Privacy Notice
EXREA S.r.l. — www.exrea.it
Provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
This is an English translation of the Italian privacy notice. In the event of any discrepancy, the Italian version prevails.
Last updated: 02/10/2026
1. Data controller
EXREA S.r.l.
Registered office: Via Tomasi di Lampedusa 149, Pistoia, Italy
Operational office: Via Pratese 199, 50145 Florence, Italy
Tax code and VAT number: 02136720477
Email: [email protected] — Certified email (PEC): [email protected]
For any matter relating to the processing of personal data, including requests to exercise the rights described in section 11, please write to [email protected].
The Controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR do not apply.
2. Scope
This notice covers personal data collected through the website www.exrea.it and the services integrated into it, including the AI-based conversational assistant.
It also applies to the domains exrea.io and exrea-production.it, which belong to the same Controller and host the demo experiences and three-dimensional configurators. This content works as a graphical representation running in the user’s browser and does not collect or store personal data. To work, it may load software components from third-party content delivery networks, which involves the transmission of the IP address, as described in § 6 of the Cookie Policy.
This notice does not extend to third-party websites that may be reached through hyperlinks, over which the Controller has no control.
3. Categories of data processed
| Category | Examples |
|---|---|
| Contact data | First name, last name, email address, telephone number, company |
| Request data | Business sector, objective, indicative budget, message text, interest in a demonstration |
| Conversational content | The text typed by the user into the conversational assistant and the responses generated |
| Browsing data | IP address, browser type and version, operating system, pages visited, date and time of access, screen resolution, language, referring site |
| Online identifiers | Cookies and pseudonymous identifiers associated with analytics and advertising tools |
Data is collected directly from the data subject, through the website or in the course of direct business contacts.
The Controller does not request, and does not intend to collect, special categories of data within the meaning of Article 9 GDPR (data concerning health, beliefs, trade union membership and the like), nor data relating to criminal matters. The conversational assistant is configured not to solicit information of this kind, nor data relating to third parties. Users are asked not to enter such data in the forms or in the chat.
4. Purposes, legal bases and retention periods
4.1 Website browsing and security
| Data | Browsing data, technical server logs and logs generated by the website’s security tools (protection against unauthorised access, web application firewall, login attempts to the restricted area) |
| Purpose | Delivering the website, ensuring its operation and security, preventing abuse and establishing liability in the event of computer crimes |
| Legal basis | The Controller’s legitimate interest in the security of its infrastructure (Art. 6(1)(f) GDPR) |
| Retention | Server logs: 30 days, according to the hosting provider’s settings. Security tool logs: 30 days |
Protection of forms against spam and abuse. The website’s forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc., which automatically checks, without requiring any action from the user, that a submission does not come from an automated program. For this purpose, technical data about the device and the browsing session is processed (IP address, browser type and version, device characteristics and interaction with the page). The legal basis is the Controller’s legitimate interest in the security of the website and the prevention of abuse (Art. 6(1)(f) GDPR). The service does not set profiling cookies and the data is not used for advertising purposes. Cloudflare processes this data as described in the Turnstile Privacy Addendum.
4.2 Contact form and demonstration requests
| Data | Contact data and request data |
| Purpose | Responding to the request, providing information and quotes, managing commercial negotiations and pre-contractual relations |
| Legal basis | Performance of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR). Where a contract is concluded: performance of the contract (Art. 6(1)(b) GDPR) and compliance with administrative, accounting and tax obligations (Art. 6(1)(c) GDPR) |
| Retention | 24 months from the last contact with the data subject. The message sent is stored both in the Controller’s mailbox and in the website database, hosted in Italy, and is deleted from both when the period expires. If the request leads to a contract, the data needed to manage it and to meet administrative, accounting and tax obligations (personal and tax details, contract, invoices and related correspondence) is kept for 10 years from the date of the last entry, as required by law (Article 2220 of the Italian Civil Code) |
| Provision of data | Fields marked as mandatory are necessary in order to reply; failure to provide them prevents a reply. The other fields are optional |
4.3 AI-based conversational assistant
The website offers a conversational assistant that uses an artificial intelligence system. Users are informed of this when the conversation opens.
