Privacy Policy
Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree no. 196/2003 (“Italian Privacy Code”), as amended by Legislative Decree no. 101/2018.
This Privacy Policy explains how Keletes processes personal data when you visit www.keletes.com (the “Site”), use the Keletes product configurator embedded on third-party websites (the “Configurator”), buy our services, or contact us via e-mail, phone, WhatsApp, LinkedIn, Instagram or other social networks (the “Social Channels”).
Our services are intended for businesses and professionals (B2B). The personal data we process mainly concerns representatives and contact persons of companies. The GDPR protects them as natural persons, and we apply it in full.
1. Data Controller
Keletes S.a.s. di Daniele Draganti & C.
Via Donatori del Sangue, 55 – 21052 Busto Arsizio (VA), Italy
VAT no. IT02585890128 – Varese Company Register
E-mail: privacy@keletes.com
Phone: +39 0331 1816157
We have not appointed a Data Protection Officer (DPO), as we do not fall within the cases of Article 37 GDPR. For any privacy matter, write to privacy@keletes.com.
2. Legal framework
We process personal data in compliance with:
- Regulation (EU) 2016/679 (GDPR);
- Legislative Decree no. 196/2003 (Italian Privacy Code) (Italian text), as amended by Legislative Decree no. 101/2018, in particular Article 122 (cookies and similar technologies) and Article 130 (direct marketing by electronic means);
- Directive 2002/58/EC (ePrivacy Directive), as amended by Directive 2009/136/EC;
- the decisions and guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali), including the Guidelines on cookies and other tracking tools of 10 June 2021 (Italian text).
3. Personal data we process
Navigation data. When you visit the Site, our servers record technical data: IP address, browser type and version, operating system, time zone, pages visited, referring page, date and time of the request. With your consent, Google Analytics also collects pseudonymous usage data (pages viewed, interactions, approximate location). Details are in our Cookie Policy.
Contact and business data. When you fill in a form, register, place an order or are indicated as contact person by your company, we process: first and last name, business e-mail, phone number, company name, role, VAT and tax code, registered and operational address, billing and shipping address, SDI recipient code or PEC, order details and communication history.
Payment data. For bank transfers and direct debits we process IBAN and the data needed for electronic invoicing. Card and wallet payments are handled directly by Stripe, PayPal or Revolut. We never receive or store full card numbers.
Social Channels data. When you contact us on WhatsApp, LinkedIn, Instagram or other networks, we process your username, profile name, message content and any information you choose to share.
Source of the data (Art. 14 GDPR). Data not collected from you directly comes from the company you work for (e.g. when it names you as a contact person for an order) or from public registers and professional networks (e.g. company registers, LinkedIn company pages).
4. Purposes, legal bases and retention
Purpose | Legal basis | Retention |
|---|---|---|
Replying to requests and demo bookings before a contract | Legitimate interest in handling business requests – Art. 6(1)(f) GDPR; pre-contractual measures – Art. 6(1)(b) GDPR if you are a sole trader or professional | 12 months from the last contact, unless a contract follows |
Performing contracts: orders, delivery of services, support, warranties | Legitimate interest in managing the business relationship with your company – Art. 6(1)(f) GDPR; contract – Art. 6(1)(b) GDPR if you are yourself the contracting party (sole trader, professional) | Duration of the contract, then as below |
Invoicing, accounting and tax obligations | Legal obligation – Art. 6(1)(c) GDPR; Art. 2220 Italian Civil Code; Art. 22 of Presidential Decree no. 600/1973 | 10 years from the date of the last entry, or longer if a tax assessment is pending |
Security of the Site and the Configurator, prevention of attacks (e.g. DDoS) and fraud, server and security logs, including full IP addresses | Legitimate interest – Art. 6(1)(f) GDPR | Overwritten automatically once a set size is reached, and in any case deleted within 30 days |
Statistics on the Site through Google Analytics | Consent – Art. 6(1)(a) GDPR; Art. 122 Italian Privacy Code | Up to 14 months (Google Analytics retention setting) |
Newsletters and commercial communications to prospects | Consent – Art. 6(1)(a) GDPR; Art. 130(1)-(2) Italian Privacy Code | Until consent is withdrawn, and in any case 24 months from your last interaction |
E-mails, at the address given when purchasing, to customers who bought a paid service, about services similar to those purchased (“soft spam”) | Art. 130(4) Italian Privacy Code (e-mail only) | 24 months from the last order, unless you object earlier |
Establishing, exercising or defending legal claims | Legitimate interest – Art. 6(1)(f) GDPR | Until the dispute is settled and limitation periods expire |
When processing is based on legitimate interest, we have assessed that it does not override your rights. You can ask us for details of this assessment.
