Provided pursuant to Articles 13 and 14 of the GDPR and the Italian Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018 ("Privacy Code").
Last updated: 1 October 2026
This notice describes how the personal data of visitors to the website agentautoma.com (the "Site") and of those who contact us via the “Book a meeting” form or the published e-mail address are processed. This notice applies solely to the Site and not to other websites accessible via links, including the websites of the HACCP DettoFatto and Agens applications, which have their own notices.
1. Data Controller
The Data Controller is Antonio Di Marzio, owner of the sole proprietorship trading under the brand AgentAutoma, with registered office at Via Val di Foro 140, 66010 Casacanditella (CH), VAT No. IT 02878780697, Tax Code DMRNTN82D10C632S (the "Controller" or "AgentAutoma").
Contact details for any matter relating to personal data:
- e-mail: info@agentautoma.com
- certified e-mail (PEC): antonio.dimarzio@legalmail.it
- post: Via Val di Foro 140, 66010 Casacanditella (CH)
Given the nature, scope and purposes of the processing, the Controller does not fall within the cases in which the appointment of a Data Protection Officer is mandatory (Art. 37 GDPR) and has not appointed a DPO.
2. Data processed
2.1 Data provided via the contact form
The Site collects personal data only through the “Book a meeting” form. It has no reserved areas, does not require registration, does not sell anything and does not collect job applications.
- Required to send the request: first name and surname, e-mail address, a brief description of your needs (message) and at least one day of the week or a date on which you would prefer to meet us.
- Optional: company or business, role, service of interest, meeting format (video call, in person, no preference), time slot, up to five specific dates.
- Recorded automatically: the language in which you are using the Site, so that we can reply in the same language.
The form does not ask for your telephone number.
Those who write directly to the published e-mail address send us their address and the data contained in the message and in any attachments.
If the meeting takes place by video call, the link is sent by e-mail and the platform used is indicated in the invitation.
2.2 Browsing data
The systems that run the Site acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of the Internet: IP address, browser and device type, operating system, date and time, pages requested, server response codes. These data are generated and stored by the hosting provider's infrastructure for the operation and security of the Site.
The IP address is also used:
- to limit automated submissions from the contact form (a maximum of three submissions per minute per address), only in the server's temporary memory and for a few minutes;
- to choose the initial language when the address visited does not specify one (for example agentautoma.com without /it, /en or /es): the hosting provider infers the country of origin from the IP address and the Site displays Italian to those connecting from Italy, Spanish to those connecting from Spain or Latin America, and English to everyone else. The country is not stored and is not used for any other purpose. A language explicitly chosen by the user always prevails.
2.3 Cookies
Please refer to the Cookie policy, which forms an integral part of this notice.
2.4 Data that should not be entered
The Controller does not collect special categories of data (Art. 9 GDPR: health, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) or data relating to criminal convictions (Art. 10 GDPR), and does not require them in order to reply. Users are asked not to enter them in their message, nor data of third parties or confidential business information.
2.5 Minors
AgentAutoma's services are aimed at businesses and professionals and not at persons under 18 years of age. Any data relating to a minor that may be acquired are deleted without delay.
3. Purposes and legal bases
| Purpose | Legal basis | Consent |
|---|---|---|
| A. Replying to requests for information, arranging the requested meeting, preparing a quote | Pre-contractual measures at the request of the data subject (Art. 6.1.b) | Not required |
| B. If the request leads to an engagement: managing the contractual relationship | Performance of the contract (Art. 6.1.b) | Not required |
| C. Invoicing and civil-law, accounting and tax obligations; requests from authorities | Legal obligation (Art. 6.1.c) | Not required |
| D. Operation and security of the Site, prevention of abuse and automated submissions, choice of the initial language | Legitimate interest (Art. 6.1.f) | Not required |
| E. For customers only: e-mails about services similar to those already purchased | Legitimate interest and Art. 130(4) Privacy Code | Not required; objection possible at any time, including by replying to any e-mail |
| F. Establishment, exercise or defence of legal claims | Legitimate interest (Art. 6.1.f) and Art. 9.2.f | Not required |
The required data listed in section 2.1 are needed for purposes A, B and C: without them, it is not possible to reply.
The Site does not collect consent for newsletters, marketing or profiling and does not carry out such processing. Those who write to us receive only communications relating to their request. Should such processing be introduced in the future, consent will be requested separately, on an optional and revocable basis, and this notice will be updated beforehand.
The Controller does not take decisions based solely on automated processing that produce legal effects or similarly significant effects on the data subject (Art. 22 GDPR).
