Privacy policy

1. Data controller

Innovationweb S.r.l. (the "Controller") is the controller of the personal data collected through this website. No Data Protection Officer (DPO) has been appointed, as this is not mandatory under Article 37 of the GDPR.

2. What data we process

We only process the data you voluntarily provide by filling in the contact form ("Request a demo"):

• full name;
• email address;
• phone number (optional);
• company name (optional);
• the content of the message you choose to send us (optional).

Navigation data. For the operation and security of the website, the IT systems and the web server automatically collect certain data whose transmission is implicit in the use of Internet communication protocols: IP address (in anonymised form), date and time of access, pages visited, referrer URL, browser type and operating system. This data is used only for anonymous statistics on the use of the site and to ensure its security, and is kept for the technical time strictly necessary.

For the cookies used, see the Cookie policy. We do not collect special categories of data (Art. 9 GDPR) and we ask you not to include any in the message field.

3. Purposes and legal basis

• Responding to your request and contacting you about our products and services. Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the relevant box in the form, and any pre-contractual measures you request (Art. 6(1)(b)).
• Security and proper operation of the website (e.g. technical logs, abuse and spam prevention). Legal basis: the Controller's legitimate interest (Art. 6(1)(f)).
• Compliance with legal obligations to which the Controller is subject. Legal basis: legal obligation (Art. 6(1)(c)).

4. Nature of the provision of data

Providing your data is optional. However, the fields marked as required (name and email) are necessary to act on your request: without them we cannot contact you.

5. Recipients of the data

Your data is neither disclosed nor sold to third parties for marketing purposes. It may be processed by the Controller's authorised staff and by external providers acting as Data Processors under Art. 28 GDPR, solely to deliver the necessary technical services:

• Aruba S.p.A. — email and certified email (PEC) services used to receive and manage requests (servers located in the European Union);
• OVH — hosting infrastructure provider: the server, owned by the Controller, is hosted in the Gravelines (France) data center, within the European Union.

6. Transfer of data to third countries

Data is processed and stored within the European Economic Area (EEA). No transfer to non-EU third countries takes place.

7. Retention period

Data collected through the contact form is kept for as long as necessary to handle the request and, in any case, for a maximum of 12 months from the date of the request, unless otherwise required by law. After that period the data is deleted or anonymised.

8. Your rights

As a data subject, under Articles 15-22 of the GDPR you have the right to:

• access your personal data and obtain a copy of it;
• request its rectification or update;
• request its erasure ("right to be forgotten");
• request restriction of processing;
• object to the processing;
• obtain data portability;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

You can exercise these rights by writing to privacy@innovationweb.it or by registered mail to Innovationweb S.r.l., Via Privata Valentino Mazzola, 12 — 20081 Abbiategrasso (MI), Italy. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Automated decision-making

The Controller does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Changes to this notice

The Controller may update this notice in the event of regulatory changes, technological innovation or other reasons. The version in force is the one published on this page, with the last-updated date indicated below. In the event of substantial changes, where processing is based on consent, a new consent will be requested.

Last updated: 5 August 2026.