Privacy policy
Last updated: 5 November 2026
This notice explains how MAGNETICA Development S.r.l. processes the personal data of visitors to the website magnetica.it, of people who contact us and of our customers. It is provided under Article 13 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code"), as amended by Legislative Decree 101/2018.
It does not cover third-party websites reachable through links, nor the data that our customers process with the software we develop or manage for them: in that case MAGNETICA acts as a processor on behalf of the customer (Article 28 GDPR), under the agreement signed with that customer.
This English version is a translation; in case of discrepancy the Italian version prevails.
1. Data controller
MAGNETICA Development S.r.l.
Viale Oriano 10, 24047 Treviglio (BG), Italy
VAT no. IT 04271100168
Tel. +39 0363 563190
E-mail: info@magnetica.it
The controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply.
2. Data we process
Browsing data
The systems that run the website collect, during their normal operation, some data whose transmission is inherent in the use of Internet protocols: IP address, date and time of the request, address (URL) of the requested resource, request method and response code, response size, referring page, browser type and operating system. These data are recorded in the web server logs.
For visit statistics we use Matomo and Plausible, installed on the controller's own servers: no data is sent to external analytics providers. IP addresses are anonymised before being stored. Matomo uses cookies only if the user consents; Plausible does not use cookies.
Data you provide
- Contact form: name, e-mail address, text of the request, answers to the project questions (type of project, status of the specifications, timing) and the page of the website from which the message was sent.
- E-mail and telephone: your contact details and the content of your message.
- Customers and their contact persons: identification and contact details, tax and invoicing data, payment data.
Record of cookie choices
When a user makes or changes their cookie choice we record a random code, the choice made, the date and time and the IP address, so that we can demonstrate consent.
We do not ask for special categories of data (Article 9 GDPR, e.g. health data): please do not include them in your messages.
3. Purposes, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Operation and security of the website, prevention of abuse (web server logs) | Legitimate interest of the controller in ensuring the operation and security of the website (Art. 6(1)(f) GDPR) | 12 months |
| Cookieless website statistics (Matomo and Plausible, anonymised IP) | Legitimate interest of the controller in measuring and improving the website (Art. 6(1)(f) GDPR) | 12 months for detailed data; afterwards only aggregated, anonymous statistics are kept |
| Statistics with Matomo cookies | Consent (Art. 6(1)(a) GDPR and Art. 122 Privacy Code), which can be withdrawn at any time | 12 months for detailed data; cookie lifetimes are listed in the Cookie policy |
| Record of cookie choices | Legal obligation to be able to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR) | 12 months |
| Replying to requests sent through the contact form, by e-mail or by telephone | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) | 24 months from the last contact, if the request does not lead to a contract |
| Management of the contractual relationship with customers (design, development, support) | Performance of a contract (Art. 6(1)(b) GDPR) | Term of the contract plus 10 years after it ends (ordinary limitation period, Art. 2946 Italian Civil Code) |
| Administrative, accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) | 10 years (Art. 2220 Italian Civil Code) |
| Establishment, exercise or defence of legal claims | Legitimate interest of the controller (Art. 6(1)(f) GDPR) | For the duration of the dispute, until the time limits for appeal have expired |
The controller does not use the data collected to send promotional communications or newsletters. When the periods above expire, the data is deleted or anonymised.
4. Whether providing data is mandatory
- Browsing data: collected automatically while you browse the website.
- Contact form: name, e-mail and text of the request are needed to reply; without them we cannot follow up on the request. Answers to the project questions are optional and help us understand the request better.
- Customers: the data needed to enter into and perform the contract and the data required by tax law are mandatory; without them the relationship cannot be established.
- Statistics cookies: consent is optional; refusing it does not limit browsing in any way.
5. How data is processed
Data is processed electronically by staff authorised and instructed by the controller (Article 29 GDPR and Article 2-quaterdecies Privacy Code), with technical and organisational measures appropriate to protect it against loss, unauthorised access and unlawful use (Article 32 GDPR). The website, database, e-mail and analytics tools run on servers managed by the controller in a data centre in France.
6. Recipients
Data may be disclosed, as far as necessary for the purposes above, to the following categories of recipients:
- Infrastructure provider: OVHcloud (OVH SAS, France), which hosts the controller's servers, as processor (Article 28 GDPR).
- Invoicing and customer management software provider: Fatture in Cloud (TeamSystem group), with servers in the European Union, as processor.
- Advisers (accountant, payroll consultant), as processors or independent controllers depending on the engagement.
- Adobe, which supplies one of the website's typefaces through the Adobe Fonts service and therefore receives the visitor's IP address and technical browser data.
- Public bodies and authorities (e.g. the Italian Revenue Agency for electronic invoicing, judicial authorities) and banks for payments, where required by law or necessary to perform the contract, as independent controllers.
The up-to-date list of processors is available on request at info@magnetica.it. Data is not disseminated.
7. Transfers outside the European Union
The controller's servers are located in the European Union. The only transfer to a non-EU country concerns the loading of typefaces through Adobe Fonts: the IP address and technical browser data may be processed by Adobe Inc. in the United States. Adobe Inc. participates in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR).
8. Your rights
You may exercise the rights provided by Articles 15-22 GDPR at any time:
- access to your data and to information about the processing (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data, where applicable (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you provided, processed by automated means on the basis of consent or contract (Art. 20);
- objection to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21);
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)): for statistics cookies, just use the Cookie preferences link at the bottom of every page.
Requests should be sent to info@magnetica.it or to the controller's address. We reply within one month, which may be extended by two further months for complex requests (Art. 12(3) GDPR).
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) under Article 77 GDPR, or with the supervisory authority of the EU country where you live or work, or to seek a judicial remedy (Article 79 GDPR).
9. Profiling and automated decisions
The controller does not carry out profiling and does not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR).
10. Minors
The website and the controller's services are aimed at businesses and professionals and are not intended for children under 14 (Article 2-quinquies Privacy Code). The controller does not knowingly collect data of children under 14; any such data received will be deleted.
11. Cookies
For information on the cookies used by the website and how to manage your preferences, see the Cookie policy.
12. Changes to this notice
This notice may be updated, for example following changes in the law or in the services used by the website. The current version is always published on this page, with the date of the last update shown at the top.
