Privacy notice

Data controller

The data controller is the operator of opifexweb.it. Identification and contact details are on the “Legal notice” page.

What data this site processes

The site has no third-party analytics and no AI-based assistant. This notice will be updated before any of these features is introduced.

• Browsing data: IP address, date and time, requested page and browser type, recorded in the web server logs. They are used for security and for the correct operation of the site.
• Email messages: if you write to the address shown on the “Contact” page, the controller processes your address and the content of the message in order to reply.
• Contact form: email (required), name, company, message and modules of interest you indicate, together with the page language. They are used to reply to your request.
• Consultation booking: the chosen day and time, name, email, company and optional notes. They are used to arrange the meeting and send the confirmation.
• Interactive demos: when you take an action in a demo (for example you press a button), the site creates a session with made-up sample data (orders, stock, contacts, invoices) and a technical cookie that identifies it. No personal data is requested or saved, and your IP address is not kept in the session: it is only used, for a few seconds, to limit abuse. To avoid saving personal data by mistake, you are asked not to write real names or addresses in the demos. The text written in the test form of the “Websites” demo is not saved.
• Demo test emails: if you send a test email (or buy in the sample shop), the text you wrote and a confirmation email end up in an internal mailbox of the site, at a test address that cannot be reached from outside and is tied to the session.

Legal bases and retention

• Browsing logs: legitimate interest in the security of the site (Art. 6(1)(f) GDPR). They are kept for 14 days and then deleted.
• Email messages: steps taken at the user's request prior to entering into a contract (Art. 6(1)(b) GDPR) or legitimate interest in replying. They are kept for as long as needed to handle the request and, if a relationship follows, for legal obligations.
• Contact form requests: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). They are kept for 24 months and then deleted automatically, unless you ask for earlier deletion.
• Bookings: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). 24 months after the meeting date the personal data are anonymised automatically; only the time slot remains.
• Demo sessions and their test emails: legitimate interest in making the demo you asked for work (Art. 6(1)(f) GDPR). They are deleted automatically after 24 hours without actions, or right away with the “Restore the sample data” button (which also empties the test mailbox).

Recipients and place of processing

• The server hosting the site is located in Singapore: browsing data are therefore processed in a country outside the European Economic Area.
• Site traffic goes through the network of Cloudflare, Inc. (CDN and protection), which processes browsing data as a processor.
• Email messages pass through the controller's email provider and your own.
• Form requests and bookings are stored in the site database, on the same server. The notification to the controller and the confirmation to you are sent through the controller's email provider.
• Demo sessions are stored in the site database, on the same server. Demo emails are never sent to real addresses or to outside providers: they stay in an internal mailbox.
• When enabled, the anti-spam check on the forms is provided by Cloudflare Turnstile (Cloudflare, Inc.), which receives the technical browser data needed for the check.

Your rights

You may request access, rectification, erasure, restriction, portability and objection (Arts. 15–22 GDPR) by writing to the address shown on the “Contact” page. You may also lodge a complaint with the Italian data protection authority (garanteprivacy.it).