Privacy policy

Scope and controller

This notice is provided under Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR). The controller is ES Informatica di Egon Suljic, which operates the Xaflo website at the contact details above. For questions about personal data or to exercise your rights, email hello@rocketweb.it.

Data we collect

When you use the contact form, we receive your name, email address, company if provided, project category and message. If you email us directly, we also receive the information you choose to include. Please do not include passwords, health data or other particularly sensitive information.

Browsing involves technical data needed to deliver the service, such as IP address, HTTP request, browser information and any error or security records, depending on the infrastructure configuration. Product screenshots published on the site contain illustrative data.

Purposes and legal bases

We use enquiries to respond, understand your project and assess requested pre-contractual steps. The legal basis is Article 6(1)(b) GDPR for steps requested by the data subject before a contract; for other professional communications, Article 6(1)(f), based on the legitimate interest in handling and following up on enquiries.

Technical data supports delivery of the website and prevention of abuse, based on the legitimate interest in service security and operation. Mandatory legal requirements are based on Article 6(1)(c). We do not use enquiries for newsletters, profiling or marketing.

Providing data and submitting the form

A name, valid email and message are needed to process the form; the company field is optional. You can select the project category. Without the necessary details, we cannot submit or properly handle the enquiry.

The form sends the message to the internal mailbox dedicated to website enquiries. hello@rocketweb.it is the contact for privacy matters. Submission does not subscribe you to promotional lists or trigger automated decisions.

Retention

Contact enquiries are retained for 90 days from receipt, as specified by the controller. If an enquiry leads to a contract, the data needed for that relationship is handled separately for contractual purposes and applicable requirements. Information strictly needed for a dispute or an authority’s request may be retained.

The form’s abuse controls use an identifier derived from the IP address using HMAC, valid for 10 minutes. The identifier preventing duplicate submissions expires after 24 hours. When an error occurs in a submission without JavaScript, the values needed to redisplay the form expire after 10 minutes. These periods concern application controls, rather than the email mailbox.

Technical operational and security records are retained for the time needed to diagnose problems and investigate security events; extensions must be limited to incidents, disputes or applicable obligations. The controller manages retention in email, logs and backups.

Access and recipients

Data is available to authorized people managing the website and responding to enquiries. Hosting and email are managed by ES Informatica. Technical support, infrastructure or professional service providers may process data only as needed for the service and in the role required by GDPR, including as processors where applicable. We do not publicly disclose received messages.

The public website serves fonts and images from the Xaflo domain and does not embed advertising, analytics or social widgets. External links open websites with their own notices. For details of infrastructure providers, processing locations and safeguards for any transfers outside the European Economic Area, contact the controller. Any transfers must comply with Chapter V GDPR.

Your rights

Where GDPR applies, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Email hello@rocketweb.it with your request; we may ask for proportionate information to verify your identity. Responses follow the time limits in Article 12 GDPR.

You may lodge a complaint with the Italian Garante per la protezione dei dati personali or the competent supervisory authority.

Cookies, products and updates

The cookie policy describes the website’s technical behaviour. Interactive home page demos run in the browser using illustrative data: they do not send real emails or requests to AI or CRM APIs.

Applications and services developed for clients can involve different processing, covered by specific notices and agreements. This notice does not replace those documents. The current public website notice is published on this page.