Privacy policy

The controller is Codedesign S.r.l., Via Nino Pesce 38, 18018 Taggia (IM), Italy, VAT number IT01739830089.

You can contact us by email at info@codedesign.it, by certified email (PEC) at codedesign@legalmail.it, or by phone at +39 0184 716 626.

Contact form

When you write to us through the contact form, we process the data you provide: name, company, role, email address, phone number, the topic you select and the text of your message. Fields marked as optional can be left blank. The website sends this data by email to our mailbox through the Twilio SendGrid email service; the mailbox is hosted on Microsoft 365. The website does not keep a copy of the message.

Email and phone

If you write to us by email or call us, we process your contact details and what you tell us, for the same purposes.

Website statistics

We measure visits to the website with Umami, a statistics tool that we install and manage ourselves, on our own server at Hetzner Online GmbH in Germany. Umami uses no cookies and stores nothing in your browser. It records the page address, the referring page, the language, the screen size and the type of browser, operating system and device. It also reads the loading and response times of the page (the so-called Core Web Vitals), to find slow pages, and counts successful submissions of the contact form, with only the topic chosen and the language, never the data you wrote. The server receives your IP address and uses it, without saving it, for two purposes only: deriving your approximate location (country, region and city) and calculating a visit code, which changes every month and from which the IP address cannot be traced back. Only aggregate data and visit codes that cannot be linked to you are kept. Umami does not follow you across other websites, does not create profiles and does not share data with third parties; if your browser sends the “Do Not Track” signal, no statistics are collected.

Experience analysis, only with your consent

If you accept experience analysis in the cookie banner, the website also loads the Umami recorder, which sends the data to the same server of ours in Germany, at Hetzner Online GmbH: no third party receives it. The same Umami installation also measures evolus.ai, another website of ours, with the data kept separate. The recorder collects two things:

• Heatmaps: where you click, how far you scroll, the size of the window and of the page, and the page address. We look at them in aggregate, to understand where attention goes.
• Session recordings: clicks, scrolling, mouse movements, moves from one page to another and the content of the page as it appears on the screen. Each recording stops automatically after 5 minutes at most. The content of the fields you fill in is never recorded: it is hidden in your browser, before anything is sent.

Recordings are linked to the Umami visit code described above, not to your name. Only we use them, to understand what to improve on the website: we create no profiles, do not combine this data with other information and do not share it with third parties. The recorder uses no cookies and stores nothing in your browser; if your browser sends the “Do Not Track” signal, it records nothing. Until you accept, and if you refuse, the recorder is not even loaded.

Google Analytics, only with your consent

If you accept statistics in the cookie banner, the website loads Google Analytics 4, which stores cookies with a random identifier in your browser and sends Google the pages you visit, the events we measure, information about your device and browser, and the referring page. For visitors in the European Union, Google states that it uses the IP address only to derive an approximate location and discards it without logging it. Google Signals and ad personalisation are turned off. Until you accept, and if you refuse, no Google software is loaded and no data is sent to Google.

Meta Pixel, only with your consent

If you accept the “Marketing” category in the cookie banner, the website loads the Meta Pixel of Meta Platforms Ireland Limited (Ireland). The pixel records the pages you visit and the successful submission of the contact form, without the content of the message and without your contact details. Along with these events Meta receives technical information about your browser and device and your IP address, and stores first-party cookies in your browser (_fbp and, if you come from an ad, _fbc: 90 days). If you are logged in to Facebook or Instagram, Meta may also use its own cookies on its own domains. We use it to measure our campaigns on Facebook and Instagram and to show ads to people who have visited the website.

We do not send Meta your email address, your phone number or any other data you enter on the website, and the pixel's automatic events are turned off. Until you accept, and if you refuse, no Meta software is loaded and no data is sent to Meta.

Running the server

The website runs on our own server at Hetzner Online GmbH, in Germany. To show you the pages the server receives, like any web server, your IP address and the technical data of the request, but we keep no log of visits. The server keeps only technical messages about how the website is running, in a fixed-size space, automatically overwritten as new ones are added.

