LEGAL
Privacy policy
Draft to complete. The fields in square brackets must be replaced with real data. The final text must be checked by a lawyer or DPO before publication: the structure and technical mechanisms are correct, but compliance depends on how you actually handle the data.
This policy explains what personal data we collect when you use this site, why we do it and what rights you have. It is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679.
Who processes your data
The data controller is Igor Korosec, based at Via del Cotonificio 187, 33100 Udine (UD), Italy, VAT number IT08107200720, reachable at hello@inkarma.it or by phone at +39 329 304 8918.
[If you have appointed a Data Protection Officer, indicate here name and contacts. If you haven't appointed one, remove this line: for many SMEs the appointment is not mandatory.]
What data we collect
- Data you send us — name, email address, any phone number, company name and the content of the message, when you write to us or fill in the contact form.
- Browsing data — IP address, browser and device type, pages visited, date and time. It is collected by the systems that run the site and is used to make it work and to keep it secure.
- Messages written to the assistant — the text you type in the site chat and the answers you choose. The assistant is instructed to not ask you for personal data in free text: when needed, it asks for it in a form, with a consent checkbox. At that point the same rules apply as for the contact form.
- Data collected via cookies — only technical ones in the absence of consent. Statistics and marketing only start if you consent: the detail is in the cookie policy.
Why we process it and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to your contact requests | Pre-contractual measures at your request (art. 6.1.b) | [24] months from the last contact |
| Answering your questions via the chat assistant | Pre-contractual measures at your request (art. 6.1.b) | [45] minutes for the conversation; [24] months if you leave a request |
| Running the site and protecting it from abuse | Legitimate interest in security (art. 6.1.f) | [12] months |
| Usage statistics | Your consent (art. 6.1.a) | [14] months |
| Marketing and campaign measurement | Your consent (art. 6.1.a) | [Specify] |
| Tax and legal obligations | Legal obligation (art. 6.1.c) | 10 years |
Providing the contact form data is optional, but without it we cannot reply to you. Consent to statistics and marketing is free and revocable at any time, with no consequences on browsing.
Who else can see your data
The data may be processed by providers acting as data processors, appointed pursuant to art. 28 GDPR: [hosting provider], [email service], OpenRouter, Inc. (United States) for the operation of the chat assistant, and the statistics and marketing providers listed in the cookie policy. We do not sell your data and do not disclose it.
The chat assistant
The site has an automated assistant. When you write to it, the message text is sent to our server and from there to OpenRouter, Inc., which passes it to an artificial intelligence model to generate the reply. Our server keeps the conversation for [45] minutes of inactivity, the time needed to let it continue, then deletes it.
The assistant is not a cookie and does not profile you: it activates only if you open it and write. For this reason it is not subject to the consent banner. If you'd rather not use it, the contact form and the email address remain available and don't go through any artificial intelligence provider.
Don't write personal or confidential data in the chat's free text. If you need to be contacted back, the assistant will open a dedicated form for you. The contact details entered in the form — name, email, phone, company name and site address — reach only us and are not sent to the model provider: the assistant sees that you filled them in, not their content. What you write in the project description field, however, is read by the assistant, because it needs it to summarize the request: don't enter data there that you don't want to share.
Transfers outside the European Union
Some providers are based in the United States. The transfer takes place on the basis of the adequacy decision for the EU-US Data Privacy Framework of 10 July 2023, provided the provider adheres to it, or on the basis of standard contractual clauses.
For statistics and marketing the transfer takes place only with your consent. For the chat assistant it instead takes place when you write to it, on the basis of the pre-contractual measures you requested (art. 6.1.b): if you don't open the assistant, no transfer takes place. [Verify case by case the adherence of the providers you use.]
Your rights
You can ask us at any time to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest (arts. 15-22 GDPR). Where processing is based on consent, you can withdraw it without this affecting the lawfulness of what was done before.
To exercise them, write to hello@inkarma.it. We reply within one month. If you believe the processing violates the Regulation, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Automated decision-making
We don't carry out profiling or automated decisions that produce legal effects on you. The chat assistant answers questions and collects contact requests: it doesn't evaluate, select or decide anything concerning you. The replies are written by an automated model and may contain errors: it is always us, in person, who provide binding answers.
Changes
If we change this policy we publish the updated version here. Last updated: [date].