// governance & transparency
Privacy Policy
This notice explains how Proteos-engineering S.r.l. processes personal data when you visit www.proteos.it, use its content or submit a request through the Contact page. It is provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and should be read together with the Cookie Policy.
1. Controller and contact details
The data controller is Proteos-engineering S.r.l., with registered address at Corso di Porta Vittoria, 10, 20122 Milano (MI), Italia, VAT no. 13265510969. For information about processing or to exercise the rights described in this notice, contact info@proteos-engineering.com.
As of the date of this notice, no Data Protection Officer (DPO) has been appointed for the processing described here; requests are handled directly by the Controller.
2. Data we process
We process only the data needed to make the site available, protect it and handle requests you send us. This includes:
- Browsing and security data: IP address, request date and time, requested URL and method, response code, user agent, request origin and technical data needed to prevent abuse, apply rate limits and investigate incidents. This data may appear in server and security logs.
- Contact form data: name, email address, company, optional phone number, selected subject and message content. The form may also process language, token and anti-bot verification metadata needed to validate the submission.
- Communication data: information contained in emails or messages you send us directly, including through channels linked from the site, and in later replies or communications concerning your request.
- Content interactions: animations, scrolling, 3D models and interface scripts run in the browser to present the site and do not send behavioural data or analytics identifiers to Proteos. The HTTP requests needed to load pages and assets may still appear in technical server logs.
- Technical site preference: a first-party local-storage entry that remembers for a limited period that you closed the notice about the site’s technical mechanisms. It is not used to profile users or track them across websites.
3. Sources, purposes and legal bases
The data is collected directly from you when you use the form, email us or contact us through channels linked from the site, including LinkedIn; other technical data is generated automatically while you browse. We do not purchase or enrich profiles from databases for the purposes described in this notice. The table summarises why we process data and the applicable legal basis.
| Purpose | Main data | Legal basis |
|---|---|---|
| Make pages available, maintain security and prevent automated or abusive requests. | Browsing data, IP, user agent, security events and anti-bot verification. | Article 6(1)(f) GDPR: the Controller’s legitimate interest in site security and continuity. |
| Reply to requests sent through the form or by email, assess a possible engagement and organise the initial contact. | Name, email, company, phone, subject and message. | Article 6(1)(b) GDPR where the request concerns pre-contractual steps; otherwise Article 6(1)(f) for handling general enquiries and communications. |
| Meet legal, accounting, tax, judicial or regulatory obligations. | Data relevant to the specific obligation or proceeding. | Article 6(1)(c) GDPR: legal obligation. |
| Establish, exercise or defend a right, handle incidents and disputes. | Data relevant to the request, logs and relationship records. | Article 6(1)(f) GDPR: legitimate interest in protecting rights. |
4. Providing data
The fields marked as required in the Contact form are needed to identify the request, verify a reply address and assess its content. If you do not provide them, the form cannot be submitted. Phone number is optional. You can always email us directly, in which case we process the data contained in your communication.
Processing needed to answer an enquiry is not based on marketing consent: this site does not send newsletters or promotional communications. If non-essential tools were ever introduced, a separate choice would be requested before they were activated; none are present in the current configuration.
The site is primarily aimed at businesses and professionals and is not designed to intentionally collect data from children. If a child contacts us without parental involvement, a parent or legal guardian may contact the Controller to request verification and, where applicable, erasure.
5. Recipients and processors
Data may be accessed, within their roles, by authorised personnel and by suppliers supporting the site or communications. Suppliers processing data on the Controller’s behalf are bound by instructions and by an Article 28 GDPR agreement or other required legal act, where applicable.
- Resend / Plus Five Five, Inc.: the server-side service used to deliver form requests to the company mailbox. It may process email addresses, metadata and message content to provide the service. Resend DPA · GDPR information.
- Cloudflare, Inc.: Turnstile is used only on the Contact page to check that a submission comes from a person and reduce spam. For site protection, Cloudflare acts on the Controller’s behalf; for processing that its notice identifies as independent controller processing, including improving and securing Turnstile, it determines the purposes and means itself. Verification may involve the client IP address, User-Agent, TLS fingerprint and sitekey/origin data; server-to-server verification may also transmit the IP address. Turnstile privacy notice.
