Legal
Privacy notice
Praxedia S.r.l. · Last updated: 2 August 2026
This notice covers praxedia.com, the company's corporate website. It does not cover the data customers enter into ClimaSync or IureSync: in that relationship the customer is the controller and Praxedia is the processor under GDPR art. 28, as described on the security page and in article 11 below.
The Italian text is the authoritative one. This English version is a courtesy translation; where the two diverge, the Italian prevails.
1Data controller
The controller for personal data relating to this website is Praxedia S.r.l., registered office at Via Comelico 18, 20135 Milan (MI), Italy. The company's full particulars — VAT number, Companies Register, REA, share capital — are published in the legal notice and at the foot of every page.
| Item | Value |
|---|---|
| Address for privacy requests | info@praxedia.com |
| Suggested subject line | “Privacy”. Not required: it only gets the message to the right person sooner. |
| Data protection officer (DPO) | Not appointed: the conditions in GDPR art. 37 are not met given the nature and size of the organisation. Requests are handled by the legal representative for the time being. Should the appointment become mandatory, this section will be updated. |
The address above is the only one the company publishes: there are no separate privacy@ or dpo@ mailboxes. A request sent to any address other than info@praxedia.com may not reach the controller.
2What this website processes
This site has no contact form, no account area, no sign-up and nothing for sale. There is therefore no data that a visitor types into a page. Three kinds of processing remain, and they are these.
- Technical delivery data. To serve a page, the infrastructure hosting it necessarily receives the IP address the request came from and what the browser sends with it: browser and operating system, the address requested, the date and time. That is an unavoidable technical step for any website, not a measurement tool.
- Aggregate visit statistics, collected through Plausible Analytics: how many pages were viewed and which, the referring site, the country, the device and browser type. No cookies, no persistent identifier, no individual or cross-site profile.
- Correspondence. When someone writes to info@praxedia.com, the controller processes the sender's address, the content of the message and any attachments.
None of this builds a profile of the visitor, and none of it makes the same person recognisable on a later visit.
The site does not ask for special categories of personal data under GDPR art. 9 — data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic, biometric or health data, or data concerning sex life — and provides no field in which to enter them. If an unsolicited message contains any, the controller makes no use of them beyond handling the request.
What is written to a visitor's device — and what is not — is set out in full in the cookie policy.
3Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Serving the pages requested and keeping the site available and secure | Technical delivery data | Legitimate interest in running and protecting our own website (GDPR art. 6(1)(f)) |
| Measuring in aggregate how the site is used | Visit statistics | Legitimate interest in understanding the use of our own website (GDPR art. 6(1)(f)). Art. 5(3) of Directive 2002/58/EC is not engaged, because nothing is read from or written to the device |
| Replying to people who write in | Email address, message content, attachments | Legitimate interest in handling correspondence received (GDPR art. 6(1)(f)); steps prior to entering into a contract, where the message concerns a possible engagement (GDPR art. 6(1)(b)) |
| Meeting tax, accounting and other legal obligations once correspondence turns into a relationship | Identification and contract data | Legal obligation (GDPR art. 6(1)(c)) |
| Establishing or defending a legal claim | The data the dispute requires | Legitimate interest in defending our rights (GDPR art. 6(1)(f)) |
The site runs no direct marketing, sends no newsletter, keeps no waiting list and takes no sign-ups. There is therefore no processing based on consent under GDPR art. 6(1)(a), and no consent to withdraw.
4How long it is kept
| Data | Retention |
|---|---|
| Technical delivery data | This site's code writes no application log. The logs that exist are the hosting provider's operational logs, kept for the period set out in its processing agreement, and the controller does not use them to identify visitors. |
| Visit statistics | The statistics are aggregate and contain nothing that identifies a person, so there is no deletion period attached to a data subject. |
| Email correspondence | For as long as handling the request and the relationship arising from it requires. Correspondence evidencing a commercial relationship falls within the statutory record-keeping period of ten years under art. 2220 of the Italian Civil Code. |
| The statistics preference | Stays on the visitor's device until they clear the site's data in their browser. No copy of it is transmitted or kept. |
5Who processes data on the controller's behalf
The controller uses two providers to run this website. Both process data as processors under GDPR art. 28, under an agreement governing purposes, documented instructions, confidentiality and security measures.
| Provider | Purpose | Data location |
|---|---|---|
| Vercel — Vercel Inc. (United States) | Hosting of this corporate website. It does not process product customer data. | Static content served from a CDN; no personal-data store |
| Plausible Analytics — Plausible Insights OÜ (Estonia) | Aggregate traffic statistics for this website. No cookies, no persistent identifier, no profiling. | European Union |
No one else receives data collected through this site. In particular, nothing is passed to advertising networks, marketing-tool vendors or sales intermediaries, and nothing is disseminated.
