Privacy Policy

Data Controller: Gitogi Srl, Piazza IV Novembre 4, 20124 Milano — VAT No. 14288420962

Data Controller Contact: info@gitogi.com | Certified Email (PEC): pec@pec.gitogi.com

A Data Protection Officer (DPO) has not yet been designated; the appointment is planned. In the meantime, the controller is directly reachable at the contact details provided.

1. Data We Collect

We collect personal data that you voluntarily provide through our contact forms, the AI Readiness assessment, newsletter subscription, resource downloads, and interactions with our AI chatbot. Data may include: first name, last name, email, company name, role, profession, firm size.

2. Purposes of Processing

Your data is processed for the following purposes:

3. Automated Profiling and Lead Scoring

We use an automated scoring system (lead scoring) to classify contacts based on their level of interest, pursuant to Art. 22 GDPR.

The system is rule-based (not machine learning) and relies exclusively on behavioural signals: email type, declared profession, firm size, completed assessment, downloaded guides, newsletter subscription.

We do not use sensitive data (Art. 9 GDPR) in score calculation.

You have the right to:

• Know the score assigned to you
• Request an explanation of the criteria used
• Contest the score and obtain a human review
• Object to automated profiling (Art. 21 GDPR)

For more details, please see the AI Transparency page.

4. AI Chatbot

The chatbot on this website is a generative artificial intelligence system based on third-party Large Language Models (LLMs) provided by OpenAI and Anthropic.

• Conversation messages are sent to AI providers to generate responses
• Conversations are stored on EU servers (Supabase Postgres, Frankfurt) for 90 days
• You are not required to provide personal data to use the chatbot
• If you voluntarily provide personal data in the conversation, it is processed as described above
• Messages are automatically scanned for voluntarily provided contact data (email, phone number) to associate the conversation with your lead profile for commercial follow-up purposes

5. Data Retention

Data is retained for the time strictly necessary to fulfil the purposes for which it was collected, as indicated in the table in section 2. At the end of the retention period, data is automatically deleted through scheduled weekly/monthly processes.

6. Privacy by Design (Art. 25 GDPR)

• Data minimisation: we collect only the personal data strictly necessary for each purpose
• Pseudonymisation: AI audit logs record anonymised input summaries (no personal identifiers)
• Encryption in transit (TLS 1.3) and at rest (AES-256-GCM for stored API keys)
• Least-privilege access controls for all data stores
• Automated data retention: scheduled cleanup processes delete data at the end of each retention period
• Granular consent management: separate opt-in for each processing purpose
• Consent Mode v2: analytics and marketing technologies activate only after explicit user consent

7. Sub-processors

The following providers act as data processors pursuant to Art. 28 GDPR:

We do not sell or share your data with third parties for marketing purposes.

8. Transfers Outside the EU

Some of our sub-processors are based in the USA. Data transfers to the USA are legitimised by the Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by specific Data Processing Agreements (DPAs).

9. Your Rights (Art. 15–22 GDPR)

You have the right to:

• Access (Art. 15): obtain a copy of your personal data
• Rectification (Art. 16): correct inaccurate data
• Erasure (Art. 17): request the deletion of your data
• Restriction (Art. 18): restrict processing
• Portability (Art. 20): receive your data in a structured format (JSON/CSV)
• Objection (Art. 21): object to processing based on legitimate interest
• Withdrawal of consent (Art. 7(3)): withdraw consent at any time
• Human review (Art. 22): request a human review of automated decisions

You can exercise your rights:

• Through the Your Data page (self-service export and deletion)
• By writing to info@gitogi.com
• Via certified email (PEC) to pec@pec.gitogi.com

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

10. Cookies

For our cookie policy, please refer to our Cookie Policy.

11. Artificial Intelligence

For detailed information on the use of artificial intelligence on this website, please see the AI Transparency page, drafted in compliance with EU Regulation 2024/1689 (AI Act).

Last updated: 1 March 2026