Privacy notice

1. Data controller and contacts

This site is owned and operated by ECLOUD srl, data controller, registered office at via del Lavoro 3/c, 36027 Rosà (Vicenza), Italy, VAT no. IT03762650244, represented by its legal representative pro tempore. For privacy requests: info@hydrocloud.it; certified email (PEC): pec.ecloudsrl@legalmail.it. The controller has not appointed a Data Protection Officer (DPO), as this is not mandatory for the activity carried out under Art. 37 GDPR.

2. Data and processing methods

We process the data entered in the form (company name, VAT number, contact person, email, phone and notes), acknowledgment of this notice, and any optional marketing consent. Requests are received by email and also managed in our company CRM, Odoo. Processing is carried out using IT tools and, where necessary, manual methods, by authorized personnel and with adequate security measures.

We also receive data through Google Ads lead form ads: in this case Google collects the data directly on its own platform (first and last name, email, phone, company name and any answers to the form's custom questions) and automatically forwards it to us through a technical integration (webhook) to our Odoo CRM, under Google's Lead Form Terms of Service. Once received, this data is processed like any other commercial request, with the same purposes and legal bases set out in point 3.

To operate and secure the site, we process technical connection data such as IP address, browser, device and request timestamp. The Cloudflare Turnstile anti-spam service analyzes technical signals from the browser and connection. The form also stores cryptographic fingerprints of IP addresses and requests, timestamps and delivery status to limit abuse and duplicates; it does not store the text of requests in the anti-spam database.

3. Purposes and legal bases

• Responding to your request, drafting proposals and managing the relationship: request received via the website form or via a Google Ads lead form ad; pre-contractual measures or contract requested by the data subject (Art. 6.1.b GDPR); for company contacts, legitimate interest in managing professional relationships (Art. 6.1.f).
• Installation and logistics: handling the request and any related services, including putting you in touch with a partner installer where necessary and agreed.
• News and promotional communications: only with optional consent given via the dedicated checkbox (Art. 6.1.a), revocable at any time. Contact necessary to answer your request does not require marketing consent.
• Security, spam and duplicate prevention: the controller's legitimate interest in protecting the site and its systems (Art. 6.1.f).
• Accounting and tax obligations: legal obligations (Art. 6.1.c). Any retention for the protection of legal rights is based on the related legitimate interest (Art. 6.1.f).
• Analytics, advertising and external video: consent to the respective categories in the cookie panel (Art. 6.1.a and applicable rules on tracking tools).

4. Providing your data

Fields marked as required are needed to process the form. Alternatively, you can contact the controller by email. Please do not enter sensitive data or unnecessary information in the notes field. Marketing consent and consent to optional tools are separate and do not affect the response to your request.

5. Recipients and providers

Data is accessible to authorized personnel and to hosting, email, CRM and maintenance providers, to the extent necessary for their respective activities. Hosting and email are provided by OVH. For requests from individuals, necessary data may be shared with partner installers to follow up on the request; for deliveries and logistics services, with the parties in charge. These parties act as processors or independent controllers depending on their actual role; sharing data with them does not authorize independent promotional campaigns on their part.

For lead form ads, the initial data collection takes place on Google's platform under Google's Lead Form Terms of Service, not on our site: at this stage Google acts as an independent controller. The data is then automatically forwarded to us and processed as described in this notice.

We also use Cloudflare Turnstile for security and, depending on your choices, YouTube, Google Analytics and Meta Pixel; typefaces are hosted directly on the site and do not require connections to third-party services. Cloudflare states it also acts as an independent controller for improving bot detection. If activated with your consent, the use of Meta Pixel involves joint controllership between the controller and Meta Platforms Ireland Ltd., limited to the initial collection and transmission of data for advertising measurement and optimization purposes, under the terms of the Controller Addendum made available by Meta; for subsequent processing Meta acts as an independent controller. With consent to the Advertising category, Meta's Advanced Matching is also active: where present in the form, first name, last name, email and phone number are hashed (SHA-256) in the user's browser before being sent to Meta, to recognize the user across its platforms and better attribute advertising conversions. Meta's configuration also covers other identifier categories (e.g. location, date of birth, gender) that the site's form does not collect and which are consequently never transmitted; the free-text notes field is never shared with Meta. Data is not made public. The updated list of processors and authorized persons is kept at the controller's registered office; information about recipients is available by writing to info@hydrocloud.it.

6. International services

Google (including Google Analytics and Google Ads lead form ads), Meta and Cloudflare services may involve processing and transfers outside the European Economic Area. Each service's terms identify the parties involved and the applicable safeguards, such as adequacy decisions where applicable or standard contractual clauses. Consent to cookies does not replace these safeguards. Further information is available in the providers' notices referenced in the cookie policy and from the controller.

7. Retention

• Accounting and tax records: 10 years under applicable obligations, starting as provided by law, unless further documented legal needs apply.
• Requests and commercial history in email and CRM: per the controller's policy, up to a maximum of 10 years from the last meaningful contact, with periodic review of necessity and early deletion of data no longer needed. This period is not a blanket retention requirement for every request.
• Marketing: until consent is withdrawn and in any case no longer than 10 years from collection, with periodic review of the consent's validity and the contact's continued interest. Withdrawal stops promotional communications; only the information necessary to document and honor the withdrawal may be retained.
• Application-level anti-spam: IP counts and hashes for a one-hour window; request status and fingerprints for 24 hours. Expired rows are cleared on the next submission to the form: absent new requests, they may persist until the next cleanup. Hosting logs follow OVH's own settings; details are available from the controller.
• Cookie preferences: 183 days. Duration of other tools and service settings is detailed in the cookie policy.

8. Your rights

Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interest, and withdraw consent without affecting the lawfulness of processing carried out before the withdrawal. For marketing, you can ask at any time to stop receiving further communications. Write to info@hydrocloud.it or to the controller's PEC. You can lodge a complaint with the Italian Data Protection Authority (Garante).

9. Cookies and choices

Optional categories are initially disabled. You can accept, reject, or choose individually among Google Analytics statistics, Meta Pixel advertising and YouTube video. Choices can be changed via the "Cookie preferences" control in the landing page footer. Withdrawing consent blocks further loading and reloads the page; it does not undo data already shared with providers. The cloud video hosted directly on the site does not require consent for external video. See the full cookie policy.

10. Updates

This notice is updated whenever the processing activities or services used change. The current version shows the last-updated date at the top of this page.