Privacy

This notice applies to the marketing website https://cervio.app. The Site allows you to browse informational content, request a product demo via the dedicated form, book a demo via Google Calendar, and contact the team by email.

1. Data controller

Cervio S.R.L.
Registered office: Corso Vinzaglio 2, 10121, Torino, Italia
VAT no. IT13482690016
Share capital: € 15.000,00 i.v.
Certified email (PEC): [email protected]
Email: [email protected]

Cervio S.R.L. is the independent data controller for data collected through the Site.

2. Types of data collected

The Site collects the following categories of personal data, either directly or through technical providers:

Data voluntarily provided by the user via the demo request form: first name, last name, email address, company, plus the date and time the request was submitted.

Data voluntarily provided via Google Calendar (demo booking): name, email address, any notes entered by the user, date and time of the chosen slot, plus technical data processed by Google in the booking context.

Data voluntarily provided by writing to the Site's contact email addresses: the sender's email address and the content of the message.

Data collected automatically during browsing: IP address, browser type and version, operating system, pages visited, date and time of access, language preference (NEXT_LOCALE cookie), cookie preferences (cervio-consent cookie), and other technical identifiers required to deliver the Site.

Providing the data requested by the form is optional but necessary to be contacted and arrange a demo. Refusal means we cannot follow up on the request.

3. Purposes and legal basis of processing

Personal data is processed for the following purposes:

• Handling demo requests and contacting the data subject. Legal basis: pre-contractual measures taken at the data subject's request (Art. 6.1.b GDPR). Data: first name, last name, email, company.
• Organising demos via Google Calendar booking. Legal basis: pre-contractual measures (Art. 6.1.b GDPR). Data: information provided during booking.
• Responding to contact requests received by email. Legal basis: pre-contractual measures (Art. 6.1.b GDPR); legitimate interest (Art. 6.1.f GDPR). Data: information provided by the user.
• Providing, securing, and operating the Site. Legal basis: legitimate interest (Art. 6.1.f GDPR). Data: browsing and technical data.
• Storing cookie preferences. Legal basis: consent where required (Art. 6.1.a GDPR). Data: cookie banner preferences.
• Compliance with legal obligations. Legal basis: legal obligation (Art. 6.1.c GDPR). Data: relevant data.
• Legal defence and protection of rights. Legal basis: legitimate interest (Art. 6.1.f GDPR). Data: relevant data.

The user may at any time ask not to be contacted further, or withdraw consent where given, by writing to [email protected], without affecting the lawfulness of processing carried out before withdrawal.

4. Processing methods

Processing is carried out using IT and telematic tools, with logic strictly related to the stated purposes and with appropriate technical and organisational security measures to prevent loss, unlawful or improper use, and unauthorised access to data.

Data is processed exclusively by personnel authorised and instructed by the Controller, or by external parties appointed as processors under Art. 28 GDPR.

5. Data recipients

Personal data may be disclosed to:

Demo requests submitted via the form are received server-side on the Site's self-managed infrastructure (Hetzner hosting, Coolify orchestration), with data centres in the European Union, and notified to the Cervio team via the Resend email service.

Demo booking via Google Calendar takes place on a service operated by Google LLC (calendar.app.google): data entered by the user is processed by Google as an independent controller, under Google's privacy policy (policies.google.com/privacy). Cervio receives only the information needed to confirm the appointment (e.g. name, email, time).

• Hetzner Online GmbH (server hosting, self-managed infrastructure via Coolify). Data processor under Art. 28 GDPR; registered office and data centres in the European Union (Germany/Finland).
• Resend, Inc. (sending email notifications for demo requests). Data processor under Art. 28 GDPR; based in the United States. See section 6 for safeguards on transfers outside the EU.
• Advisers and professionals (accountants, lawyers) in the course of their respective services.
• Public authorities where legitimately requested.

An up-to-date list of processors may be requested by writing to [email protected].

Data is not disseminated and is not subject to automated profiling or automated decision-making.

6. Transfers of data outside the EU

Personal data processed through the Site is mainly handled on infrastructure with data centres in the European Union. The Resend service, used to send email notifications for demo requests, is based in the United States: the data required for notification (first name, last name, email, company) is transferred to and stored in the United States in compliance with the GDPR, on the basis of both Resend's participation in the EU-US Data Privacy Framework and the Standard Contractual Clauses adopted by the European Commission (Arts. 45 and 46 GDPR), included in the relevant data processing agreement (DPA).

Google Calendar: demo booking involves processing of personal data by Google LLC in the United States as an independent controller. For the safeguards applied by Google, please refer to Google's privacy policy.

Should additional providers based outside the EU be introduced in future, this notice will be updated and the same safeguards provided for by the GDPR will be adopted.

7. Retention period

Data is retained for the time strictly necessary for the purposes for which it was collected:

• Demo requests (first name, last name, email, company): for the time needed to handle the request and up to 12 months from the last contact, unless a contractual relationship is established.
• Demo bookings via Google Calendar: for the time needed to organise and conduct the demo and up to 12 months from the last contact, unless a contractual relationship is established; retention periods applied by Google are governed by Google's policy.
• Browsing data/technical logs: maximum 12 months unless required to investigate offences.
• Data for legal obligations: for the period required by applicable law (e.g. 10 years for accounting records).
• Cookie preferences (cervio-consent): 6 months, as stated in the Cookie Policy.

At the end of the retention period, data is deleted or irreversibly anonymised.

8. Data subject rights

Under Articles 15-22 of the GDPR, the user has the right to:

• Access their personal data and obtain a copy.
• Rectify inaccurate data or complete incomplete data.
• Erase data ("right to be forgotten") in the cases provided for.
• Restrict processing.
• Object to processing based on legitimate interest.
• Receive their data in a structured format (portability).
• Withdraw consent at any time.
• Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise these rights, the user may write to [email protected]. The Controller responds within 30 days of receiving the request.

9. Cookies

The Site uses cookies and tracking tools, including a banner to manage preferences. For more information, see the Cookie Policy available at /legal/cookies.

10. Changes to this notice

The Controller reserves the right to amend this notice at any time, notifying users on this page. Please check this section regularly, referring to the last updated date shown at the top.

In the event of material changes, users with an ongoing demo request will also be informed by email.