Your privacy, kept simple.

When you send the contact form (or confirm the summary card prepared by the assistant), the request reaches our systems. We process:

• what you write: the type of need, the message, your name, phone number and/or email, your company if you give it, and your preferred time of day;
• the page you are writing from and, where available, where the visit came from (for example the name of a campaign or the click identifier of an ad, contained in the page address), so that we know which channels bring us requests;
• the path you took through the site during that visit (pages viewed, sections read and, if there is one, the conversation with the assistant), so that whoever calls you back already knows what you looked at.

Why: to reply to you and to manage any relationship that follows, at your request (Art. 6(1)(b) GDPR, pre-contractual measures). The source is used to measure our channels and the path to call you back well prepared (Art. 6(1)(f), legitimate interest): we do not use them to profile you and, at present, we do not pass it on to any advertising platform. If we ever do, we will update this notice first.

Who sees it: the Z-32 staff who handle requests. To alert them quickly, the notification goes through our work tools (email, messaging), with the request and the path through the site, nothing more.

How long: 24 months from the last contact if no relationship follows; if a contract follows, for the periods required by law for contractual and tax records. No newsletters, no other uses.

To block spam, the form uses a hidden field and a limit on submissions per network: the IP address is used only for this count and is not stored with the request.

We tell you below the text box, and we say it again here: you are talking to an artificial intelligence system, not a person. The messages you send pass through our servers in the European Union and are processed by AI models to generate the reply (Art. 6(1)(b) GDPR).

The assistant sends nothing on its own. If you ask to be contacted, it shows you a card with the details you have given it: the request is sent only when you press “Send” on the card, and from that moment section 02 applies.

Conversations are kept for 12 months, then deleted, for three reasons: traceability (being able to reconstruct and check what the assistant did), security (recognising and blocking abuse) and analysis, in aggregated and anonymous form, of what businesses ask us. All three rest on our legitimate interest (Art. 6(1)(f)). Only anonymous, aggregated traces, which no longer relate to anyone, are kept with no time limit (Recital 26).

The chat needs no registration: we do not create accounts and we do not link different conversations together. We do not profile you and we do not take automated decisions that produce legal effects (Art. 22). A good rule: for sensitive or confidential data, use email, not the chat.

So that the conversation carries on while you change page, your browser keeps the chat in the tab’s memory (sessionStorage) until you close the tab. This only happens if you open the chat; it is not used to recognise you, and it disappears by itself.

To understand whether the site is useful, we measure, with our own tools and without cookies, what happens on its pages: which pages are read, how long they stay in the foreground, how far people scroll, which buttons are tapped, at which point people stop filling in the form (which fields were filled in and which need was chosen, never what was written), and which site or campaign they come from. We also measure the technical quality of the visit: how long the page takes to appear, any errors, the browser family (for example “Safari on iPhone”) and the window size.

How, without identifying you: your device stores nothing that recognises you. To count the visitors of a given day, the server computes a hash from a random value that changes every day, the network address and the browser type; the IP address is not written down and the next day the hash is different, so no one can be followed over time or from one site to another.

If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we measure nothing.

Legal basis: legitimate interest in improving the site (Art. 6(1)(f) GDPR). Retention: detailed events for 13 months, after which only aggregate totals remain.

The server records the requests it receives: page requested, date and time, outcome, browser type and referring site. This lets us spot faults and attacks. The IP address is truncated before it is written: for IPv4, the first three of its four parts are kept; for IPv6, the first three of eight. Legal basis: Art. 6(1)(f) GDPR. Retention: up to 45 days, then automatic deletion; for statistics we keep a summary of each visit, with the address already truncated, for 13 months.

The chat and the form have an anti-abuse counter: we count how many messages or submissions come from each address and, above a threshold, we stop accepting them. The address is used only as the key for the count, is not written to any log, and the counter expires by itself within 24 hours.

The site, the form, the statistics and the chat systems are hosted on a server in the European Union (Hetzner Online GmbH, Germany), which acts as data processor. Fonts, scripts and images are all served from here: browsing does not pass through any third party.

The one exception is generating the chat’s replies: for this we rely on OpenRouter, which routes the text of the messages to the AI model that produces the reply. When the model provider operates outside the EU, the transfer takes place on the basis of the safeguards in Chapter V of the GDPR (Arts. 44–49), in particular the standard contractual clauses. You can ask us for a copy by writing to us.

For notifications to the team we use our own email and messaging tools, with the request and the path through the site. The up-to-date list of processors is available on request.

This site does not use cookies. There is no banner because there is nothing to accept: no technical or profiling cookies, no third-party analytics platform, no content loaded from other sites.

Your browser keeps only a few navigation settings in the tab’s memory (sessionStorage) and, if you open the chat, the conversation (see section 03): nothing that recognises you, and it disappears when you close the tab. If we ever need to use tools that require consent, we will update this page first and ask for your consent properly.

At any time you can exercise the rights set out in Arts. 15–22 GDPR: access, rectification, erasure, restriction, objection and portability. Just send an email to amministrazione@z-32.it: we will reply within the time limits set by the GDPR. If you believe that a processing operation breaks the law, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority).

Providing your data is always optional: you can read the whole site without leaving any.

Z-32 is a brand of CSF · VAT no. 03372330591 · registered office: Latina, Italy.

The contents of this site — texts, graphics, the agent and its animations — belong to the controller: all rights reserved. The trademarks mentioned belong to their respective owners.