Privacy Policy

Controller

The data controller is Altheon S.R.L.S. (“Altheon”, “we”, “us”).

Company name

Altheon S.R.L.S.

Legal form

Simplified limited liability company (società a responsabilità limitata semplificata) with a sole shareholder

Registered office

Via Gioachino Rossini 109, 37045 Legnago (VR), Italy

Share capital

EUR 1,000.00, subscribed and fully paid up

Companies Register

Verona, no. 05142670230

Economic and administrative index (REA)

VR-473784

VAT no. and tax code

05142670230

Certified email (PEC)

altheon@pec.it

Email

info@altheon.it

Sole administrator

Michele Pravadelli

The point of contact for data-protection requests is the sole administrator, Michele Pravadelli: write to info@altheon.it or to the PEC address altheon@pec.it.

Data we collect through the forms

We collect the data you enter in the site's forms. Required fields are marked with an asterisk.

• “Projects and advisory” (Contact page). Required: counterpart type, timing, message, full name, email, confirmation that you have read this policy. Optional: organization or public body, role, indicative capacity, consumption or area with its unit, permitting status and grid connection status (required only for a stalled project), one question about your case that depends on the counterpart type (for example the current use of the land or the stage of the assets), and whether the request concerns AIP Engine.
• Application to the specialist network (Partners and Contact pages). Required: full name, firm or company, discipline, country, email, description of your work, confirmation that you have read this policy. Optional: website.
• “Press and other” (Contact page). Required: email and message.
• Newsletter (at the bottom of every page). Required: email and consent. With the subscription we also record the language, the consent wording in use and the version of the wording the form showed you, so that we can demonstrate that consent was given.

If you reply to a confirmation email with documents or other information, we process them for the same purpose as the request.

Technical data of each submission

With every form we also receive: date and time, page language, the page holding the form and the referring page (only when they are pages of this site), how the form was sent (with or without JavaScript), a reference code, and the IP address the submission comes from. This data appears in our internal notification and stays with the request, to handle it and to prevent abuse.

Server logs may contain request metadata (IP address, date and time, user agent) for the same security purposes.

Protecting the forms from abuse

To discard automated submissions we use three measures, with no CAPTCHA and no cookies:

• a hidden field that people do not see: submissions that fill it in are discarded;
• a minimum filling time of 3 seconds, measured in the browser: it is used only to discard submissions that are too fast and is not stored;
• rate limits: a maximum number of submissions per IP address within a given interval and, for confirmation emails, no more than two in 24 hours to the same email address. For this second limit the server uses a cryptographic fingerprint of the address (a hash), not the address itself.

The counters behind these limits live only in the server's temporary memory, are not saved to any store and lapse when the interval ends, after 24 hours at most.

Confirmation emails

After a successful submission we send a confirmation email to the address you entered. The wording is fixed and, depending on the form, includes your name, the counterpart type and a reference code; it does not repeat your message. Internal notifications and confirmations are sent through Resend.

Traffic measurement

The site measures traffic with Vercel Web Analytics, a service of Vercel Inc. It uses no cookies.

On each page you visit, a script served from our own domain sends Vercel the page address and the time. Before sending, the site removes any parameters from the address, that is the part starting with the question mark; any pointer to a section of the page (the part after “#”) remains. On the first page the script also sends the referring site. From the request Vercel derives country, region and city, operating system, browser and device type.

To count visitors Vercel computes from the request a code (hash) that is valid for a single day and then reset, and deletes session data after 24 hours. According to Vercel's documentation the code cannot be used to follow a visitor across days or other websites, and the data serves aggregate statistics only. We only consult aggregate statistics for this site.

Vercel's public documentation does not state which elements of the request go into the daily code. Vercel's Data Processing Addendum does not say whether measurement data is processed solely on our behalf or falls within the service usage data that Vercel processes as a controller (see “Recipients and providers”). This description therefore relies on what Vercel documents.

The same tool can record anonymously that a form was sent successfully, with at most two items among counterpart type, topic and language, never the data entered. This feature is not active today.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding how the site is used. How we classify the tool is explained in the Cookie Policy.

Purposes and legal bases

• Answering requests sent through the “Projects and advisory” and “Press and other” forms and assessing applications to the network, including the confirmation emails: Art. 6(1)(b) GDPR, pre-contractual steps taken at your request.
• Managing the newsletter subscription: Art. 6(1)(a) GDPR, consent. You can withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it.
• Protecting the forms and the site from abuse (hidden field, minimum filling time, rate limits, IP address in the notification and in the logs): Art. 6(1)(f) GDPR, legitimate interest in the security of the site.
• Measuring traffic in aggregate form: Art. 6(1)(f) GDPR, legitimate interest in understanding how the site is used.

The “I have read the privacy notice” box in the “Projects and advisory” form and in the network application confirms that you have read this text: it is not a request for consent.

We do not use the data for profiling or automated decision-making.

Required and optional data

The fields marked as required are needed to handle your request: without them the form cannot be sent and we cannot reply. All other fields are optional. Subscribing to the newsletter is always optional.

Recipients and providers

For the services we use, the data is processed by two providers acting as processors:

• Vercel Inc., which hosts the site, receives form submissions and provides traffic measurement;
• Resend, which sends the internal notifications and the confirmation emails.

Under its Data Processing Addendum, Vercel processes as a controller, including for analytics, benchmarking and reporting, the usage data and metadata generated by the use of its services (Service-Generated Data).

We do not sell or rent personal data, and we do not disclose it to any other third party, except where required by law.

Transfers outside the European Union

Vercel Inc. and Resend are United States entities, so the data collected through the forms and browsing and measurement data are transferred to the United States. The transfer is governed by the Standard Contractual Clauses adopted by the European Commission, together with the applicable supplementary measures; for Vercel these are the clauses of Commission Implementing Decision (EU) 2021/914, incorporated in its Data Processing Addendum. You can request a copy by writing to info@altheon.it.

How long we keep the data

• Requests and applications, with the technical data of the submission: for the time strictly necessary to handle them and for the statute-of-limitations period under Italian civil law.
• Newsletter subscription: until you unsubscribe.
• Filling time: not stored.
• Rate-limit counters: only in the server's temporary memory, for 24 hours at most.
• Server logs: rotated at short intervals.
• Traffic measurement: Vercel resets the visitor code every day and deletes session data after 24 hours. Aggregate statistics remain available for the period set by the service plan, from 1 to 24 months according to Vercel's documentation, which states that it may keep them longer.

Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability. You can object to processing based on legitimate interest and withdraw at any time the consent given for the newsletter.

Requests can be directed to info@altheon.it or to the PEC address altheon@pec.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Cookies and similar technologies

See the Cookie Policy for details on cookies and similar technologies.

Updates

We may update this policy to reflect changes in our processing or in applicable law. Material changes will be communicated on this page with the date of the update.