Data controller
The data controller for personal data collected through this site is:
Trandafir Roxana Alexandra
Operating commercially as Elethos
Address: Desenzano del Garda (BS), Italy
Email: privacy@elethos.it
VAT: IT04559720984
For any request regarding the processing of your personal data, please write to the email address above. Requests are handled within 30 days of receipt (Art. 12 GDPR).
Data collected
The site collects the following categories of personal data:
- Contact form: first and last name, company, email address, service of interest, message text. Optional, but necessary to respond to the request.
- Microsoft Bookings: first and last name, email address, optionally company and phone number, selected time slot. Voluntarily provided by the data subject when booking.
- Navigation data — Google Analytics 4 (only with consent): anonymised IP address, pages visited, session duration, device and browser type, approximate geographic area (city/country). These do not allow direct identification of the data subject.
- Server logs (Hosterion): IP address, timestamp, requested URLs, HTTP status code, user agent. Collected automatically for security and proper site operation.
Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact form | Responding to information requests and managing commercial contacts | Explicit consent (Art. 6.1.a GDPR) — checkbox in the form |
| Microsoft Bookings | Managing preliminary consultation call bookings | Pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR) |
| Google Analytics 4 | Statistical traffic analysis to improve the site (pseudonymous data) | Explicit consent (Art. 6.1.a GDPR) — activated only after banner acceptance |
| Server logs | Security, abuse prevention, technical diagnostics | Legitimate interest of the controller (Art. 6.1.f GDPR) |
Sub-processors and third parties
The following providers process personal data as data processors (Art. 28 GDPR).
| Provider | Country | Purpose | DPA | Privacy notice |
|---|---|---|---|---|
| Google LLC | USA | Google Analytics 4 — traffic analysis | Google Data Processing Amendment (accepted in GA4 Admin) | policies.google.com |
| Microsoft Corporation | USA / IE | Microsoft Bookings — call booking | Microsoft Online Services DPA (included in M365 subscription) | privacy.microsoft.com |
| Hosterion | IT | Website hosting, server access logs | Signed | hosterion.it |
Non-EU transfers
Data processed by Google LLC and Microsoft Corporation is transferred to the United States. Transfers are covered by:
- EU–US Data Privacy Framework (European Commission adequacy decision 2023/1795 of 10 July 2023): Google LLC and Microsoft Corporation are certified under this framework, ensuring an equivalent level of protection to that in Europe.
- Standard Contractual Clauses (SCC) under Art. 46.2.c GDPR, incorporated in the respective DPAs, as an additional safeguard.
Data processed by Hosterion remains within the European Union — no non-EU transfers.
Retention periods
| Data category | Retention | Note |
|---|---|---|
| Contact form messages | 12 months | From the last communication received, then deletion |
| Bookings reservation data | 24 months | Configurable in M365 tenant — retention policy set to 24 months |
| Server logs (Hosterion) | 30 days | Automatic rotation by the hosting provider |
| Google Analytics 4 data | 14 months | GA4 configuration: Data Retention set to 14 months. Anonymous aggregated data available without expiry. |
elethos_consent (localStorage) |
Persistent | Retained until manual deletion or browser clean-up by the user |
Data subject rights
Rights guaranteed by Articles 15–22 of the GDPR.
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction (Art. 18)
- Portability (Art. 20)
- Objection (Art. 21)
To exercise the rights listed above, or to withdraw previously given consent, write to privacy@elethos.it. The controller responds within 30 days of receiving the request (Art. 12 GDPR), extendable to 60 days in particularly complex cases. You may also lodge a complaint with the Italian Data Protection Authority (Garante) — www.gpdp.it.
Cookie Policy
This site is static (no application server). Cookies set are limited to those listed below. No profiling cookies are set without explicit consent.
Technical cookies (always active)
| Cookie / Storage | Type | Duration | Party | Purpose | Legal basis |
|---|---|---|---|---|---|
elethos_consent |
localStorage | Persistent | First | Stores cookie banner choice (accept / necessary) | Legitimate interest — necessary |
Analytics cookies (only with consent)
Set by Google Analytics 4 via Google Tag Manager only after explicit consent. Without consent, GA4 operates in Consent Mode v2 mode (aggregated data, no identification cookies).
| Cookie | Type | Duration | Party | Purpose | Legal basis |
|---|---|---|---|---|---|
_ga |
Analytics | 2 years | Third (Google LLC) | Distinguishes unique users. Contains an anonymous identifier. | Consent |
_ga_EV01Q1V2DZ |
Analytics | 2 years | Third (Google LLC) | Maintains GA4 session state for the specific property. | Consent |
_gid |
Analytics | 24 hours | Third (Google LLC) | Distinguishes users. Resets daily. | Consent |
Third-party cookies — Microsoft Bookings (contact page)
The Contact page embeds a Microsoft Bookings iframe (outlook.office.com). Microsoft may set its own cookies to manage authentication and booking sessions. For details: Microsoft Privacy Statement.
Changes to this policy
The controller reserves the right to update this notice to comply with regulatory changes, new processing activities or changes to the services used. The date of the last update is shown at the top of the page. In the event of material changes, notice will be given via a prominent notice on the site. Continued use of the site after changes are published constitutes acceptance of the updated version.