- Infrastructure and authorised personnel: the site and its technical logs are managed through infrastructure controlled by the Controller and by authorised Proteos personnel. Access is limited to what is necessary for service operation, security and maintenance; no external technical access is planned.
- Register.it: provider of the company mailbox info@proteos-engineering.com. It may process email content and related metadata to provide the mail service, under the relationship and terms applicable to the mailbox. Register.it privacy notice · contracts and DPA.
- Authorities and professional advisers: public bodies or authorised professionals where disclosure is required by law, an authority order or is necessary to protect a right.
6. Transfers outside the European Economic Area
Some technology suppliers may process data outside the European Economic Area. Resend states that its main service operations and data storage take place in the United States and identifies the EU Standard Contractual Clauses and, where applicable, participation in the EU-U.S. Data Privacy Framework as transfer tools in its DPA. For Cloudflare, transfers relating to its services may rely on the EU Standard Contractual Clauses with supplementary measures and/or participation in the EU-U.S. Data Privacy Framework, according to its DPA and GDPR documentation.
Transfers take place only where necessary for the service and with an appropriate legal basis and safeguards under Chapter V GDPR. For further detail, consult the Resend Privacy Policy, the Resend DPA, Cloudflare’s Turnstile privacy notice, its Cloudflare DPA and Cloudflare GDPR documentation.
7. Retention periods
We keep data for the time needed for the purpose for which it was collected and apply proportionate deletion or anonymisation criteria:
- Contact requests: up to 24 months from the last communication, unless a longer period is needed for a contractual relationship, legal, accounting or tax obligations, or the establishment, exercise or defence of a right.
- Technical and security logs: for the time needed to prevent abuse, handle incidents and demonstrate service security, normally no longer than 12 months, unless an incident or legal obligation requires more.
- Supplier systems: according to contractual periods and service policies, which may differ from the limits applied directly by Proteos. The Controller verifies and updates these periods against the accounts and DPAs actually active; for Resend, the retention periods stated in its DPA and GDPR documentation also apply.
- Technical site preference: the local entry is kept for a maximum of 6 months, after which it is removed and the notice may appear again. You can delete it at any time through browser settings or the Cookie Policy.
8. Your rights
Under Articles 15–22 GDPR, where applicable, you may request access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interests. You may also withdraw consent where consent was given, without affecting the lawfulness of processing carried out before withdrawal.
To exercise a right, email info@proteos-engineering.com, identifying the right you wish to exercise and providing enough information to handle the request. We may reasonably verify your identity to avoid disclosing data to an unauthorised person. We normally reply within one month; the period may be extended in the cases allowed by Article 12 GDPR, with notice of the reasons.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante Privacy) or the supervisory authority in the place where you live or work.
9. Security and automated processing
We apply technical and organisational measures proportionate to the risk, including HTTPS, Content Security Policy and other security headers, input validation, anti-spam protection, request-origin checks, rate limiting, access restrictions and server-side secret management. No Internet transmission can be guaranteed absolutely secure; do not include passwords, credentials or unnecessary confidential information in the form.
The site does not profile users and does not make decisions based solely on automated processing that produce legal or similarly significant effects. The anti-bot check exists only to protect the form from abuse and does not assess the person or the substance of the request.
10. External links and services
The site links to external services, including the company LinkedIn page. Merely loading this site does not embed LinkedIn or send browsing data to LinkedIn; when you choose to open the platform, subsequent processing is governed by LinkedIn’s own notice and terms, not this page. We do not control the privacy practices of external sites.
11. Updates to this notice
This notice may be updated when services, suppliers, purposes or applicable law change. The date at the top identifies the latest review. If a change materially affects processing, we will use the communication method required by law.
This page should be read together with the Cookie Policy, which describes technical mechanisms that store or access information on the device.
12. Legal references
This notice takes account of Regulation (EU) 2016/679, Italian Legislative Decree 196/2003 as amended and guidance from the Italian Data Protection Authority. It describes the processing currently configured for this site and must be updated if new tools such as analytics, advertising, newsletters, maps or embedded content are introduced.