Privacy Policy

1. Who we are: the data controller

The controller of the personal data collected through this website is nBang, i.e. Dataspritz S.r.l, with registered office at Via Circumvallazione 165, 80035 Nola (NA), VAT no. 10892801217.

If you have any questions about how we handle your data, or want to exercise your rights, please write to info@nbang.it.

Data Protection Officer (DPO): [DA INSERIRE: DPO, se nominato].

2. What this policy covers

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018. It explains how we process the personal data of people who visit this website and of those who get in touch through our contact form.

It does not cover processing carried out as part of our consulting services, which is governed by the individual contracts and their own privacy notices. For cookies, please see our Cookie Policy.

3. What data we process, why, and on what legal basis

a) Contact form enquiries. We collect your name, email address, company, role, the service you are interested in and your message, together with your confirmation that you have read this notice (the box is never pre-ticked). We use this data only to reply to your enquiry and, where relevant, to discuss a possible collaboration. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Name, email and message are needed for us to reply; company, role and service of interest help us route your request. The data is stored in the website’s database and forwarded by email to our team.

b) Protecting the form against spam and abuse. To keep spam and automated submissions out, we use a hidden field (honeypot) and limit how many requests can be sent from the same IP address. Your IP address is never stored in clear: we only keep a cryptographic fingerprint of it (a hash). The legal basis is our legitimate interest in protecting the website and our communications (Art. 6(1)(f) GDPR).

c) Automatic language selection. When you visit the website, your IP address is checked against a geolocation database installed on our own server (DB-IP Lite, IP Geolocation by DB-IP, db-ip.com, CC BY 4.0 licence), solely to estimate your country and show you the site in the most suitable language. This happens entirely on our server, no data is sent to third parties, and the IP address is not stored. The legal basis is our legitimate interest in offering a website that is easy to use (Art. 6(1)(f) GDPR). You can always switch language manually.

d) Cookie consent log. When you set or change your cookie preferences, we record a random consent ID, the choices you made, the version of the Cookie Policy, the date and time, a hash of your IP address and your browser’s user agent. We do this so that we can demonstrate consent, as required by Art. 7(1) GDPR; the legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR).

e) Technical browsing data. Like any website, the systems that run it may collect technical data needed to deliver pages and keep them secure (for example, server logs). This is based on our legitimate interest in the security and proper functioning of the website (Art. 6(1)(f) GDPR). [DA INSERIRE: contenuto e durata di conservazione dei log del server e del reverse proxy]

f) Usage statistics. The website does not currently use any analytics tool. If we enable one in the future, it will be [DA CONFERMARE: strumento di analytics] and it will only load after you have given your consent, as described in the Cookie Policy.

4. Is providing your data mandatory?

Using the contact form is entirely optional, but we cannot reply to you without the fields marked as required. You do not need to give us any personal data to browse the website.

5. How we process your data

Data is processed electronically by authorised, trained staff, with appropriate technical and organisational measures to protect it against unauthorised access, loss or disclosure. We do not carry out profiling, nor do we make decisions based solely on automated processing that produce legal effects concerning you.

Our fonts are served from our own server, and we do not load any third-party resources (fonts, maps, videos, social media embeds) without your consent.

6. How long we keep your data

• Contact form enquiries: [DA INSERIRE: periodo di conservazione, es. 24 mesi] from our last exchange; if the enquiry leads to a contract, data will be kept as required by that contract and by law.
• IP hash used for spam protection: [DA INSERIRE: periodo di conservazione dell’hash IP anti-spam].
• IP address used for language selection: not stored.
• Cookie consent log: [DA INSERIRE: periodo di conservazione del registro consensi], for as long as needed to demonstrate consent.
• Technical server logs: [DA INSERIRE: periodo di conservazione dei log].

7. Who we share your data with

We never sell or publish your data. It may be processed on our behalf, as data processors under Art. 28 GDPR, by the providers we rely on to run the website:

Data may also be disclosed to the competent authorities where required by law. An up-to-date list of our processors is available on request at info@nbang.it.

• hosting and infrastructure provider: [DA INSERIRE: hosting provider e paese dei server];
• email delivery (SMTP) provider, used to forward contact form enquiries to our team: [DA INSERIRE: fornitore SMTP];
• any technical consultants engaged to maintain the website, who are bound by confidentiality.

8. Transfers outside the European Union

We favour providers that process data within the European Economic Area. If a provider processes data outside the EEA, the transfer will only take place on the basis of a European Commission adequacy decision (for example, the EU-U.S. Data Privacy Framework for certified companies) or of appropriate safeguards such as the Standard Contractual Clauses (Articles 45-46 GDPR). [DA INSERIRE: indicare se sono previsti trasferimenti extra UE e con quali garanzie]

9. Links to third-party services

The website contains plain links to WhatsApp (Meta), Instagram and LinkedIn. These links do not load any third-party scripts or content: only if you click one are you taken to the external service, which processes your data as an independent controller under its own privacy policy. We encourage you to read it before using the service.

10. Your rights

You can exercise the rights granted by Articles 15-22 GDPR at any time, free of charge:

To exercise your rights, write to info@nbang.it. We will reply within one month of your request, which may be extended by two further months for complex requests, as provided by Art. 12 GDPR. We may ask you for information to verify your identity.

• access your data and information about how it is processed (Art. 15);
• have inaccurate or incomplete data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive the data you provided to us in a portable format, where processing is based on contract or consent and carried out by automated means (Art. 20);
• object, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21);
• withdraw your consent, where applicable, at any time, without affecting the lawfulness of prior processing (Art. 7(3)); for cookies, use the “Manage cookies” link in the footer;
• not be subject to decisions based solely on automated processing (Art. 22).

11. Complaints to a supervisory authority

If you believe that the processing of your data breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), or with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place (Art. 77 GDPR).

12. Changes to this policy

We may update this policy, for example when the website or the law changes. The date of the latest update is shown at the top. We will highlight any significant changes on the website.