Privacy Policy

This Privacy Policy describes how Certy processes the personal data of individuals who visit the Website, submit enquiries or choose to receive promotional communications. The purposes, legal bases and available choices are explained in the following sections.

1. Data Controller and Contact Details

The data controller is Certy S.r.l., with registered office at Piazza Deffenu 12, 09125 Cagliari, Italy, tax code and VAT number 03778590921.

For information about personal data and to exercise your rights, you can contact us at info@certy.ai. or via certified email (PEC) at certysrl@legalmail.it.

This Privacy Policy covers browsing on certy.ai, enquiries submitted through forms and published contact details, requested promotional communications, and the technologies used on the Website. The domain certy.me redirects to the Website; the change of domain does not affect the email addresses provided above.

Processing activities carried out in connection with development, consulting, cybersecurity, marketing, design, AI and research assignments are defined within the scope of the individual business relationships. This Privacy Policy does not replace the data processing agreements required for such assignments.

2. Data We Process

When you visit the Website, technical systems may record your IP address, date and time, requested page or resource, server response, and information about your browser and device. This data is used to ensure the operation, maintenance and security of the service.

When you contact us, we process your name, email address, telephone number (if provided), and any other information you choose to include, such as your company, role and message content. Mandatory fields are marked in the form. We ask that you do not include health data, credentials, access keys or confidential information that is not necessary to understand your enquiry.

If you choose to receive promotional communications, we process your email address, expressed preferences and the information necessary to document your consent or its withdrawal. Optional technologies described in the Cookie Policy may also collect data about visits, browsing events and interactions, according to the choices you make.

3. Enquiries and Preliminary Business Relationships

We use contact details and the content of your enquiry to respond, understand your needs, prepare quotations and manage preliminary communications. Where an enquiry concerns pre-contractual measures requested by the data subject, the legal basis is Article 6(1)(b) of the GDPR.

For general enquiries and contacts with representatives of companies or organisations, the legal basis is Certy’s legitimate interest in managing professional contacts and relationships, pursuant to Article 6(1)(f) of the GDPR. Processing is limited to information relevant to the contact.

Providing the necessary contact details is voluntary, but failure to do so may prevent us from responding. Submitting an enquiry does not require consent to marketing and does not constitute the conclusion of a service contract.

4. Website Operation, Security and Legal Obligations

We process the technical data necessary to make pages available and prevent abuse, unauthorised access and malfunctions. The legal basis for processing personal data is our legitimate interest in ensuring the security and continuity of the Website, pursuant to Article 6(1)(f) of the GDPR.

To comply with legal obligations and handle requests to exercise data protection rights, we process the necessary data pursuant to Article 6(1)(c) of the GDPR. In the event of disputes, processing of information relevant to the protection of Certy’s rights is based on Article 6(1)(f) of the GDPR.

Operations that are strictly necessary to read or write information on your device are separate from optional technologies. Their applicable rules are explained in the Cookie Policy.

5. Promotional Communications

With your consent, we may send you updates, content and offers relating to Certy’s services by email. The legal basis is Article 6(1)(a) of the GDPR and, for electronic communications, the provisions of Article 130 of the Italian Privacy Code also apply.

Consent is voluntary, separate from submitting an enquiry and may be withdrawn at any time using the link included in our communications or by writing to info@certy.me. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Refusing consent does not limit your ability to request information or quotations.

Email distribution and mailing list management are handled through Brevo. Subscribing to the mailing list does not constitute consent to tracking on the Website, and consent to marketing cookies does not automatically subscribe you to the mailing list. Individual tracking of email opens and clicks is not included in the consent to receive communications described here.

6. Analytics and Marketing on the Website

With your consent to the Analytics category, we use Google Analytics 4 to measure visits and browsing events, and Hotjar to understand how pages are used and identify usability issues. The information may include pseudonymous identifiers, browser and device characteristics, pages viewed and interactions such as clicks and scrolling.

With your consent to the Marketing category, we use Meta Pixel to measure campaigns and support advertising activities, and the Brevo tracker to detect interactions and support marketing automation. Linking visits to an identified contact requires an informed choice that expressly includes this functionality. Message content and values entered into forms are not intended to be sent to advertising tags or included in session recordings.