The list of subprocessors handling product data is a different list, because it concerns different infrastructure: it is published on the security page and annexed to the GDPR art. 28 agreement.
Before a provider processing data for this website is added or replaced, the change is published on this page.
6Transfers to third countries
Visit statistics are processed by Plausible Insights OÜ, an Estonian company, on infrastructure in the European Union: they involve no transfer outside the European Economic Area.
Hosting is provided by Vercel Inc., a company established in the United States, with content served from a delivery network. To the extent that delivery involves a transfer of data outside the European Economic Area, the transfer is covered by the Standard Contractual Clauses approved by the European Commission in implementing decision (EU) 2021/914, under GDPR art. 46(2)(c).
The site embeds no external fonts, maps, videos, tracking pixels, chat widgets or social buttons: typefaces are served from the site's own domain. The only third-party requests a page generates are those of the analytics script described above — which does not load at all if the visitor has declined statistics.
7Automated decisions and profiling
This site carries out no profiling and no automated decision-making producing legal effects concerning the visitor or similarly significantly affecting them, within the meaning of GDPR art. 22.
Aggregate analysis of visits cannot isolate any individual's behaviour and has no effect on them: counting how often a page was opened is not profiling whoever opened it.
8Security measures
Pages are served only over an encrypted connection (HTTPS with TLS). The site is made of static pages: it exposes no account area, queries no database and stores no credentials. What attack surface remains is the hosting provider's.
The technical and organisational measures in place for the products — per-tenant isolation enforced by the database, encryption in transit and at rest, sign-in through your own identity provider, audit logging, backups — are described on the security page, in the terms of GDPR art. 32.
Vulnerabilities can be reported under the conditions published on that same page, which also states the acknowledgement time.
9Data-subject rights
Within the limits of GDPR arts. 15-22, a data subject has the right to obtain:
- access (art. 15): confirmation that processing is taking place and a copy of the data processed;
- rectification (art. 16): correction of inaccurate data and completion of incomplete data;
- erasure (art. 17): deletion of the data in the cases the article provides for;
- restriction (art. 18): suspension of processing in certain circumstances;
- portability (art. 20): receipt of the data provided, in a structured, commonly used, machine-readable format;
- objection (art. 21): objection at any time to processing based on legitimate interest, on grounds relating to their particular situation.
Requests are made by writing to info@praxedia.com. A response is given without undue delay and in any event within one month of receipt, extendable by two further months for complex requests, with reasons given to the data subject (GDPR art. 12(3)).
On some of this information the right cannot be exercised, for a factual reason worth stating rather than leaving to be discovered: the aggregate statistics contain nothing that links a record to a person, and the controller cannot identify a data subject from them. GDPR art. 11 therefore applies — an access or erasure request aimed at those statistics cannot be answered, because there is nothing to look for.
Objecting to the statistics, by contrast, needs no written request at all: it is done from the panel that appears at the foot of the page on a first visit, and it takes effect immediately. How to revisit a choice already made is explained in the cookie policy.
10Complaint to a supervisory authority
Anyone who considers that the processing of their personal data infringes the Regulation has the right to lodge a complaint with a supervisory authority under GDPR art. 77. In Italy that is the Garante per la protezione dei dati personali.
| Item | Value |
|---|---|
| Address | Piazza Venezia 11, 00187 Rome, Italy |
| Website | www.garanteprivacy.it |
| garante@gpdp.it | |
| Telephone | +39 06 69677 1 |
The option of approaching the controller first remains open, as does a judicial remedy under GDPR art. 79.
11Product data: Praxedia as processor
This notice does not cover the data customers enter into ClimaSync or IureSync. In that relationship the customer is the controller and Praxedia S.r.l. acts as processor under GDPR art. 28, under the agreement signed alongside the contract.
The subject matter and duration of processing, documented instructions, confidentiality obligations, security measures, the subprocessor regime, assistance with data-subject requests and personal-data breaches, and what happens to the data when the relationship ends are described on the security page and governed by that agreement.
The notices addressed to each product's own users live on that product's own site, because they describe different processing under different controllers. Duplicating them here would mean maintaining two versions, and the copy is always the one that ages.
12Changes to this notice
This notice may be updated to reflect operational, regulatory or infrastructure changes. Every version carries the date of the last change at the top, and changes take effect on publication on this page.
Where a change introduces new processing, the page says so explicitly rather than merely moving the date.