• Answering your request, and taking the steps you ask for before a possible contract: Article 6(1)(b) GDPR.
• Following up on your request and managing our relationship with you and your company: our legitimate interest, Article 6(1)(f) GDPR.
• Showing you the website and protecting it, including the server's technical messages: our legitimate interest, Article 6(1)(f) GDPR.
• Understanding how the website is used and finding slow pages with cookieless Umami statistics: our legitimate interest in improving it, Article 6(1)(f) GDPR. You can object at any time by writing to us or by turning on the “Do Not Track” signal in your browser.
• Measuring in more detail how the website is used with Google Analytics: only with your consent, Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003). You can withdraw it at any time from “Cookie preferences”, at the bottom of every page.
• Understanding what to improve on the website with Umami heatmaps and session recordings (experience analysis): only with your consent, Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code. You can withdraw it at any time from “Cookie preferences”, at the bottom of every page.
• Measuring our campaigns on Facebook and Instagram and showing ads to people who have visited the website with the Meta Pixel (“Marketing” category): only with your consent, Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code. You can withdraw it at any time from “Cookie preferences”, at the bottom of every page: the pixel stops sending data and the website deletes the _fbp and _fbc cookies.

We do not use your data for purposes other than those listed here.

Providing your data is optional. Without the required fields of the form, however, we cannot reply to you. Consent to Google Analytics, to experience analysis and to the Meta Pixel is optional too: if you do not give it, the website works just the same.

We keep the data of a contact request for the time needed to handle the request and any follow-up, and in any case for no longer than 24 months from our last exchange, unless a contract follows. If a contract follows, the data is kept for the duration of the contract and for as long as the law requires afterwards.

We keep no log of visits; the server's technical messages are overwritten automatically as new ones are added. We keep Umami statistics data for 24 months, then delete it automatically.

With your consent to experience analysis, we keep heatmap data for 12 months and session recordings for 30 days, then delete them automatically.

Google Analytics user-level and event-level data is deleted by Google after 14 months; aggregate reports may remain available for longer.

With your consent to the Meta Pixel, the _fbp and _fbc cookies last 90 days. Data received by Meta is kept by Meta for the periods set out in its own policy.

Your data is processed by our staff, who are authorised and bound to confidentiality.

It is also processed on our behalf by these providers, acting as data processors under Article 28 GDPR: Hetzner Online GmbH, Germany, for the server of the website and of Umami, with the statistics and, if you accept them, the heatmaps and session recordings (Nuremberg); Twilio Inc., United States, with the Twilio SendGrid service, for sending the emails of the contact form (United States); Microsoft Ireland Operations Limited, Ireland, Microsoft Corporation group, for the Microsoft 365 mailbox where we receive the messages (European Union; the provider's support may also take place outside the Union).

Only if you accept Google Analytics, statistics data is processed on our behalf by Google Ireland Limited, acting as a data processor.

Only if you accept the Meta Pixel, event data is received by Meta Platforms Ireland Limited, Ireland. For collecting the data through the pixel and transmitting it, we are joint controllers with Meta Platforms Ireland (Article 26 GDPR), under Meta's “Controller Addendum”, which sets out the responsibilities. For any later processing Meta is an independent controller, under its own policy (facebook.com/privacy/policy (external link)). You can exercise your rights with Meta as well.

We do not sell your data. Apart from Meta, and only if you accept the Meta Pixel, we do not share it with third parties for their own purposes.

The website and Umami, including heatmaps and session recordings, run in Germany. Some processing, however, involves a transfer of data to the United States: sending the emails of the contact form (Twilio SendGrid), any technical support from Microsoft on the mailbox and, only if you accept Google Analytics, the statistics of Google LLC and, only if you accept the Meta Pixel, event data, which Meta Platforms Ireland may transfer to Meta Platforms, Inc. Transfers to Twilio Inc., Microsoft Corporation, Google LLC and Meta Platforms, Inc. rely on the EU-US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023, under which these companies are certified. You can check it at dataprivacyframework.gov (external link).

We do not make decisions based solely on automated processing, including profiling. If you accept the Meta Pixel, Meta may use event data to show ads, under its own policy.

Under Articles 15 to 22 GDPR you have the right to:

• access your personal data and obtain a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where the conditions of Article 17 apply;
• restrict the processing of your data;
• receive your data in a structured, commonly used and machine-readable format, and have it transmitted to another controller;
• object at any time to processing based on our legitimate interest;
• withdraw your consent to Google Analytics, to experience analysis and to the Meta Pixel at any time from “Cookie preferences”, at the bottom of every page, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, write to info@codedesign.it or to codedesign@legalmail.it. We reply without undue delay, and in any case within one month of receiving the request, as the GDPR requires. For data Meta receives through the pixel you can also contact Meta Platforms Ireland Limited, under its own policy.

If you believe that your data is processed unlawfully, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (external link), or with the supervisory authority of the EU country where you live or work, or where the alleged infringement took place.

This website uses technical cookies and, only with your consent, Google Analytics cookies, the Meta Pixel cookies and the Umami recorder for experience analysis, which uses no cookies. The details, and how to change your choice, are in the cookie policy.

We may update this policy. The date at the top of the page shows when it was last changed.