| Data | Content of the messages exchanged; contact data, if the user chooses to provide it |
| Purpose | Answering questions about the Controller’s business and services; if the user leaves their details, following up on the request as described in section 4.2 |
| Legal basis | Performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR); legitimate interest in operating the service and protecting it from misuse (Art. 6(1)(f) GDPR) |
| Retention | Conversations are not stored on the infrastructure that delivers the service. If the user leaves their contact details, the conversation transcript is sent to the Controller’s systems and kept for 24 months from the last contact |
How it works in practice. The assistant does not set cookies and does not associate any user identifier with the conversation: only the text of the messages is sent to the service. The message passes through a technical infrastructure that does not store it and is sent to an AI model provider, which generates the response. The provider automatically deletes the content within 30 days and does not use it to train its models. Only two technical data items with automatic expiry remain on the transit infrastructure: a usage counter containing no personal data and an abuse-protection counter based on the IP address pseudonymised by hashing, lasting a few minutes.
Retention by the model provider. If a conversation is flagged for a breach of the terms of use, the provider may keep messages and responses for up to 2 years and the related safety indicators for up to 7 years.
Please do not enter unnecessary data or information about other people in the chat.
4.4 Contact via WhatsApp
The website offers a link to start a conversation with the Controller via WhatsApp Business. The link does not load external resources and does not set any tracker: the platform is opened only at the user’s initiative.
| Data | Telephone number, profile name and picture, content of the messages exchanged |
| Purpose | Responding to requests for information and managing business contacts |
| Legal basis | Performance of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR) |
| Retention | 24 months from the last contact. Any contact details recorded in the Controller’s records follow the same period |
| Provision of data | Free and optional: the same contact can take place by email or through the website form |
The service is provided by Meta Platforms Ireland Ltd., which acts as an independent controller with regard to the operation of the platform and the data it processes for its own purposes. Use of WhatsApp is therefore also subject to Meta’s privacy policy, which we invite you to read.
The business account is managed exclusively by the Controller’s legal representative. Please do not send special categories of data within the meaning of Article 9 GDPR, or information about third parties, through this channel.
Messages received via WhatsApp are not used to send marketing communications: this requires specific consent, which is not deemed to have been given simply by contacting the Controller on this channel.
4.5 Analytics
| Data | Pseudonymous identifiers, IP address, browsing data, interactions with pages (views, scrolling, form starts and submissions) |
| Tool | Google Analytics 4 |
| Purpose | Understanding how the website is used and improving its content |
| Legal basis | The data subject’s consent (Art. 6(1)(a) GDPR), given through the cookie banner for the “Statistics” category |
| Retention | Event data: 2 months. User data: 14 months, a period that restarts with each new interaction of the user with the website |
Google Analytics is only activated if the user consents to the “Statistics” category. Data is sent to the service’s European regional endpoint.
4.6 Marketing, remarketing and campaign measurement
| Data | Advertising identifiers, browsing data, conversion events, email address in pseudonymised form (see below) |
| Tools | Google Ads (conversion measurement, remarketing, user lists); Google Analytics audiences shared with Google Ads |
| Purpose | Measuring the effectiveness of advertising campaigns and showing promotional messages again to people who have already visited the website |
| Legal basis | The data subject’s consent (Art. 6(1)(a) GDPR), given through the cookie banner for the “Marketing” category |
| Retention | According to the durations stated in the cookie policy and Google’s retention terms |
Google Ads is only activated if the user consents to the “Marketing” category.
Audiences from Google Analytics. The Controller’s Google Analytics and Google Ads accounts are linked. If the user has consented to both statistics and marketing, data collected through Google Analytics may be used to build audiences for remarketing on Google Ads.
Enhanced conversions. If the user has consented to marketing, when the contact form is submitted the email address entered is sent to Google in pseudonymised form by hashing, solely to measure the effectiveness of campaigns (the “enhanced conversions” feature). The processing is governed by Google’s Customer Data Terms. Without marketing consent, neither the email address nor the conversion is sent.
These activities involve profiling for marketing purposes, based on consent and revocable at any time through the “Manage consent” button (see § 5 and § 7 of the Cookie Policy).
