Privacy policy

This notice, provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), describes how personal data of xkdigital.it users is processed.

Data controller

The data controller is XKDIGITAL di Kenga Xheraldo, based in Novara (NO), Italy — VAT IT02772920035.

For any matter concerning data processing you can write to: info@xkdigital.it.

What data we process

Data voluntarily submitted through the contact form: full name, email address, phone number (optional), service of interest and message content.

Technical browsing data: the hosting infrastructure (Cloudflare) automatically collects, for security and service-delivery purposes, data such as IP address and technical request logs. The Cloudflare Turnstile anti-spam service is active on the contact form and analyses technical browser signals to distinguish real users from bots.

The site has no user accounts, no newsletter and no advertising profiling. Subject to the user’s consent, aggregated and anonymised usage statistics are collected through Google Analytics 4 (see the «Usage statistics» section); without consent no analytics tool is activated.

Purposes and legal bases

Answering requests sent through the contact form and managing any pre-contractual phase: the legal basis is the performance of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR).

Ensuring site security and preventing abuse (anti-spam, anti-bot): the legal basis is the controller’s legitimate interest (Art. 6(1)(f) GDPR).

Measuring site usage in aggregate form to improve content and performance, through Google Analytics 4: the legal basis is the data subject’s consent (Art. 6(1)(a) GDPR), given through the dedicated banner and withdrawable at any time.

Establishing, exercising or defending legal claims, where necessary: the controller’s legitimate interest (Art. 6(1)(f) GDPR).

Usage statistics

Only if the user gives consent through the banner, the site uses Google Analytics 4 to collect aggregated usage statistics (such as pages visited, visit duration, device type), in order to improve content and performance.

Processing is carried out with an anonymised IP address and without cross-referencing the data with other information to identify the individual user. Consent is optional, does not affect browsing and can be withdrawn at any time via the «Cookie preferences» link in the site footer.

Recipients and data processors

Data submitted through the form is delivered to the controller by email through the provider Resend (Resend, Inc.), acting as data processor for the forwarding service.

The site is hosted on Cloudflare Pages (Cloudflare, Inc.), which also provides security and anti-spam services (Turnstile) and acts as data processor for hosting and protection services.

If the user gives consent, usage statistics are collected through Google Analytics 4, a service of Google Ireland Limited (with possible processing by Google LLC, USA), acting as data processor for statistical measurement. The IP address is processed in anonymised form.

Data is not disseminated, sold or shared with third parties for marketing purposes.

Transfers outside the EU

The providers listed (Cloudflare, Resend and, subject to consent, Google) may process data outside the European Economic Area, in the United States. Transfers take place on the basis of the safeguards provided by Articles 44 et seq. GDPR, such as adequacy decisions (including the EU-U.S. Data Privacy Framework, where applicable) and/or Standard Contractual Clauses approved by the European Commission.

Data retention

Requests received through the form are kept for the time needed to handle them and for any subsequent pre-contractual or contractual phase, and in any case no longer than 24 months from the last contact, unless legal obligations apply or a contractual relationship is established.

Technical security logs are retained according to the hosting provider’s retention policies, for the time strictly necessary for security purposes.

Rights of the data subject

Data subjects may at any time exercise the rights provided by Articles 15-22 GDPR: access, rectification, erasure, restriction of processing, objection and data portability, by writing to info@xkdigital.it.

Data subjects also have the right to lodge a complaint with the competent supervisory authority: for Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Nature of data provision

Providing data through the form is optional, but the fields marked as required are necessary to answer the request: without them it will not be possible to follow up on the contact.

Changes to this notice

The controller may update this notice, including as a result of regulatory changes or changes to the services used. The version published on this page, with its update date, is the one in force.