site (art. 6(1)(f) GDPR).

Retention period

Contact data is retained for the time strictly necessary to handle the request and, if a contractual relationship is started, for the duration of the contract and the following 10 years as required by tax and civil law. Server logs are retained for a maximum of 30 days, unless required to investigate offences.

Data recipients

Data is not disclosed or transferred to third parties for marketing purposes. It may only be shared with: Aruba S.p.A. (Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy — VAT 01573850516), as provider of infrastructure and technical management services connected to the site, to the extent necessary for service delivery — Aruba GDPR, Aruba privacy notice; Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), as data processor for statistical data collected via Google Analytics 4 — policies.google.com/privacy; consultants, professionals, or authorities to fulfil legal obligations. Providers processing data on our behalf are appointed as processors or sub-processors under art. 28 GDPR, where applicable.

Transfer of data outside the EU

Contact data is processed primarily within the European Union, including through Aruba S.p.A. (Italy). More information: aruba.it/gdpr. Statistical data collected via Google Analytics 4 may be transferred to Google LLC servers in the United States. Google has adhered to the EU-US Data Privacy Framework and applies Standard Contractual Clauses approved by the European Commission. The IP address is anonymised before transmission. For more information: policies.google.com/privacy.

Rights of the data subject

As a data subject, you may exercise the following rights at any time pursuant to arts. 15-22 GDPR:

• access to your personal data;
• rectification or erasure of the data;
• restriction of or objection to processing;
• data portability;
• withdrawal of consent, where applicable;
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights you can write to info@gradotech.it.

Google Analytics 4

The site uses Google Analytics 4 (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to collect anonymous statistical data about site usage. Data is collected via cookies (_ga, _ga_*, _gid). IP addresses are anonymised and data is not used by Google for advertising purposes. Users can opt out of Google Analytics by installing the browser add-on available at tools.google.com/dlpage/gaoptout.

Security

We adopt appropriate technical and organisational measures to protect personal data from unauthorised access, loss, destruction, or disclosure: encrypted HTTPS connection, protected access, regular backups, and the principle of least privilege.

Changes

This notice may be updated. Any changes will be published on this page along with the date of the last update.