4.7 Marketing communications
| Data | Email address, name, company |
| Purpose | Sending marketing and informational communications about the Controller’s products and services |
| Legal basis | The data subject’s free, specific and optional consent (Art. 6(1)(a) GDPR), given by ticking a separate box when filling in the online form or on paper forms collected at business meetings, trade fairs and events. Consent is recorded together with the date on which it was given |
| Retention | Until consent is withdrawn and in any case no longer than 24 months from the data subject’s last interaction |
Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal, by writing to [email protected] or by replying to any of the communications received.
How communications are sent. Communications are sent individually from the Controller’s business mailbox. No bulk mailing services or tools that track message opens or link clicks are used. Should the Controller adopt such tools in the future, this notice will be updated and the related tracking will only be activated with specific prior consent.
Customers. The Controller may send people who have purchased products or services communications about products or services similar to those supplied, pursuant to Article 130(4) of the Italian Personal Data Protection Code, with the right to object at any time, including simply by replying to one of the communications received.
4.8 Requests for informational materials (white papers and reports)
| Data | Name, company and business email address entered in the request form |
| Purpose | a) Sending the requested material by email; b) contacting the data subject individually by email to discuss the topics of the downloaded material and assess their interest in the Controller’s related services |
| Legal basis | a) Performance of measures taken at the data subject’s request (Art. 6(1)(b) GDPR); b) the Controller’s legitimate interest in following up on a request from a business contact who has shown interest in a specific area of its services (Art. 6(1)(f) GDPR). The data subject may object to being contacted at any time, without formalities, by writing to [email protected] or by replying to the message received |
| Retention | 24 months from the last contact with the data subject. If the data subject objects to being contacted, the data is no longer used for purpose b) |
| Provision of data | Necessary to receive the material: failure to provide it prevents it from being sent. General marketing and informational communications, such as service updates, are only sent with the optional consent described in section 4.7 |
5. Cookies and other tracking tools
The website uses technical, statistics and marketing cookies, as well as tools that send data to third parties without writing cookies to the user’s device.
Non-technical cookies and tools are only activated with the data subject’s prior consent, collected through a banner that complies with the Guidelines on cookies and other tracking tools of the Italian Data Protection Authority (Garante per la protezione dei dati personali, decision no. 231 of 10 June 2021). Consent is collected separately for the “Statistics” and “Marketing” categories: each category only activates the tools that belong to it.
Consent can be withdrawn or changed at any time through the “Manage consent” button, which is always available on every page of the website.
For the detailed list of trackers, their classification, purposes, durations and the coding criteria adopted, please refer to the Cookie Policy, which forms an integral part of this notice.
6. Recipients of data and processors
Personal data is processed exclusively by the Controller’s legal representative. No other internal persons or external collaborators have access to it. Data may be disclosed to the following parties, appointed as processors pursuant to Article 28 GDPR:
| Party | Role | Location of processing |
|---|---|---|
| Aruba S.p.A. | Hosting of the website and its database (including messages sent through the forms and consent records), domain management | Italy |
| Google Ireland Ltd. / Google LLC | Google Workspace (email, including the sending of the website’s automatic emails such as form confirmations and notifications, and document storage), Google Analytics, Google Ads | Data storage region set to Europe; for some features, processing may take place on global infrastructure |
| Anthropic PBC | Generation of the conversational assistant’s responses | United States |
| Cloudflare, Inc. | Transit infrastructure for the conversational assistant; protection of forms against spam and abuse (Cloudflare Turnstile) | Distributed infrastructure |
Meta Platforms Ireland Ltd. processes data relating to the WhatsApp Business service as an independent controller, as described in section 4.4.
Data may also be disclosed to the Controller’s professional advisers and consultants for legal compliance purposes, and to public authorities where required by law.
Data is not disseminated or transferred to third parties for their own marketing purposes.
7. Transfers of data outside the European Union
Data collected through the website’s forms is stored on the servers of Aruba S.p.A. in Italy. This processing does not involve any transfer abroad.
Data stored in Google Workspace has its storage region set to Europe. Data processed through Google Analytics and Google Ads, as well as some Google Workspace features, may be processed on global infrastructure, with the safeguards provided by the EU-US Data Privacy Framework and the Standard Contractual Clauses adopted by the European Commission.
