Privacy Policy

This notice describes how the personal data of users who visit the kom.online website (the “Site”) and interact with the services offered on it is processed. Our data management policies are guided by data protection law — in particular Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Personal Data Protection Code”), as amended by Legislative Decree 101/2018 — and, before that, by our founding principles of transparency, confidentiality, lawfulness and fairness. Anyone who works with us accesses data only in compliance with those principles of confidentiality and security.

1. Data Controller

The Data Controller for personal data is:

No Data Protection Officer (DPO) has been appointed, as the conditions that make it mandatory under Article 37 GDPR do not apply. For any matter relating to the processing of personal data you can contact the Data Controller at the details given above.

2. Types of data collected

The personal data collected by this Site, directly or through third parties, includes:

• Contact details that you provide voluntarily: for example your email address and other information given when you request information or subscribe to the newsletter;
• Usage and browsing data: IP address (anonymized where indicated), browser and device type, operating system, pages visited, access times, length of visit, referring URL and other parameters collected through cookies and tracking tools;
• Technical identifiers generated by cookies and similar technologies, including unique identifiers.

Providing contact details is optional; not providing them may make it impossible to receive the information or the services requested. Browsing data needed for the Site to work is collected by its own technical nature.

3. Purposes of processing and legal bases

We process your personal data solely for the purposes set out below, on the corresponding legal bases provided for by Article 6 GDPR:

Purpose	Legal basis
Responding to requests for information about our services and related updates	Pre-contractual measures and legitimate interest in responding to requests (Art. 6.1(b) and (f))
Sending the newsletter and informational emails about our services	Consent of the data subject and, where the conditions are met, Article 130(4) of Legislative Decree 196/2003 (“soft opt-in”) (Art. 6.1(a))
Usage statistics and analysis of the browsing experience	Consent of the data subject for non-technical and third-party cookies (Art. 6.1(a))
Technical operation and security of the Site	Legitimate interest of the Data Controller (Art. 6.1(f))
Compliance with legal obligations	Legal obligation (Art. 6.1(c))

4. Newsletter and informational emails (HubSpot)

If you have requested information or subscribed to our newsletter, we will occasionally send you updates by email. This activity is governed by Article 130 of the Italian Privacy Code (Legislative Decree 196/2003) and is based on your consent.

If you no longer wish to receive these messages you can tell us at any time: at the bottom of every message you will find instructions to unsubscribe (opt-out link). We will use your email address only to send you the information you asked to receive, and for no other purpose.

HubSpot (HubSpot Ireland Limited / HubSpot, Inc.)

Our newsletter is run through HubSpot. Your email address is stored on the provider’s servers and processed in line with the applicable rules on security and confidentiality. It will never be shared with third parties for purposes other than running the service.

Like any newsletter platform, HubSpot provides aggregate information on message opens and link clicks. We may use this information to understand whether our content is of interest and adapt our communications accordingly.

Data processed: email address; usage data (opens, clicks). Provider’s privacy policy: legal.hubspot.com/privacy-policy

5. Browsing, statistics and experience analysis

We use the following services to understand how users interact with the Site and to improve its content and usability. Where these tools involve non-technical cookies, they are activated only after you have given consent through the cookie banner.

Google Analytics (Universal Analytics) with IP anonymization — Google Ireland Limited

Google Analytics (Universal Analytics) is a web analytics service provided by Google Ireland Limited (“Google”). Google uses the personal data collected to track and examine the use of this Application, compile reports and share them with the other services developed by Google. Google may use the personal data to contextualize and personalize the ads in its own advertising network. This Google Analytics integration anonymizes your IP address. Anonymization works by shortening users’ IP addresses within the borders of the member states of the European Union or of other states party to the European Economic Area agreement. Only in exceptional cases will the IP address be sent to Google’s servers and shortened within the United States.

Personal data processed: usage data; tracking tools. Place of processing: Ireland – Privacy Policy – Opt Out.

Google Analytics 4 — Google Ireland Limited

Google Analytics is a statistics service provided by Google Ireland Limited (“Google”). Google uses the personal data collected to track and examine the use of this Application, compile reports and share them with the other services developed by Google. Google may use the personal data to contextualize and personalize the ads in its own advertising network. In Google Analytics 4, IP addresses are used at the moment of collection and then deleted before the data is recorded in any data center or server.

Personal data processed: usage data; number of users; session statistics; tracking tools. Place of processing: Ireland – Privacy Policy – Opt Out.

Hotjar — Hotjar Ltd

We use Hotjar to analyze the user experience on the Site. Hotjar makes it possible to understand how users interact with the Site through heatmaps, session recordings and surveys.

Heatmaps give a visual representation of where users click, scroll and spend most time on the page, helping us understand which parts of the Site are most engaging and spot areas to improve. Session recordings let us see, in aggregate form, how users interact with the Site, offering useful information for improving its usability and experience.

Personal data processed: usage data; tracking tools. Provider’s privacy policy: hotjar.com/legal/policies/privacy

WooCommerce Order Attribution Tracking — this Application

WooCommerce Order Attribution Tracking is a WooCommerce analytics feature which, where present, links interaction data to marketing activities, channels or campaigns in order to measure their effectiveness. The Site does not currently sell online: the tool is used purely for statistical and traffic attribution purposes.

Personal data processed: usage data; pageviews; tracking tools; referring URL. Place of processing: Italy (this Application).

