Privacy Policy

The website collects personal data exclusively through the contact form and through technical service logs.

• Data provided by the data subject through the form: name, email address, company name (optional), message content.
• Data automatically collected for technical reasons: IP address, country of origin, browser user-agent, request timestamp.

Data submitted through the form is processed to handle the data subject's request and to assess the establishment of a possible contractual or pre-contractual relationship. Legal basis: art. 6(1)(b) GDPR — pre-contractual measures taken at the data subject's request.

Technical data (IP, country, user-agent) is processed for security, abuse prevention and diagnostic purposes. Legal basis: art. 6(1)(f) GDPR — legitimate interest of the controller in protecting the service.

Messages submitted through the form are delivered by email to the controller's business address and stored within the controller's email systems. They are not subject to automated profiling or to automated decision-making processes pursuant to art. 22 GDPR.

Technical logs are stored within the controller's monitoring systems and within the systems of the edge networking provider (Cloudflare).

Contact data is retained for the time necessary to handle the request and, in any case, for no longer than twenty-four months after the last meaningful contact, unless the data subject requests earlier deletion or unless retention is required to comply with legal obligations.

Technical logs are retained only for the time strictly necessary for security purposes, normally no longer than twelve months.

To deliver the service, the controller relies on the following external data processors, appointed pursuant to art. 28 GDPR:

• Cloudflare, Inc. (USA) — edge networking, CDN and DDoS protection provider. Transfers to the United States take place under the Standard Contractual Clauses adopted by the European Commission pursuant to art. 46 GDPR.
• Vertigo Consulting S.r.l. (Italy) — SMTP service provider used to deliver contact-form messages.

Pursuant to articles 15–22 GDPR, the data subject has the right to ask the controller for access to their personal data, rectification, erasure, restriction of processing, portability and to object to processing.

These rights can be exercised by writing to privacy@oasi.systems. The controller responds without undue delay and, in any event, within one month from receipt of the request.

The data subject also has the right to lodge a complaint with the competent supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

The controller has not appointed a Data Protection Officer (DPO), as the conditions for mandatory designation under art. 37 GDPR do not apply.

This notice may be updated at any time to reflect changes in the processing of personal data or in applicable law. The version in force is always the one published on this page, with the date of the last update indicated above.