4. Place and methods of processing
Contact form data are not saved in any database of the Site. The process is as follows:
- the Site's server, hosted by Vercel, receives the request, checks it and converts it into an e-mail;
- the transactional e-mail service Resend delivers it to the address info@agentautoma.com;
- Cloudflare's e-mail forwarding service delivers it to the Controller's Gmail mailbox, where the request is read, handled and stored.
Processing is carried out using IT and electronic tools. Security measures adopted (Art. 32 GDPR): encryption of communications (HTTPS/TLS), collection of only the necessary data, validation of the data received on the server, anti-abuse mechanisms on the form without third-party services, access control to the mailbox and to the providers' dashboards.
5. Recipients
The data may be processed by:
- providers appointed as Data Processors (Art. 28 GDPR), listed below with a link to the respective data processing agreement;
- independent controllers: accounting, tax and legal advisers, banks for payments relating to engagements, public authorities in the cases provided for by law.
| Provider | Purpose | Location | Agreement (DPA) | Sub-processors |
|---|---|---|---|---|
| Vercel Inc. | Hosting of the Site and running of the server that receives the form | USA, with distributed network | DPA | List |
| Resend (Plus Five Five, Inc.) | Delivery of the e-mails generated by the form | USA | DPA | List |
| Cloudflare, Inc. | Domain management and forwarding of e-mail addressed to info@agentautoma.com | USA, with distributed network | DPA | List |
Requests forwarded from info@agentautoma.com are received and stored in a Gmail mailbox, a service provided by Google Ireland Limited under its own Terms of Service and Privacy Policy.
The data are not disseminated, sold or transferred to third parties for their own marketing purposes. The up-to-date list of processors is also available on request from info@agentautoma.com.
6. Transfers outside the European Economic Area
Vercel, Resend and Cloudflare are based in the United States and may also process data outside the European Union. In particular, the server that receives the contact form runs in the United States. Google, for the Gmail service, may also store and process messages on servers located outside the European Union, including the United States.
Transfers take place in accordance with Articles 44 et seq. of the GDPR, on the basis of:
- an adequacy decision of the European Commission, including Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework for certified entities;
- Standard Contractual Clauses (Decision (EU) 2021/914) contained in the agreements with the providers, supplemented where necessary by supplementary measures;
- other appropriate safeguards pursuant to Art. 46 GDPR.
A copy of the safeguards may be requested from info@agentautoma.com.
7. Retention
| Data | Duration |
|---|---|
| Requests not followed by a contract | 24 months from the last contact |
| Requests leading to an engagement | For the duration of the relationship, as provided for in the contract |
| Contracts, invoices, tax documents | 10 years (Art. 2220 Italian Civil Code and tax legislation) |
| Hosting infrastructure logs | According to the provider's timeframes, normally no longer than 30 days |
| IP address for the submission limit | A few minutes, only in temporary memory |
| Objection to the e-mails under point E | For as long as needed to comply with it |
| Defence in legal proceedings | Duration of the dispute and of the time limits for appeal |
Once these periods have elapsed, the data are deleted or anonymised, unless legal obligations or the need for defence in legal proceedings require otherwise.
8. Rights of the data subject
The data subject may at any time exercise the rights under Articles 15-22 GDPR:
- access (Art. 15): to know whether and which data are processed and to receive a copy;
- rectification (Art. 16): to correct or complete the data;
- erasure (Art. 17), in the cases provided for;
- restriction (Art. 18);
- portability (Art. 20): to receive the data provided in a structured, machine-readable format;
- objection (Art. 21) to processing based on legitimate interest and, always and without giving reasons, to the communications under point E;
- not to be subject to decisions based solely on automated processing (Art. 22).
Requests should be sent to info@agentautoma.com, to the certified e-mail (PEC) address or by post to the address in section 1. The Controller will reply without undue delay and in any event within one month, which may be extended by two months in complex cases, with notice to the data subject. Exercising these rights is free of charge, except for manifestly unfounded or excessive requests (Art. 12.5 GDPR).
Complaint. The data subject may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Roma — www.garanteprivacy.it) or with the supervisory authority of the EU country in which they live or work, or apply to the judicial authority.
9. Links to other websites
The Site contains links to third-party websites and to the websites of AgentAutoma's applications, each with its own notice. The Controller is not responsible for processing carried out on websites it does not manage.
10. Changes
This notice may be updated, including as a result of changes in legislation or to the Site. The version in force is always available on this page, with the date of the last update. Should processing based on consent be introduced or changed, consent will be requested again.
AgentAutoma di Antonio Di Marzio — VAT No. IT 02878780697 — Via Val di Foro 140, 66010 Casacanditella (CH)