6. Content from external platforms and social networks

This type of service makes it possible to view content hosted on external platforms directly from the pages of this Application and to interact with it. Such services are often called widgets, that is, small elements embedded in a website or an application: they provide specific information or perform a particular function, and often allow interaction with the user. This type of service may collect web traffic data about the pages where it is installed, even when users do not use it.

YouTube Video Widget — Google Ireland Limited

YouTube is a video content service operated by Google Ireland Limited that allows this Application to embed such content within its own pages.

Personal data processed: usage data; tracking tools. Place of processing: Ireland – Privacy Policy.

YouTube Video Widget (Privacy Enhanced Mode) — Google Ireland Limited

YouTube is a video content service operated by Google Ireland Limited that allows this Application to embed such content within its own pages. This widget is set so that YouTube does not save information and cookies about users on this Application unless they play the video.

Personal data processed: usage data; universally unique identifier (UUID); tracking tools. Place of processing: Ireland – Privacy Policy.

Social buttons and widgets

At the bottom of pages and posts there may be buttons to share content on social networks such as LinkedIn and Facebook. These platforms use their own cookies to recognize you if you browse after logging into those accounts. We have no agreements with these platforms and we cannot see how they use your data: we invite you to read their respective privacy notices.

7. Cookies and tracking tools

Cookies are data that websites store on the device (computer, smartphone or tablet) you use to browse. They can serve several purposes, including remembering your preferences or recognizing you when you come back to the Site.

On this Site we use:

• Technical cookies, needed for the Site to work and to remember your choices (for example the preferences you expressed about cookie consent). They do not require consent.
• Analytics and third-party cookies, used to monitor browsing and, where applicable, to show certain campaigns. These cookies are installed only after your consent, which you can give or refuse on your first visit through the banner and change at any time.

Cookie consent on this Site is collected and managed through iubenda (iubenda s.r.l.), which acts as the Consent Management Platform. On your first visit you are shown a banner allowing you to accept, refuse or customize the use of cookies. You can change or withdraw your choices at any time by clicking the “Privacy preferences” button at the bottom of every page of the Site.

For the complete, detailed list of the individual cookies and tracking tools used, with their purposes and durations, see the Cookie Policy reachable from the “Privacy preferences” button or from the dedicated links on the Site. You can also manage cookie preferences through your browser settings; disabling some cookies may limit certain features of the Site.

8. Place of processing and transfers outside the EU

We handle your data at our own premises and in the other places where the parties involved in the processing operate. Some of the services we use may involve transferring data outside the European Union, in particular to the United States.

These transfers take place in compliance with Chapter V of the GDPR and are covered by appropriate safeguards. In particular, where the US provider adheres to the EU-U.S. Data Privacy Framework (the subject of the European Commission’s adequacy decision of 10 July 2023), the transfer is based on that adequacy decision. In addition, or where there is no adherence to the Framework, transfers are governed by the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional measures, so as to guarantee a level of data protection substantially equivalent to the one ensured within the Union.

You can request further information about the safeguards applied to transfers, and a copy of them, by writing to the Data Controller at the details given in section 1.

9. Data retention period

Personal data is processed and kept for the time strictly necessary for the purposes for which it was collected and, in any case, according to the following criteria:

• Data provided for information requests: for the time needed to respond to the request and for the related follow-up;
• Data for sending the newsletter: until consent is withdrawn or deletion is requested (unsubscribe), after which the data is removed or anonymized unless legal obligations apply;
• Browsing data and analytics/third-party cookies: for the duration stated in the cookie policy or in the settings of the individual tool, and in any case no longer than is necessary for statistical purposes;
• Data kept for legal obligations: for the period required by the applicable law.

At the end of the periods indicated, the data is deleted or irreversibly anonymized.

10. Your rights and how to exercise them

In relation to the processing of your personal data, under Articles 15-22 GDPR you can exercise the following rights at any time:

• Withdraw your consent at any time, without affecting the lawfulness of processing based on the consent given before withdrawal;
• Object to the processing of your data;
• Access your data and obtain a copy of it;
• Check that your data is accurate and ask for it to be rectified, updated or corrected;
• Ask for the processing of your data to be restricted;
• Ask for your data to be erased or removed (right to be forgotten);
• Receive your data or have it transferred to another controller (portability), where processing is carried out by automated means and is based on consent or on a contract.

To exercise your rights you can write to the Data Controller: certified email (PEC) komlabsrl@legalmail.it · email info@kom.online

We will respond to your request without undue delay and in any case within one month, extendable by a further two months in particularly complex cases, under Article 12 GDPR. Exercising your rights is free of charge, except in the cases provided for by law.

11. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your personal data breaches the applicable law you have the right to lodge a complaint with the Italian data protection authority:

12. Data security

The Data Controller adopts appropriate technical and organizational measures, under Article 32 GDPR, to protect personal data against unauthorized access, loss, destruction or unlawful disclosure. The parties who, in various capacities, take part in the processing access the data only within the limits of the purposes set out above and in compliance with the principles of confidentiality and security, on the basis of specific instructions and, where applicable, appointments as Data Processors under Article 28 GDPR.

13. Changes to this notice

The Data Controller reserves the right to make changes to this notice at any time, informing users on this page and, where necessary, through the Site. We therefore invite you to check this page regularly, referring to the last-updated date shown at the top.