Notice on the processing of personal data

The data controller for the processing described on this page is AEGIS CODEX S.r.l., with registered office at Via di Santa Costanza 21, 00198 Roma (RM), VAT number 18727461008, which operates the AerPuro service¹.

• Email: supporto@aerpuro.it (also for exercising your rights)
• PEC (certified email): aegiscodex@pec.it
• Data Protection Officer (DPO): [Da indicare: DPO nominato oppure non nominato]

The company’s other details are in the legal notice.

This notice covers three situations in which we decide how and why the data is processed:

• you visit the website aerpuro.it and its guides;
• you write to us, including through the demo or quote request that the website prepares as an email;
• you sign in through the central sign-in on aerpuro.it, which takes you to your company’s area.

Browsing the website. The server that hosts the website automatically records, for each request, the IP address, the date and time, the page requested, the outcome and the browser type (user agent). These are technical logs: we do not use them to profile you and we do not combine them with other data. The website does not use analytics tools or third-party services that track browsing: the details are in the cookie policy.

Demo or quote request. The form on the website does not send anything to our servers: it composes an email in your email program, and we receive it only if you decide to send it. It contains the data you choose to enter: the company name and VAT number, the contact person’s name, role, telephone number and email, the city and any notes.

Email. If you write to us, we process your address, the content of the message and the data you give us.

Central sign-in. When you sign in from aerpuro.it you enter your email and password. The password is forwarded to the server of your company’s area, which checks it: the central sign-in does not record or store it. To know which area to direct you to, the central sign-in keeps for each user only a cryptographic fingerprint (hash) of the email (calculated with a secret key, never the email in clear), the area the user belongs to and whether the user is active. For security it records sign-in attempts: date and time, outcome, IP address, the email fingerprint and the fingerprint of the browser used.

Each processing activity has a specific purpose and a legal basis among those provided for by the GDPR².

We do not send promotional communications, we do not profile and we do not take automated decisions that produce effects on you. Providing the data is optional, but without it we cannot reply to you or let you sign in.

The data is neither disclosed nor sold. It is processed only by the authorised people at our company and by the suppliers who help us provide the service, each only for the activity we entrust to them:

HERE and OpenAI do not receive data of website visitors or of people who use the central sign-in: they act only in the customer companies’ areas, for the functions indicated³⁴. The data may be disclosed to the authorities when the law requires it.

Switzerland. Servers, archive and backups are in Switzerland, a country for which the European Commission has recognised an adequate level of protection⁵, confirmed in the review of 15 January 2024⁶. No further safeguards are needed for this transfer (Article 45 GDPR)⁷.

OpenAI. For customers established in the European Economic Area or in Switzerland, the terms published by OpenAI name OpenAI Ireland Ltd as the counterparty and provide that transfers to group companies or suppliers outside those countries, such as the United States, take place on the basis of standard contractual clauses or an adequacy decision³.

HERE. HERE’s terms allow access to data from outside the European Economic Area only to countries with an adequacy decision or under standard contractual clauses⁴.

You can ask us for a copy of the safeguards adopted by writing to supporto@aerpuro.it.

• Technical website logs: for as long as needed for security, then deleted by the automatic rotation of the logs.
• Emails and demo or quote requests: for as long as needed to handle the request; if a contract results, for the duration of the relationship and then for the periods required by law, including tax law.
• Central sign-in: the email fingerprint is kept for as long as the user exists in their company’s area and is removed when the company deletes the user. Rejected sign-in attempts are kept for 14 days, other security events for 90.

You can ask us at any time to access your data, to correct or delete it, to restrict its processing and to receive it in a readable format (portability), and you can object to processing based on our legitimate interest⁸.

Write to supporto@aerpuro.it: we reply within one month, which can be extended by two months in complex cases, with an explanation. We may ask you to confirm your identity before replying. For the data your company manages in its AerPuro area, contact the company (chapter 2).

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali)⁹, or with the supervisory authority of the Union country where you live or work.

We update this notice when the processing or the suppliers change. The date of the latest version is at the top and at the bottom of the page, together with the version number.