You can object to e-mails about similar services when you place your order and at any time via the link in each message. If you have only requested a demo or a free trial, we send you commercial communications only with your consent.
When retention periods expire, we delete the data or anonymise it irreversibly.
Is providing data mandatory? Data needed to reply to a request, to perform a contract or to meet legal obligations is required: without it we cannot provide the service or issue invoices. Consent for marketing and analytics cookies is optional: refusing it has no effect on the use of the Site or our services.
Automated decision-making. We do not take decisions based solely on automated processing, including profiling, that produce legal effects on you (Art. 22 GDPR).
5. The Configurator on third-party websites
Our customers embed the Configurator on their own websites. In that context:
- Keletes acts as data processor (Art. 28 GDPR) for the customer, which is the data controller. This covers any personal data end users enter in the Configurator (e.g. a quote request). Please refer to the customer’s own privacy policy. We process this data only on the customer’s documented instructions, under a data processing agreement.
- Keletes acts as independent controller only for technical logs needed to run, secure and improve the service. These logs record configuration choices and product data requested. Usage logs do not include names, contact details or IP addresses, and are kept for 12 months. Full IP addresses appear only in security logs, used to prevent attacks and abuse (e.g. DDoS) and for specific technical checks, on the basis of legitimate interest (Art. 6(1)(f) and Recital 49 GDPR). These logs are overwritten automatically once a set size is reached, and in any case deleted within 30 days.
The Configurator does not set cookies on the customer’s website.
6. Recipients of personal data
Only authorised Keletes staff, bound by confidentiality, can access your data. We also share it with:
- Data processors (Art. 28 GDPR), bound by a data processing agreement: hosting and IT providers, e-mail and CRM providers, customer support tools, our accountant for bookkeeping services.
- Independent controllers, which process data under their own privacy policies: payment providers (Stripe Payments Europe Ltd., PayPal (Europe) S.à r.l. et Cie S.C.A., Revolut Bank UAB), banks, Google Ireland Ltd. for Google Analytics, legal advisors, public authorities when required by law.
- Social networks. When you write to us on WhatsApp (WhatsApp Ireland Ltd.), Instagram (Meta Platforms Ireland Ltd.) or LinkedIn (LinkedIn Ireland Unlimited Company), these platforms also process your data under their own policies. For page statistics (“Insights”) we are joint controllers with the platform, under the arrangements it publishes (Art. 26 GDPR; CJEU, case C-210/16).
We do not sell personal data and we do not disclose it to the public.
A full list of processors is available on request at privacy@keletes.com.
7. Transfers outside the EU/EEA
We store your data in the European Union. Some providers (e.g. Google, Meta, Microsoft, PayPal, Stripe) may transfer data to the United States or other non-EU countries. In that case transfers rely on:
- the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for certified companies (Art. 45 GDPR);
- the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR), in all other cases.
You can request a copy of the safeguards at privacy@keletes.com.
8. Your rights
Under Articles 15–22 GDPR you have the right to:
- access your data and obtain a copy;
- rectify inaccurate or incomplete data;
- erase your data, within the limits of the law;
- restrict processing;
- data portability, for data processed on the basis of contract or consent by automated means;
- object at any time to processing based on legitimate interest and, without need to give reasons, to direct marketing (Art. 21 GDPR; Art. 130(4) Italian Privacy Code);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, write to privacy@keletes.com or to our postal address. You can also unsubscribe from marketing e-mails with the link in every message. We reply within one month of receipt. This may be extended by two further months for complex or numerous requests; in that case we inform you within the first month (Art. 12(3) GDPR).
9. Right to lodge a complaint
If you believe your data is processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Art. 77 GDPR; Articles 140-bis ff. Italian Privacy Code) or with the supervisory authority of the EU country where you live or work, or where the alleged infringement took place.
Garante per la protezione dei dati personali
Piazza Venezia, 11 – 00187 Rome, Italy
Phone: +39 06 696771
E-mail: protocollo@gpdp.it
PEC: protocollo@pec.gpdp.it
Website: www.garanteprivacy.it
10. Security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including HTTPS encryption, secure cookies, access control with individual credentials, regular backups, staff training and periodic risk reviews.
11. Minors
Our services are for businesses. We do not knowingly collect data of people under 18.
12. Changes to this Privacy Policy
We may update this Privacy Policy when our processing or the law changes. The current version is always published on this page. We notify significant changes by e-mail to customers or by a notice on the Site.
Last updated: 29/09/2026
Version: 2.0