Privacy Policy

Last updated: 20 September 2026 — pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR). DATA CONTROLLER GALVANIK S.R.L. — Via Zanardelli 86, 25013 Carpenedolo (BS) — VAT no. IT 01676210980 — Tax code 01676210980 — REA BS-339117 (Brescia Chamber of Commerce) — share capital € 46.800,00 i.v. — email info@galvaniksrl.it — certified email galvanik@pec.galvaniksrl.it — phone +39 030 969070. No Data Protection Officer (DPO) has been appointed: the activity does not involve large-scale processing of special categories of data or systematic monitoring of data subjects, so the conditions of Art. 37 GDPR do not apply. Data protection requests can be addressed directly to the controller at the contacts above. DATA COLLECTED Mandatory fields in the contact form are those needed to assess and reply to the request: contact name, company name, email, requested treatment, material, quantity and description of the request, plus acknowledgement of this notice. The phone number and any attachments (photos, drawings, technical documents) are optional. Without the mandatory data the request cannot be submitted. We process: contact data (company name, contact name, email, optional phone); technical data about the request (treatment, material, quantity, description, attached drawings or images); technical submission data (IP address, user agent and the page the request was sent from, stored with the request for security and anti-spam purposes); campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), read from the page URL when present and stored with the request in order to know which channel the contact came from — they are not used to profile users, are not shared with third parties for advertising purposes and no cookie or identifier is used for this reading; and the content of messages sent to the virtual assistant (see the dedicated section). PURPOSES Replying to quotation and technical assessment requests; contractual, tax and legal obligations arising from any business relationship; website security, prevention of abuse and automated submissions, cookie preference management; knowing the channel a request came from, to assess the company's communication channels in aggregate form; providing the informational virtual assistant available on the website. LEGAL BASIS Art. 6.1.b GDPR — pre-contractual measures at the data subject's request, where the data subject is (potentially) a party to the relationship, as with a natural person or a sole trader. Art. 6.1.f GDPR — the controller's legitimate interest, where the request is submitted by a contact person acting for a company: in that case the contact person's data is processed to manage the commercial relationship with the company they represent; the same basis covers website security, prevention of abuse, knowledge of the originating channel and the operation of the virtual assistant. Art. 6.1.c GDPR — legal obligations (tax, accounting) and demonstration of the consents obtained. Art. 6.1.a GDPR — consent, limited to statistics and marketing cookies and the separate loading of Google Maps (see the Cookie Policy). The checkbox in the form is an acknowledgement of this notice, not a consent to processing: submitting a request is not conditional on a generic privacy consent. RETENTION Data is kept for as long as necessary for the purposes above, according to the criteria below. Except where stated otherwise, these durations are organisational criteria adopted by the controller, not statutory obligations; deletion follows a periodic review and is not automatic. - Requests closed without a business relationship (contact data, technical data, attachments): kept for the time useful to handle any follow-up and deleted when no longer necessary. - Requests leading to a business relationship: contractual, accounting and tax documentation is kept for the periods required by civil and tax law (as a rule ten years from registration). That period applies to documents that are relevant for tax and contractual purposes, not to every item of data collected through the website. - Technical attachments: kept together with the related request and deleted with it. - Technical submission data (IP, user agent, page) and campaign parameters: kept for the time necessary for security purposes and channel assessment. - Cookie consent register, separate Google Maps choice register and records of acknowledgement of the chat notice: kept for the time needed to demonstrate compliance (as a rule no longer than twenty-four months). - Copies in company mailboxes and backup copies: follow the retention cycles of the respective systems, so deletion from those media may not be immediate. RECIPIENTS AND ROLES Data is processed by authorised staff of GALVANIK S.R.L. and may be disclosed to: the hosting, database and file storage provider that hosts the website, the request database and the attachments — data processor (Art. 28 GDPR); the email delivery provider used to forward the request notification to the company mailbox, the notification containing the data entered in the form and, where attachments are present, temporary links valid for seven days — data processor; the gateway and the artificial intelligence model provider used by the virtual assistant — data processors (see the dedicated section); tax, accounting and legal advisers, acting as independent controllers within their professional obligations. Data is never disclosed or sold to third parties for marketing purposes. COOKIES, CONSENT REGISTER AND MAP The choices you make in the cookie banner are recorded in an internal archive (random consent code, categories accepted or rejected, type of action, date and time, banner version, language, originating page, IP address and user agent) for the sole purpose of demonstrating the consent obtained under Art. 7.1 GDPR; legal basis: Art. 6.1.c GDPR. The archive is accessible to authorised administrators only. The interactive map on the Contact page is provided by Google and is loaded only after separate consent given directly in the map panel; the cookie banner does not enable it. Without consent no data, including your IP address, is sent to Google. Activation and withdrawal are recorded separately, and consent can be withdrawn through the control displayed on the map. Details, inventory and durations are in the Cookie Policy. VIRTUAL ASSISTANT (AI CHAT) The website provides a virtual assistant that gives general information about electroplating treatments and directs users to the contact page. The assistant does not ask for identifying data and is not designed to collect it; since the input field is free text, it may nevertheless receive such data if the user enters it. Users are therefore asked not to enter personal, sensitive or identifying data in the chat: this is an informational and organisational measure, not a technical guarantee of anonymity. Messages typed by the user, together with the history of the ongoing conversation, are transmitted to a gateway and from there to the artificial intelligence model provider, solely in order to generate the real-time reply. Both act as data processors under Art. 28 GDPR and do not use the content for their own profiling or model-training purposes. The website does not store conversations: no message or reply is saved in the controller's database and the history remains only in the page opened by the user, until it is closed. The controller cannot rule out that providers keep temporary technical records for security and abuse-prevention purposes under their own policies. Legal basis for providing the chat service: the controller's legitimate interest (Art. 6.1.f GDPR) in offering immediate informational assistance to website visitors. Use of the assistant is entirely optional: the same information is available on the website pages and through the company contacts. Before first use, the user confirms an information notice recalling the automated nature of the assistant and the request not to enter personal data. Upon confirmation the website records a technical audit entry (terms version, acceptance date and time, user agent and originating page), without the conversation content, for the sole purpose of demonstrating compliance with transparency obligations (accountability, Art. 5.2 GDPR). Legal basis: Art. 6.1.f GDPR. This legal basis covers only the record of acknowledgement and does not extend to the processing of messages, described in the previous paragraph. AUTOMATED DECISION-MAKING AND PROFILING The controller does not carry out automated decision-making or profiling under Art. 22 GDPR. TRANSFERS OUTSIDE THE EU Some technical providers, in particular the email notification service and the services delivering the artificial intelligence model, may process data outside the European Economic Area or rely on infrastructure located in third countries. In such cases the transfer takes place on the basis of adequate safeguards under Chapter V GDPR: the European Commission's Standard Contractual Clauses or adequacy decisions. A copy of the applicable safeguards can be requested from the controller at the contacts above. YOUR RIGHTS Articles 15-22 GDPR: access, rectification, erasure, restriction, portability and objection, including in relation to processing based on legitimate interest; withdrawal of consent at any time, without affecting the lawfulness of previous processing. To exercise them, write to info@galvaniksrl.it. COMPLAINTS Complaints can be filed with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).