Privacy notice
Revision: 17 September 2026 · v40
This notice explains how Geyser IC handles the personal data of website visitors and people requesting information, quotations or support, including requests with attachments.
1. Controller and contact details
The controller is Geyser IC SRL, Italian VAT number 04140270127, with registered office at Via Matteotti 24, Arcisate (VA), and operating office at Piazza Risorgimento 11, Gallarate (VA), Italy. For enquiries and data protection rights, contact info@geyser-ic.com. Certified email (PEC): geyser-ic@pec.it.
2. Data we process
- Browsing and security: IP address, date and time, requested resource, browser and device information, technical request results and anti-spam checks.
- Enquiries: email address, any name, company and telephone number provided, message and technical details entered in the form, originating page, language and enquiry identifier.
- Optional attachments: selected file names and contents, including personal information within documents, photographs and their metadata.
Usage and performance statistics: the website uses Cloudflare Web Analytics/RUM to display visits, page views and loading times. Geyser IC uses this to assess website performance, not to identify enquiry senders or associate advertising profiles with them. See the statistics section of the cookie notice.
Only attach information relevant to your enquiry that you are authorised to share. Avoid identity documents, health information and other unrelated personal data; redact unnecessary information about other people.
3. Purposes and legal bases
- Responding and preparing a quotation or service: steps requested before a contract or performance of a contract where you are a party to it (GDPR Article 6(1)(b)).
- Handling business contacts and enquiries on behalf of organisations: Geyser IC's legitimate interest in maintaining professional relationships with customers, prospective customers and their representatives (Article 6(1)(f)).
- Protecting the website and forms and diagnosing errors: our legitimate interest in service security and continuity, limited to what is necessary (Article 6(1)(f)).
- Legal obligations and protection of rights: applicable legal obligations (Article 6(1)(c)) and, for disputes, our legitimate interest in protecting legal rights (Article 6(1)(f)).
Technical statistics: where measurements involve personal data, the purpose is to understand and improve website use and performance, based on Geyser IC's legitimate interest (Article 6(1)(f)), with data minimisation and without advertising profiling.
Sending an enquiry does not subscribe you to newsletters or promotional campaigns. We do not require general mandatory consent to respond. We do not make solely automated decisions with legal or similarly significant effects. Anti-spam filtering protects the form; if it prevents submission, you can email us directly.
4. Providing data and sending attachments
A valid email address is required for direct submission. Attachments are optional; other fields describe your requirements and any mandatory fields are identified in the form. Insufficient technical information may require a follow-up. Without valid contact details, we may be unable to reply.
The form accepts up to 3 PDF, JPG/JPEG or PNG files, totalling 10 MB. When you submit, Cloudflare processes the fields and files and the website forwards them through Resend to info@geyser-ic.com, hosted by Aruba. Files are not published on the website or saved by the form in a public archive. Messages and attachments remain subject to email and delivery-service retention.
The form's application code does not write enquiry contents, files or anti-spam tokens to its logs. Providers may still process operational and security data. If you use the option that prepares an email draft, your email application and its provider handle sending.
5. Recipients and service providers
Data is accessible to people authorised by Geyser IC to handle your enquiry and to providers necessary for the service, according to their roles and agreements:
- Cloudflare: website hosting, form processing, content delivery and traffic protection.
- Cloudflare Turnstile: anti-spam verification using signals such as IP and browser and connection characteristics. Cloudflare acts as processor to protect this website and as controller to improve bot detection, as described in the Turnstile notice.
- Resend (Plus Five Five, Inc.): delivery of form emails and attachments; see its data processing agreement and privacy policy.
- Aruba: domain and business email services, including receipt and storage in mailboxes; see the Aruba privacy notice.
Advisers or authorities may receive information where necessary for legal obligations or the protection of rights. Personal data is not made public.
6. Transfers outside the European Economic Area
Cloudflare and Resend may process data outside the EEA, including in the United States. Resend's selected Ireland region controls email routing: account data, including metadata, logs and API records, is stored in the US, according to its region documentation.
Applicable provider agreements govern transfers and provide GDPR transfer mechanisms, including standard contractual clauses where applicable: Cloudflare DPA and Resend DPA. Contact Geyser IC for information or a copy of the relevant safeguards, subject to redaction of unrelated confidential information.
7. Retention
Enquiries and attachments: kept while the enquiry, clarifications and agreed work are being handled. Enquiries that do not become a commercial relationship are retained for 12 months after the enquiry is closed, then deleted or anonymised, unless specific legal obligations or documented protection of rights require retention. Irrelevant attachments are removed when identified. Closure means the end of handling the enquiry, not simply the date of the first email.
Contractual relationships: only necessary data continues to be used for the relationship and administration for periods required by applicable law. A dispute may require relevant data to be retained until it is resolved.
Resend delivery service: we use the Free plan, for which the provider specifies 30 days of email delivery data retention. This period applies to the sending service and does not erase messages already received in our business mailbox. Account data, billing data where applicable, and information needed for legal obligations or abuse prevention follow the provider's separate rules. See plan retention and the Resend privacy policy.
Aruba email: the Security Archive is not enabled. Messages in the spam folder are automatically deleted after 30 days. Received email and attachments instead follow the enquiry and contractual retention periods described above; Geyser IC manages their deletion. Deleting a message from the mailbox does not necessarily remove the provider's technical or backup copies immediately, as these follow service cycles and applicable obligations.
Security and technical data: the form does not create a persistent enquiry archive on the website or log enquiry contents. Any technical data processed by Cloudflare services is retained as needed for delivery, error diagnosis and abuse prevention, according to the features used; relevant incident data may be retained to investigate the incident and protect legal rights. Statistics and cookie periods are described in the cookie notice and differ from enquiry retention.
8. Rights and complaints
Where the GDPR provides, you may request access, rectification, erasure and restriction, and portability for automated processing based on contract or consent. You may object to processing based on legitimate interests on grounds relating to your situation. Where consent is the basis, you may withdraw it without affecting earlier processing.
Contact info@geyser-ic.com. We may request only the information needed to verify your identity. You may complain to the Italian Data Protection Authority or the competent authority in your EEA country.
9. Updates
We update this notice when our services or processing change. The revision date appears at the start of this page.