// Privacy policy

Last updated: 10/2026

This privacy policy explains how ITEM S.r.l. (“ITEM”, “we”, “our”) processes the personal data of people who:

visit the website www.item.to.it;
contact ITEM through the website, by email or by phone;
report a security vulnerability to cybersecurity@item.to.it.

It is provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Italian Privacy Code), as amended.

Data controller

The data controller is ITEM S.r.l.

Registered office: via Chialamberto 4, 10148 Turin, Italy
VAT No. IT06939990013
Phone: +39 011 220 0477
Email: info@item.to.it

ITEM has not appointed a Data Protection Officer.

Data we collect

Navigation data. The systems that run the website automatically collect some technical data: IP address, browser and operating system, pages requested, date and time of each request, and the referring page. We use this data to deliver the pages, keep the website secure and investigate technical problems or misuse.

Visit statistics. We count visits with Koko Analytics, which runs on our own server without cookies and without storing your IP address. To recognize unique visits it computes an encrypted code from your IP address and browser, which changes every 24 hours and is not used to identify you.

Contact form. When you write to us from the Contact page, we collect your first name, last name, company, role, country, email address and the content of your message.

Email and phone. When you write to an ITEM address, such as sales@item.to.it or info@item.to.it, or call us, we process your contact details and the information you choose to share.

Vulnerability reports. When you report a vulnerability to cybersecurity@item.to.it, we process your contact details, the content of your report and, if you ask us to, the name you want to be credited with.

Please do not include sensitive data, such as health information, in your messages.

Purposes and legal bases

To reply to your request and, where relevant, prepare a quotation. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and ITEM’s legitimate interest in answering business enquiries (Art. 6(1)(f)).
To manage the contract that may follow, including invoicing. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with legal obligations, such as tax and accounting rules (Art. 6(1)(c)).
To handle vulnerability reports and, where the law requires, notify them to the competent authorities. Data in reports is used only for this purpose. Legal basis: obligations under Regulation (EU) 2024/2847, the Cyber Resilience Act (Art. 6(1)(c)), and ITEM’s legitimate interest in the security of its products (Art. 6(1)(f)).
To operate the website and protect it from abuse. Legal basis: legitimate interest (Art. 6(1)(f)).
To establish, exercise or defend legal claims. Legal basis: legitimate interest (Art. 6(1)(f)).

All fields in the contact form are required: without them we cannot handle your request.

Who receives the data

Your data is handled by ITEM staff who are authorized and instructed to do so. It may also be processed, on ITEM’s behalf, by service providers acting as data processors under Article 28 GDPR:

Aruba, which hosts the website and provides our email service.

We may also share data with professional advisors bound by confidentiality and with public authorities when the law requires it. For actively exploited vulnerabilities, the authorities are CSIRT Italia and ENISA: we do not share the reporter’s identity without their consent, unless the law requires it. The full list of data processors is available on request.

Transfers outside the European Economic Area

If a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the Standard Contractual Clauses adopted by the Commission. You can request a copy of these safeguards by writing to cybersecurity@item.to.it.

How long we keep the data

Contact requests: for the time needed to reply and follow up, and no longer than 24 months after the last contact if no business relationship begins.
Contract and invoicing data: 10 years, as required by Italian law (Art. 2220 of the Civil Code).
Vulnerability reports: 24 months after the report is closed.
Navigation data: for the period set by our hosting provider for security purposes, unless needed to investigate an incident.

Cookies

The website uses only technical cookies that it needs to work, such as the cookie that remembers the language you selected or that your browser indicated. Technical cookies do not require consent.

Your rights

You can ask ITEM to:

access your personal data (Art. 15 GDPR);
correct it (Art. 16) or delete it (Art. 17);
restrict its processing (Art. 18);
receive it in a structured, machine-readable format and transmit it to another controller (Art. 20);
object at any time to processing based on legitimate interest (Art. 21).

To exercise these rights, write to cybersecurity@item.to.it. We reply within one month of receiving your request. For complex requests this period can be extended by two further months, and we will tell you why (Art. 12(3)).

If you believe that the processing of your data breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

Automated decisions

We do not take decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

Security

We apply appropriate technical and organizational measures to protect data from unauthorized access, loss, misuse, alteration, or disclosure.

Changes to this privacy policy

We may update this privacy policy to reflect changes to the website, our services or applicable laws. The current version is always the one published on this page.

Contact

For privacy-related questions, contact ITEM S.r.l. at cybersecurity@item.to.it.