Privacy notice
Last updated: 2 November 2026
This notice explains how we process the personal data of people who visit softautomation.it and contact us through it, under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). The Italian version is the reference text.
1. Data controller
Giovanni Nicolussi, trading as SoftAutomation, Thiene (VI), Italy.
Email for any privacy request: giovanni@softautomation.it
We have not appointed a Data Protection Officer, as it is not required for our activity.
2. What data we process
a) Data you give us
- Contact form: full name, email, company or firm (optional), phone (optional), the service you’re interested in, your message and, if you include it, your check-up result. We also record the date, language and page the form was sent from.
- “Cash flow forecast” waiting list: email, name and company (optional), whether you’re an accountant, the date you joined and gave consent.
- Direct contact: if you email, call or message us on WhatsApp, we process the data in that communication.
- If we contacted you first to present our services, the notice for people we contact applies (in Italian).
b) Process check-up Your check-up answers are processed only in your browser and are not sent to us. We only receive them if you choose to include the result in the contact form.
c) Technical browsing data To deliver the website and protect it from abuse, our hosting provider’s systems (Cloudflare) automatically process technical data such as IP address, browser and device type, the page requested and the time. When you submit a form, the Cloudflare Turnstile anti-spam service analyses some technical browser signals (such as IP address and user agent) to tell people from automated programs.
To limit repeated form submissions we keep, for at most 24 hours, a code derived from your IP address, the current date and a secret key using a one-way function (hash). The code changes every day and cannot be traced back to the address. We do not store your IP address in clear.
d) Statistics To understand which pages are useful we use Cloudflare Web Analytics, which measures visits in aggregate, without cookies and without profiling visitors. We also count, anonymously and aggregated by day, some actions on the site (for example how often the WhatsApp button is pressed or the check-up completed), with no data that could identify you.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your request, arranging the call, preparing a quote, sending you the confirmation email | Contact form, direct contact | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Writing to you when the “Cash flow forecast” product is ready to try | Waiting list | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| Protecting the site and forms from spam and abuse | Technical data, Turnstile signals, temporary IP hash | Our legitimate interest in site security (Art. 6(1)(f) GDPR) |
| Measuring site use in aggregate | Aggregate statistics | Our legitimate interest in improving the site (Art. 6(1)(f) GDPR); the data does not identify you |
| Complying with legal obligations and defending our rights | Data needed case by case | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) |
We do not use your data for advertising, we do not sell it, and we do not take decisions based solely on automated processing that produce legal effects on you.
4. Do you have to provide the data?
No. But without the required fields in the contact form we cannot reply to you, and without an email address we cannot add you to the waiting list.
5. Who can see the data
The data is processed by us and, on our behalf, by providers of the technical services we need, appointed as processors (Art. 28 GDPR):
| Provider | What it does for us | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, form database, anti-spam protection (Turnstile), aggregate statistics (Web Analytics) | United States, with servers also in the EU |
| Resend (Plus Five Five, Inc.) | Sending notification and confirmation emails | United States; emails sent from the EU region (Ireland) |
| Register S.p.A. (Register.it) | The giovanni@softautomation.it mailbox where we receive requests | Italy (Florence) |
| Microsoft Corporation | The Outlook program we use to read the giovanni@softautomation.it mailbox: it may synchronise messages (including notifications of requests received from the website) to Microsoft servers | United States |
| GitHub, Inc. | Page that takes anyone typing the address without “www” (softautomation.it) to www.softautomation.it; for security purposes GitHub logs the IP address of visitors | United States |
For Turnstile, Cloudflare also processes some technical signals as an independent controller to improve its bot detection, under its own notice: https://www.cloudflare.com/turnstile-privacy-policy/
If you contact us on WhatsApp, the communication goes through WhatsApp (Meta), which processes the data as an independent controller under its own policy.
Data may be disclosed to authorities where required by law. We do not publish it.
6. Transfers outside the European Union
Cloudflare, Inc., Resend, GitHub, Inc. and Microsoft Corporation are based in the United States. The first three are certified under the EU-U.S. Data Privacy Framework and Microsoft states that it complies with it; the Framework was found adequate by the European Commission (decision of 10 July 2023). Cloudflare’s data processing agreement also includes the Commission’s standard contractual clauses. For Resend, emails are sent from the European region, while some technical account data (email metadata and logs) is stored in the United States.
7. How long we keep the data
| Data | Retention |
|---|---|
| Contact form requests and direct contacts that do not lead to an engagement | 12 months from the last contact, then deleted |
| Requests that lead to an engagement | For the duration of the relationship and then as required by law (for example 10 years for accounting records, Art. 2220 Italian Civil Code) |
| Waiting list | Until consent is withdrawn or the product launches, and in any case no more than 24 months from joining |
| Temporary IP hash to limit submissions | At most 24 hours |
| Technical data processed by Cloudflare | According to the provider’s technical retention |
| Aggregate statistics | Without limit, as they contain no personal data |
8. Your rights
You can ask us at any time to:
- access your data and receive a copy (Art. 15);
- correct it (Art. 16);
- erase it (Art. 17);
- restrict its processing (Art. 18);
- receive it in a machine-readable format or have it sent to another controller (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw your waiting-list consent, without affecting processing already carried out (Art. 7(3)). Just reply to one of our emails or write to us.
To exercise your rights write to giovanni@softautomation.it. We reply within one month.
If you believe the processing breaks the law, you can complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or to the supervisory authority of the EU country where you live or work.
9. Children
The site is aimed at businesses and professionals. We do not knowingly collect data from children under 14.
10. Changes
If we change how we process data, we update this page and the date at the top. We notify waiting-list members by email of significant changes.
Cookies and technical tools: see the cookie policy.