Technical data processed by Cloudflare Turnstile to protect the forms may be processed on the global infrastructure of Cloudflare, Inc., based in the United States, with the safeguards provided by the EU-US Data Privacy Framework and the Standard Contractual Clauses adopted by the European Commission.
Processing related to the conversational assistant involves sending the content of messages to a provider based in the United States. The transfer is based on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the provider’s data processing agreement.
The WhatsApp messaging service, provided by Meta Platforms Ireland Ltd., may involve processing data on infrastructure located in the United States, as stated in the provider’s privacy policy.
Data subjects may request a copy of the safeguards adopted by writing to [email protected].
8. Summary of retention periods
| Data | Period |
|---|---|
| Form requests, conversation transcripts and messages received via WhatsApp | 24 months from the last contact |
| Data relating to concluded contracts (personal and tax details, contract, invoices and related correspondence) | 10 years, for administrative, accounting and tax obligations (Article 2220 of the Italian Civil Code) |
| Data processed for marketing purposes | Until withdrawal and in any case no longer than 24 months from the last interaction |
| Content of conversations held by the AI model provider | Deleted within 30 days (up to 2 years if flagged for a breach of the terms of use) |
| Analytics data (Google Analytics) | 2 months (events) and 14 months (user data) |
| Server and security tool logs | 30 days |
| Cookie consent records | For as long as needed to demonstrate the consent given |
| Cookies and identifiers | Durations stated in the cookie policy |
After these periods, data is deleted or anonymised, unless otherwise required by law or needed to establish, exercise or defend legal claims.
9. Provision of data
Providing the data marked as mandatory in the forms is necessary to receive a reply to the request: failure to provide it prevents the Controller from replying.
Providing data for statistics and marketing purposes is optional: refusing does not in any way affect the ability to use the website, send a request and receive a reply.
Use of the conversational assistant is free and optional; users decide for themselves whether, and what, information to enter.
10. Automated decision-making
The Controller does not use automated decision-making that produces legal effects concerning the data subject or similarly significantly affects them, within the meaning of Article 22 GDPR.
The conversational assistant’s responses are generated automatically, but are for information purposes only and do not result in any decision concerning the user.
The advertising tools described in section 4.6 involve profiling for marketing purposes, based on consent and revocable at any time.
11. Data subject rights
Within the limits set out in Articles 15 to 22 GDPR, the data subject has the right to:
- access their personal data and obtain a copy of it;
- have inaccurate data rectified or incomplete data completed;
- have data erased in the cases provided for;
- obtain restriction of processing;
- receive the data in a structured format and transmit it to another controller (portability);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right to object (Art. 21 GDPR). The data subject has the right to object at any time, on grounds relating to their particular situation, to processing based on the Controller’s legitimate interest (sections 4.1, 4.3 and 4.8). They also have the right to object at any time, without having to give reasons, to the processing of data for direct marketing purposes, including related profiling: in that case the data will no longer be processed for those purposes.
Rights can be exercised by writing to [email protected]. The Controller will reply within one month of receiving the request, which may be extended by two months where requests are particularly complex.
Data subjects who believe their rights have been infringed may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it), with the supervisory authority of the EU Member State where they live or work, or bring proceedings before the courts.
12. Minors
The services offered through the website are aimed at professionals and are not intended for children under 14. The Controller does not knowingly collect data relating to minors. If it becomes aware that it has collected such data, it will delete it.
13. Security
The Controller adopts appropriate technical and organisational measures to protect data against destruction, loss, unauthorised access or unlawful processing, including restricting access to records to the legal representative only, multi-factor authentication on the accounts that give access to them, tools to protect the website against unauthorised access and encrypted transmission of communications.
14. Changes to this notice
The Controller may amend this notice at any time, giving notice by publishing it on this page. Please check it periodically, looking at the date of last update shown at the top.
If the changes substantially affect the rights of data subjects or introduce new processing purposes, the Controller will inform the data subjects whose contact details it holds directly, before the changes take effect. For new purposes based on consent, data will only be processed after obtaining new consent.
