Privacy and cookies

Who the controller is

The data controller is Andrea Brognera, sole proprietorship "Kairos Lab". Partita IVA (VAT no.) 05611300269, REA TV-459072.

For any question about personal data, write to [email protected].

There is no data protection officer (DPO): for this activity it is not mandatory.

The form for businesses

The form on the Contact page (in Italian) collects: name, name of the business, phone, email, work done and area, and an open message. Along with this data comes the address of the page the request is sent from.

The data is used to reply to the business that writes. The legal basis is pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR).

Name, business and at least one contact detail are required: without them, we cannot reply.

Direct email and phone

People who write to [email protected] or phone give the data they choose: usually name, contact details and the content of the message. It is used to reply, with the same legal basis as the form for businesses.

Technical data of the site

The site is hosted by Cloudflare (Cloudflare Pages service). At each visit the server records the IP address, the date and time, the page requested and the type of browser.

This data is used to make the site work and to protect it from abuse. The legal basis is the legitimate interest in the security of the site (Art. 6(1)(f) GDPR).

For these logs Cloudflare acts as a processor.

The form on the Contact page (in Italian) has a hidden field, which people do not see. It lets Web3Forms recognise submissions made by automated programs. It contains no personal data.

The site does not use visitor statistics tools and does not use captcha.

Cookies

The site does not use cookies and does not store anything on the device.

The light or dark theme follows the device settings.

The submission to Web3Forms starts only when the form button is pressed, and it neither sends nor leaves cookies.

That is why the site does not show a cookie banner. The Garante does not require one when a site uses only technical cookies (Cookie guidelines of 10 June 2021, §7.1); this site uses none.

Who receives the data and where it goes

The form on the Contact page (in Italian) sends the data to Web3Forms, a service of Web3Creative, a business based in India. Web3Forms forwards it by email to the [email protected] mailbox.

Web3Creative is a processor on behalf of Kairos Lab, under its data processing agreement (DPA) and its privacy notice.

Web3Creative uses these sub-processors:

• Amazon Web Services: hosting, storage and email, with servers in the United States;
• Cloudflare: network and protection of the submission addresses;
• Hetzner: infrastructure in the European Union (Germany and Finland);
• CleanTalk and Akismet (by Automattic): they receive the IP address and the email of the sender, to recognise spam; they operate in the United States and in other countries;
• SparrowDesk: support for Web3Forms customers;
• Microsoft (Clarity): analysis of the use of the Web3Forms control panel, where submissions are shown; it operates in the United States and in other countries.

This list is the one in Annex 3 of the Web3Forms DPA, read on 7 October 2026. Web3Creative can change it with 14 days' notice: the updated list is in the Web3Forms DPA.

CleanTalk and Akismet process the data under their own rules, which Kairos Lab does not control: CleanTalk privacy policy, Automattic privacy policy.

Transfers outside the European Union to Web3Creative and its providers take place under the EU standard contractual clauses (Implementing Decision (EU) 2021/914), provided for by §10 of the Web3Forms DPA.

Cloudflare hosts the site. For transfers to the United States, Cloudflare participates in the EU-U.S. Data Privacy Framework (Cloudflare privacy policy).

The [email protected] mailbox is on Google Workspace. Google processes the data as a processor, under the Cloud Data Processing Addendum.

For transfers to the United States, Google participates in the EU-U.S. Data Privacy Framework (Google page on transfers). Where the Data Privacy Framework does not apply, the standard contractual clauses provided for by the Cloud Data Processing Addendum apply.

Kairos Lab does not give the data to anyone else.

For how long

Requests from businesses, in the [email protected] mailbox: 12 months from the last contact. If a contract follows, for the duration of the contract and of the tax obligations.

At Web3Forms, submissions from the form on the Contact page (in Italian) are kept for up to 3 years from submission, then they are deleted automatically.

Site logs at Cloudflare: Cloudflare does not state the periods in figures. It keeps them for as long as they are needed for its purposes and for legal obligations (Cloudflare privacy policy, §11).

At CleanTalk and Akismet: under their own rules.

Your rights

Anyone who has given their data can ask (Arts. 15-22 GDPR):

• to see it and get a copy;
• to correct it;
• to delete it;
• to restrict its use;
• to receive it in a format a computer can read;
• to object to processing based on legitimate interest.

To do so, write to [email protected].

You can lodge a complaint with the Garante per la protezione dei dati personali (Art. 77 GDPR).

There is no automated decision-making or profiling.

Last update

Privacy notice updated as of 29 October 2026.

This is a translation. The Italian text is the one that applies: Informativa in italiano