Last updated: October 2026
Smityx S.r.l. considers personal data protection an integral part of the way it works and has adopted a Data Processing Management System compliant with the GDPR. This page explains what data we collect through the website, why we collect it, how long we retain it and which rights you can exercise. Processing follows the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimization, accuracy, integrity and confidentiality.
1. Data controller
The data controller is Smityx S.r.l., with its registered office at Via delle Cisterne 54, 71043 Manfredonia (FG), Italy, VAT no. 04402990719.
For any request relating to the processing of personal data, you can email info@smityx.it or send a written communication to the registered office address.
Smityx S.r.l. has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 of the GDPR do not apply. The controller is your direct point of contact for any matter relating to your data.
2. Scope
This notice covers smityx.it, in both its Italian and English versions, and the data of people who browse the website or contact Smityx using the contact details provided on it. It does not cover other websites that may be accessed through links.
For its relationships with clients, suppliers, job applicants and employees, Smityx provides specific privacy notices when the data is collected.
3. What data we process
Browsing data
As with any website, the IT systems that enable it to operate collect certain data whose transmission is inherent in the use of Internet protocols: IP address, request date and time, requested page, server response code, browser type and operating system. This data is recorded in the hosting provider's technical logs, is not used to identify or profile users, and serves solely to ensure the website's operation and security. It may be used to establish responsibility in the event of cybercrime against the website.
Data provided voluntarily
When you contact us through the form on the Contact page or by writing directly to info@smityx.it, we process the data you choose to provide: full name, email address, company and phone number (optional), and the content of your message, together with any additional data contained in the correspondence.
The contact form sends your inquiry from the website server to info@smityx.it over an authenticated, encrypted email connection. The application does not keep a database of messages; the email is handled according to the retention rules below.
Cloudflare Turnstile is loaded when you open the contact form to protect it against automated abuse. The server validates the verification token before sending a message. Request counters use an identifier derived from the IP address, expire after an hour and are deleted on the next request. The application does not store the message body in these counters.
Please do not include special categories of personal data in your messages (for example, data concerning health, political opinions or religious beliefs, Article 9 GDPR), or data relating to criminal convictions or offenses (Article 10 GDPR). If we receive such data when it is not necessary to respond to your request, we will delete it.
Cookies
The contact form uses a technical session cookie to protect requests. No analytics or advertising tools are installed. Details are provided in the Cookie Policy.
4. Purposes and legal bases for processing
- To respond to contact requests, requests for information or quotes, and carry out the resulting pre-contractual activities (needs analysis and preparation of proposals). Legal basis: taking steps at the data subject's request before entering into a contract (Article 6(1)(b) GDPR) and, for general inquiries, the controller's legitimate interest in responding to those who contact it (Article 6(1)(f) GDPR).
- To ensure the website's operation, security and integrity by preventing misuse and cyberattacks. Legal basis: the controller's legitimate interest (Article 6(1)(f) GDPR).
- To comply with legal obligations or requests from competent authorities. Legal basis: legal obligation (Article 6(1)(c) GDPR).
- To establish, exercise or defend legal claims in or out of court. Legal basis: the controller's legitimate interest (Article 6(1)(f) GDPR).
Data is not used for marketing or profiling and is not subject to decisions based solely on automated processing (Article 22 GDPR). Your consent is therefore not required for the purposes listed above.
5. Provision of data
Providing browsing data is necessary to view the website. Providing your name, email address and a description of your request is necessary to receive a response: without this data, we cannot follow up on your inquiry. Company and phone number are optional.
6. Processing methods and security measures
Data is processed using IT and electronic tools, in ways strictly related to the stated purposes. Data is processed exclusively by Smityx personnel who are authorized and instructed pursuant to Article 29 GDPR and Article 2-quaterdecies of Italian Legislative Decree 196/2003. It is protected by appropriate technical and organizational measures, including system access through individual credentials, access restrictions based on job responsibilities, antivirus and firewall systems, regular backups and an internal procedure for managing personal data breaches.
7. Retention period
Data is retained for as long as necessary for the purposes for which it was collected, in accordance with the criteria set out in Smityx's internal data retention policy:
- Browsing data: for as long as strictly necessary for website security and operation, in accordance with the hosting provider's technical log retention periods, unless it is needed to investigate crimes against the website.
- Contact requests that do not lead to a contractual relationship: up to 24 months after the last contact, to allow the conversation to be resumed on similar requests; the data is then deleted.
- Requests that lead to a contractual relationship: for the duration of the relationship and for 10 years after it ends, in view of accounting and tax obligations and the limitation periods for legal claims.
- In the event of litigation: for the duration of the proceedings, until all appeal periods have expired.
At the end of the retention period, data is deleted or anonymized.
Cloudflare also processes technical browser data to deliver Turnstile. Its processing, including potential international transfers, is described in the Cloudflare Privacy Policy. The controller must maintain appropriate provider arrangements for its actual deployment.
8. Data recipients
Data may be made available, to the extent necessary for each purpose, to:
- Smityx personnel authorized to process data;
- suppliers that process data on behalf of Smityx, appointed as processors pursuant to Article 28 GDPR, particularly the website hosting provider (Hostinger) and the email service provider (Microsoft, Microsoft 365 service);
- external advisers (for example, accountants and legal advisers), if the request leads to a contractual relationship or litigation;
- public authorities and parties to whom disclosure is required by law.
Data is not made public or transferred to third parties. An up-to-date list of processors is available on request by emailing info@smityx.it.
9. Data transfers outside the European Union
Data is processed primarily within the European Economic Area. Some service providers, particularly the email service provider, may also process data in non-EU countries, such as the United States. In such cases, transfers take place in accordance with Article 44 et seq. of the GDPR, on the basis of an adequacy decision by the European Commission (for the United States, the EU-U.S. Data Privacy Framework, for participating organizations) or standard contractual clauses approved by the European Commission. You can request more information about the safeguards adopted by emailing info@smityx.it.
10. Your rights
As a data subject, you may, at any time:
- access your data and obtain information about its processing (Article 15);
- request rectification if it is inaccurate or incomplete (Article 16);
- request its erasure, where applicable (Article 17);
- request restriction of processing, where applicable (Article 18);
- receive the data you have provided to us in a structured, commonly used and machine-readable format (data portability, Article 20);
- object to processing based on the controller's legitimate interest, on grounds relating to your particular situation (Article 21).
To exercise your rights, email info@smityx.it or send a written request to Smityx S.r.l., Via delle Cisterne 54, 71043 Manfredonia (FG), Italy. Exercising your rights is free of charge. We will respond within one month of receiving your request; this period may be extended by two months for complex or numerous requests, in which case we will inform you within the first month. We may ask for information to verify your identity, solely to prevent your data from being disclosed to unauthorized persons.
If you believe that the processing of your data infringes the GDPR, you also have the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome, Italy - www.garanteprivacy.it) or seek a judicial remedy.
11. Children
The website is not directed at children under the age of 14, and Smityx does not knowingly collect their data. If you believe that a child has sent us personal data, please contact us and we will delete it.
12. Changes to this notice
Smityx may update this notice, for example following changes in legislation or the introduction of new services on the website. The current version is always published on this page, with the date of the last update.