Privacy policy

1. Data controller

The data controller is Digi Solution di Bomba Camillo, VAT no. IT02718170695 (the "Controller"). For any matter concerning the processing of personal data, the Controller can be reached at me@bombacamillo.com.

2. Categories of data processed

a) Browsing data. The Site's systems and hosting infrastructure acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, request time, requested page, server response code, browser and device information). This information is used solely to ensure the proper operation and security of the Site.

b) Measurement data (statistics and marketing). The Site uses Google Analytics 4 with Consent Mode v2 and consent denied by default: without consent no measurement cookie is set and the data collected contains no persistent identifiers and is processed in aggregate form. With consent, the Site also uses the Meta Pixel to measure the effectiveness of the Controller's advertising campaigns on Meta platforms (for instance a page visit or a click on a contact button). Both statistical and marketing cookies are set only after consent is given through the banner and are described in the cookie policy. IP addresses are anonymised for Google Analytics.

c) Data provided voluntarily. The Site contains no data collection forms. Where the user chooses to contact the Controller through the channels indicated (WhatsApp, email, phone, social profiles) or through the chat available on the Site, the contact details and any information spontaneously provided in the message will be processed. Conversations started on the Controller's WhatsApp number and those started in the Site chat are handled by an AI assistant: see section 3.

3. AI assistant (WhatsApp and Site chat)

Conversations started on the Controller's WhatsApp number (for instance via the "Chat on WhatsApp" buttons on the Site or from social profiles) and those started through the chat available on the Site are initially handled by an artificial-intelligence-based assistant, which introduces itself as such in its first message. The assistant collects the essential information about the request (needs, business, company size, budget indications) in order to organise and route commercial enquiries to the Controller.

Data processed: phone number, name and any contact details provided, message content and information about the business spontaneously shared in the conversation. In the Site chat the user is not identified: before closing the conversation the assistant may optionally ask for a phone number or email address so that the Controller can contact the user back; providing it is entirely optional and declining does not affect the handling of the request.

Tools used: the assistant's replies are generated through Anthropic's Claude API (privacy policy); under the provider's commercial terms, data submitted via the API is not used to train models. Conversation transcripts and summary profiles are stored on server infrastructure located in the European Union (Frankfurt).

Legal bases: pre-contractual measures taken at the data subject's request, since the user starts the conversation (Art. 6(1)(b) GDPR), and the Controller's legitimate interest in organising and prioritising incoming enquiries (Art. 6(1)(f) GDPR).

Automated classification: the assistant assigns enquiries a preliminary classification solely for internal routing. This classification produces no legal effects on the data subject and does not significantly affect them: every enquiry is in any case reviewed by a person. Users may also ask, at any time in the same chat, to speak directly with a person.

Retention: transcripts and profiles are kept for the time needed to handle the enquiry and in any case no longer than 24 months from the last contact, unless a professional relationship follows.

4. Purposes and legal bases

• Operation and security of the Site (browsing data) — legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR) in properly delivering and protecting the service.
• Site usage statistics (measurement cookies) — legal basis: the data subject's consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time via the "Cookie preferences" link in the footer.
• Measurement of advertising campaign effectiveness (Meta Pixel) — legal basis: the data subject's consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time via the "Cookie preferences" link in the footer.
• Responding to contact requests (data provided voluntarily) — legal basis: pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
• Handling and routing of enquiries received on WhatsApp and through the Site chat via AI assistant — legal bases: see section 3.
• Compliance with legal obligations where applicable — legal basis: Art. 6(1)(c) GDPR.

5. Processing methods and retention

Data is processed by electronic means, with technical and organisational measures adequate to ensure its security and confidentiality. Apart from the preliminary classification of WhatsApp enquiries described in section 3 — which produces no legal effects and is always subject to human review — no automated decision-making within the meaning of Art. 22 GDPR is carried out.

Browsing data is kept for the time strictly necessary for operation and security purposes. Google Analytics statistical data is retained for a maximum of 14 months. Data relating to contact requests is kept for the time needed to respond and, where a professional relationship follows, for its duration and any applicable statutory periods.

6. Recipients

Data may be processed, as processors within the meaning of Art. 28 GDPR or as independent controllers, by the following parties:

• Vercel Inc. — Site hosting and delivery (privacy policy);
• Google Ireland Ltd. — Google Analytics 4 measurement service (privacy policy);
• Meta Platforms Ireland Ltd. / WhatsApp Ireland Ltd. — Meta Pixel service for measuring advertising campaigns, active only with consent (Meta privacy policy), and where the user chooses to contact the Controller via WhatsApp (WhatsApp privacy policy);
• Anthropic PBC — generation of the AI assistant's replies (WhatsApp and Site chat) through the Claude API (privacy policy), as described in section 3;
• the provider of the server infrastructure in the European Union (Frankfurt) where the AI assistant's conversations and profiles are stored;
• providers of email and productivity services used by the Controller.

7. Transfers outside the EU

Some of the providers listed above are established or operate infrastructure in the United States. Transfers take place on the basis of adequacy decisions of the European Commission (EU-U.S. Data Privacy Framework, for certified providers) or of the standard contractual clauses under Art. 46 GDPR.

8. Data subjects' rights

Under Articles 15-22 GDPR, data subjects may exercise the following rights at any time by writing to me@bombacamillo.com:

• right of access (Art. 15);
• right to rectification (Art. 16);
• right to erasure ("right to be forgotten", Art. 17);
• right to restriction of processing (Art. 18);
• right to data portability (Art. 20);
• right to object (Art. 21);
• right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal (Art. 7(3)).

9. Complaints to the supervisory authority

Data subjects who consider that the processing of their data infringes the GDPR have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), pursuant to Art. 77 GDPR, or to seek judicial remedies.

10. Minors

The Site is not intended for children under 14 and the Controller does not knowingly collect personal data relating to minors.

11. External channels and social platforms

The Site links to third-party platforms (WhatsApp, LinkedIn, Instagram, YouTube). Use of those platforms is governed by their respective privacy notices, over which the Controller has no control. Users are invited to review them.

12. Changes to this notice

The Controller reserves the right to amend or update this notice at any time, including as a result of regulatory changes or changes to the services used. Amendments will be published on this page with the date of last update. For information on cookies, please see the cookie policy.