Last updated:
This notice applies to the website comproove.com. Other services and platforms operated by Comproove may have their own notices.
1. Data controller
The data controller is Comproove Srl, with registered office at Via Alessandria 5, 20144 Milan, Italy.
For any question about this notice or about the processing of your personal data, write to [email protected].
2. Personal data we process
Data you provide through the contact form. Name, company, email address, phone number (optional), the content of your message and the language of the page you write from. The form also records that you have confirmed reading this notice.
Data you send us by email. If you write to an address published on the website, such as [email protected], we process your email address and the information contained in your message.
Technical and security data. When you submit the form, our server processes your IP address and the request headers needed to check where the request comes from. The Cloudflare Turnstile security check processes technical signals from your browser, such as IP address, TLS fingerprint and User-Agent, to tell people apart from automated software.
Browsing data. As with any website, the infrastructure that delivers the pages necessarily processes data such as your IP address, the requested address, the date and time of the request and technical details about your browser, in order to deliver the content and protect the service.
We do not ask for special categories of personal data (Article 9 GDPR). Please do not include them in your messages.
3. Purposes of processing
- A. Handling your requests. Replying to messages sent through the form or by email, sending an automatic acknowledgement of receipt to the address you provide, and recording the request in Comproove’s proprietary customer relationship management (CRM) system so that it can be followed up.
- B. Security of the website and of the form. Preventing spam, abuse and automated submissions (Cloudflare Turnstile check, hidden anti-spam field, limit on submissions from the same IP address, check of the request origin) and keeping technical logs of submissions.
- C. Managing cookie preferences. Storing the choices you make in the cookie banner so that they are respected.
- D. Legal obligations and defence of rights. Complying with obligations under applicable law and, where necessary, establishing, exercising or defending legal claims.
We do not currently use your data for analytics, profiling or marketing. If this changes, we will update this notice and, where required, ask for your consent first.
4. Legal bases
| Purpose | Legal basis |
|---|---|
| A. Handling requests | Steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) or, when you write on behalf of an organisation, Comproove’s legitimate interest in replying to the requests it receives (Article 6(1)(f) GDPR). |
| B. Security | Comproove’s legitimate interest in protecting the website, the form and its systems from abuse (Article 6(1)(f) and Recital 49 GDPR). |
| C. Cookie preferences | Compliance with legal obligations on cookies and on demonstrating consent (Article 6(1)(c) GDPR and Article 122 of the Italian Personal Data Protection Code). |
| D. Legal obligations and claims | Legal obligation (Article 6(1)(c) GDPR) and legitimate interest in defending rights (Article 6(1)(f) GDPR). |
Where processing is based on legitimate interest, you can object to it at any time (see section 9).
5. How we process data
Data are processed electronically, only by authorised personnel and with technical and organisational measures appropriate to the risk. On the website these include encrypted connections (HTTPS), server-side validation and sanitisation of form input, origin checks against cross-site requests, limits on repeated submissions and keeping secret keys on the server only.
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). The Turnstile check is an automated technical filter used only to protect the form from abuse.
6. Recipients
Your data are not disseminated. For the purposes described above, they may be made accessible to:
- Comproove personnel authorised to process them;
- Cloudflare, Inc., which hosts and delivers the website, runs the server-side function that receives the form, temporarily stores IP addresses to limit repeated submissions and provides the Turnstile security check. For Turnstile, Cloudflare states that it acts as processor for bot detection and as independent controller when it uses the signals to improve its detection capabilities;
- the provider of the transactional email service that delivers the notification to Comproove and the acknowledgement to you;
- the providers of the mailboxes on which Comproove receives messages;
- Comproove’s proprietary CRM system, to which requests are forwarded;
- advisers, IT service providers and public authorities, where necessary and within the limits of the law.
Providers that process data on our behalf are appointed as processors under Article 28 GDPR.
7. Transfers outside the European Economic Area
Some of the providers listed above, including Cloudflare, Inc., are established in the United States or operate infrastructure worldwide, so personal data may be processed outside the European Economic Area (EEA). Such transfers may only take place with the safeguards required by Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or the standard contractual clauses adopted by the European Commission.
8. Retention periods
| Data | Retention |
|---|---|
| IP address used to limit repeated form submissions | Up to 10 minutes, then deleted automatically. |
| Cookie preference record (cc_cookie) | 182 days from your choice, unless you delete it earlier. |
When these periods end, data are deleted or anonymised, unless they must be kept longer to comply with a legal obligation or to defend rights.
9. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access your personal data and obtain a copy;
- have inaccurate data corrected and incomplete data completed;
- obtain the erasure of your data, where the conditions are met;
- obtain the restriction of processing;
- receive the data you provided in a structured, commonly used and machine-readable format and have them transmitted to another controller, where processing is based on consent or on a contract and is carried out by automated means;
- object at any time, on grounds relating to your particular situation, to processing based on legitimate interest;
- withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
10. How to exercise your rights
Send your request to [email protected] or by post to Comproove Srl, Via Alessandria 5, 20144 Milan, Italy. We will reply without undue delay and in any event within one month of receiving it. That period may be extended by two further months where necessary, given the complexity and number of requests; in that case we will tell you. We may ask for information needed to confirm your identity.
You can change or withdraw your cookie choices at any time through the “Cookie preferences” link at the bottom of every page.
11. Right to lodge a complaint
If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it (opens in a new tab)), or with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place.
12. Is providing your data mandatory?
Your name, company, email address and message, confirmation that you have read this notice and completion of the security check are needed to send a request through the form: without them the form cannot be submitted. The phone number is optional. You can always write to us by email instead of using the form.
Browsing data and the cookie preference record are processed automatically when you use the website.
14. Changes to this notice
We may update this notice, for example after changes to the website, to the services we use or to the law. The current version is always published on this page with the date of its last update. Where changes are significant, we will highlight them on the website.