Privacy Policy

1. Data Controller

The Data Controller for personal data is:

2. Categories of data processed and purposes

2.1 Browsing data

The computer systems and software procedures used to operate this website automatically acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (IP address, browser type, operating system, timestamps, pages visited). Such data are used solely to obtain anonymous statistical information about site usage and to verify its correct functioning.

2.2 Data voluntarily provided by the user — Contact form

Through the form on the /contact page, the user may send the Controller the following personal data:

• • First and last name (required)
• • Email address (required)
• • Phone number (optional)
• • Company name (optional)
• • Job role (optional)
• • Area of interest (optional)
• • Message content (required)

Purpose: handling the contact request, responding to questions and, with specific consent, sending commercial communications.
Legal basis: performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR); legitimate interest of the Controller in responding to communications received.

2.3 Application data — Careers

Emails sent voluntarily via the application links on the /careers page may contain personal data (CV, personal details, work experience). Such data are processed solely for recruitment purposes (Art. 6(1)(b) GDPR) and retained for a maximum of 12 months.

3. Processing methods and retention

Personal data are processed using electronic tools, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and integrity (Art. 5 GDPR). Appropriate technical and organisational measures are implemented to ensure a level of security appropriate to the risk (Art. 32 GDPR).

Data collected via the contact form are retained for the time strictly necessary to handle the request and, in any case, for a maximum of 24 months from collection, unless legal obligations require longer retention periods.

4. Data recipients

Personal data are not transferred to third parties for marketing purposes. They may be disclosed to:

• • Data processors (Art. 28 GDPR): providers of technical services (hosting, SMTP email servers) who process data on behalf of the Controller under appropriate contractual agreements;
• • Public authorities: in cases provided for by law.

The website uses Google reCAPTCHA v3 to protect the contact form from automated submissions (spam/bots). The service is provided by Google LLC and involves the transfer of data (browsing behaviour, verification token) to Google's servers in the USA, in accordance with the standard contractual clauses approved by the European Commission (Art. 46 GDPR). Google's Privacy Policy and Terms of Service apply.

The website loads typefaces via Google Fonts. This feature involves the transfer of the visitor's IP address to Google's servers. For more information, see Google Fonts privacy documentation.

5. Data subject rights

Pursuant to Arts. 15–22 GDPR, the data subject has the right to:

To exercise your rights, write to info@key-4.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) at www.garanteprivacy.it.

6. Cookies

For detailed information on how this website uses cookies, please read our Cookie Policy.

7. Changes to this notice

The Controller reserves the right to make changes to this privacy notice at any time, notifying users on this page. Please consult this page regularly, taking note of the last updated date shown at the top.