The legal basis is consent pursuant to Article 6(1)(a) of the GDPR. Article 122 of the Italian Privacy Code also applies to accessing information stored on your device. Optional technologies remain disabled until you make your choice and can be withdrawn through Cookie Preferences. You can use the Website and submit an enquiry even if you reject them.

7. Data Retention

Enquiries that do not result in an assignment are retained for a maximum of 12 months from the closure of the relevant correspondence. If a contractual relationship is established, the necessary data is managed within the scope of that relationship and in accordance with the applicable legal obligations and retention periods.

Contact details used for marketing purposes are retained until consent is withdrawn and, in any case, for no longer than 24 months from the date consent was given. Once this period expires, marketing communications for that purpose will cease unless new consent is obtained. A minimum set of information may be retained separately to honour objections to receiving communications and document the choices made.

Technical access logs are normally retained for a maximum of 30 days. Information relating to an incident or dispute is isolated and retained for as long as necessary to manage the matter or for any different period required by law.

Records of consent and withdrawal are stored separately, with restricted access, for the period during which consent is used and for a maximum of 5 years after its termination, unless a dispute requires the relevant information to be retained. User-level or event-level analytics data is subject to a retention limit of 2 months within analytics services. The duration of cookies in your browser is separate from the retention of data within service providers’ systems and is specified in the list associated with the Cookie Policy.

Deletion from ordinary systems is accompanied by the renewal of backup copies in accordance with the applicable retention cycle. Any data recovered from a backup is not reused to reactivate purposes or consents that have expired or been withdrawn.

8. Authorised Personnel and Service Providers

Data may be processed by Certy’s authorised employees and collaborators, within the scope of their respective activities, and by service providers delivering technical or professional services. Parties acting on our behalf are bound by agreements and instructions consistent with their respective roles.

We use OVHcloud services for hosting and corporate email. Brevo supports the management of communications and mailing lists. For optional purposes, we use Google Analytics 4, Hotjar, Meta Pixel and the Brevo tracker, according to the preferences expressed. Google Tag Manager is used to manage the loading of tags and does not make the individual tools it contains necessary.

Data may be disclosed to consultants appointed to handle legal obligations or protect our rights, and to public authorities where required by law. An updated list of data processors can be requested using the contact details provided above. Accessing social media websites through a link involves processing by their respective operators in accordance with their own privacy policies.

9. International Data Transfers

Analytics and marketing services may involve the processing of data outside the European Economic Area, including in the United States, through the infrastructure and subcontractors of the respective operators. The availability of a European service provider does not, in itself, exclude such transfers.

Transfers are carried out where the requirements of Chapter V of the GDPR are met: an applicable adequacy decision covering the recipient and the processing activity, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with the necessary assessments and supplementary measures. You can request information about recipients, the safeguards applied and how to obtain a copy by writing to info@certy.me.

10. Your Rights and How to Exercise Them

In accordance with the conditions and circumstances provided for by the GDPR, you may request access to, rectification or erasure of your personal data, restriction of processing and data portability. You may object to processing based on legitimate interests and, at any time, to direct marketing, including any profiling related to it. Consent may be withdrawn as easily as it was given.

To exercise your rights, contact us at info@certy.me or via certified email (PEC) at certysrl@legalmail.it, specifying your request and providing contact details for our response. You do not need to create an account or accept any service terms. If there are reasonable doubts about your identity, we may request only the additional information necessary to verify it.

We generally respond within one month of receiving your request. In cases of particular complexity or a high number of requests, this period may be extended by a further two months. In such cases, we will inform you within the first month and explain the reasons for the extension. Erasure may be restricted where data retention is permitted or required by law; in such cases, we will explain the reason.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it, or with the competent supervisory authority pursuant to Article 77 of the GDPR, and exercise any other remedies available under applicable law.

11. Artificial Intelligence and Updates

The Website does not provide an AI chatbot. The use of artificial intelligence described on the service pages relates to Certy’s professional activities. Publishing such descriptions and submitting a form do not constitute general authorisation to use the data received in AI tools or to train models.

Within the scope of the Website, we do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject, as defined in Article 22 of the GDPR. Optional analytics and marketing activities remain those described above.

This Privacy Policy may be updated whenever processing activities, services or applicable legislation change. The updated version is published on the Website together with its revision date. Any new purposes or consent requirements will be addressed before the relevant processing begins.