Opens in a new tab

PRIVACY POLICY

Last update: 18 October 2026

This information describes how AvoFlow S.r.l.s. processes personal data collected through the website www.avoflow.it and in particular through the contact form on the site, pursuant to Regulation (EU) 2016/679 (“GDPR”).

1. DATA CONTROLLER

The Data Controller is:

AvoFlow S.r.l.s.
Viale Monte Nero 82, 20135 Milan (MI)
VAT number 14732030961
Email: ciao@avoflow.it

For any request relating to the processing of your personal data you can write to the email address indicated above.

2. TYPES OF DATA COLLECTED

Through the contact form we collect the following personal data that you voluntarily provide to us:

  • Name and surname
  • E-mail address
  • Name of the company or project
  • Content of the message that you write freely in the “What would you like to work on?” field.

We also collect, through analysis and tracking tools (only if you consent to cookies), navigation data such as pages visited, origin of the visit, device and IP address, in aggregate or pseudonymized form. If you fill out the contact form after agreeing to tracking, this navigation data can be linked to the form data in our CRM (see points 3.2 and 6).

3. PURPOSE OF THE PROCESSING AND LEGAL BASIS

3.1 Respond to your request and organize the information call

We use the data you provide us to contact you, organize the 30-minute call and evaluate a possible collaboration.

Legal basis: execution of pre-contractual measures adopted at your request (art. 6.1.b GDPR). Your specific consent is not required for this purpose, because you are actively requesting commercial contact.

We also store your contact in our CRM (HubSpot) to manage your request, keep track of our conversations and get back to you about the same enquiry.

Legal basis: legitimate interest of the Data Controller to manage the commercial requests received in an orderly manner (art. 6.1.f GDPR). You can object at any time by writing to ciao@avoflow.it (art. 21 GDPR).

3.2 Analysis, tracking and improvement of the site

We use analysis and tracking tools (Google Analytics, Amplitude and HubSpot) to understand how the site is used, improve its functioning and content and, with HubSpot, connect visits to the site to contacts who write to us.

HubSpot installs some tracking cookies in your browser (__hstc, hubspotutk, __hssc and __hssrc) which record a device identifier, the pages visited, the origin of the visit and the IP address. If you fill out the contact form after consenting, the identifier (hubspotutk cookie) is sent to HubSpot together with the form data, so that your visit history is associated with your contact. If you do not agree, the HubSpot script is not loaded, no cookies are installed, and the form still works, but without any connection to your visits.

Legal basis: consent (art. 6.1.a GDPR and art. 122 of the Privacy Code), collected through the cookie banner upon first access to the site. HubSpot falls into the Marketing category. These tools are only active if you accept the corresponding cookie categories and you can revoke your consent at any time from the cookie preferences.

3.3 Commercial communications and newsletter (if activated in the future)

If in the future we decide to use your contact also to send newsletters or commercial communications relating to our services, this will only happen subject to your explicit and separate consent, collected via a specific optional checkbox when sending the form (or at a later time, with a new request for consent).

Legal basis: consent (art. 6.1.a GDPR). You can revoke your consent at any time, for example via the unsubscribe link present in each communication, without this affecting the lawfulness of the processing carried out before the revocation.

3.4 Technical monitoring of the site

To detect and correct malfunctions we use Sentry (Functional Software, Inc.), an error monitoring service whose data is hosted in Germany (EU). When a technical error occurs on the site's server, a report is sent to Sentry with the type of error, the address of the requested page, date and time and the version of the site's software. As a rule, no visitor IP addresses, cookies or login data are sent, and this server-side component does not install anything on the user's device. Legal basis: legitimate interest of the Data Controller in the security and correct functioning of the site (art. 6.1.f GDPR). Reports are kept for 90 days. Sentry acts as data processor (art. 28 GDPR); since the company is based in the United States, any transfers take place on the basis of the Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

Component in the browser (only with consent). If you consent to statistical cookies via the banner, your browser also loads a Sentry script, served by the site itself, which reports JavaScript errors, measures page loading times and can record the browsing session (“Session Replay”) to reproduce an error. During recording, all texts and form fields are masked and images and multimedia content are not recorded; the access area is excluded. To connect the events of the same visit, Sentry uses the browser session memory (sessionStorage, “sentryReplaySession” item), which is deleted when the tab is closed; no cookies are installed. Legal basis: consent (art. 6.1.a GDPR and art. 122 Privacy Code), revocable at any time from the cookie preferences: without consent the script is not loaded. The data is hosted in Germany (EU), stored for 90 days and processed by Sentry as data processor (art. 28 GDPR), with the transfer guarantees indicated above. The IP address is not stored.

4. PROVISION OF DATA

Providing the data marked as mandatory in the form (name, surname, email, company or project) is necessary to be able to respond to your request: without this data we cannot contact you again. Providing the message is optional and failure to include it does not affect the possibility of being contacted, but could limit the quality of the response we can give you.

5. METHODS OF TREATMENT

The data is processed using IT and telematic tools, with logic strictly related to the purposes indicated above and, in any case, in such a way as to guarantee its security and confidentiality. We adopt appropriate technical and organizational measures to prevent unauthorized access, loss or dissemination of data.

6. RECIPIENTS OF THE DATA AND THIRD PARTY SUPPLIERS

Your data may be communicated, for the purposes described above, to the following parties, who act as data processors or independent controllers:

  • HubSpot (HubSpot, Inc.): CRM used to store and manage the contacts received through the form, and platform for tracking visits to the site (see point 3.2). Acts as data processor (art. 28 GDPR); our account data is hosted in the United States.
  • Google Analytics (Google Ireland Ltd.): used for statistical analysis of the use of the site.
  • Amplitude: used for analysis of user behavior on the site.
  • Sentry (Functional Software, Inc.): used for technical monitoring of site errors (see point 3.4).

These suppliers may also be based or process data outside the European Economic Area (in particular in the United States). In such cases, the transfer takes place on the basis of adequate guarantees provided by the GDPR, such as the Standard Contractual Clauses (SCCs) approved by the European Commission, or other recognized adequacy mechanisms. You can request more information on these guarantees by writing to ciao@avoflow.it.

We do not sell or rent your data to third parties for the third parties' own commercial purposes.

7. STORAGE PERIOD

– The data collected through the contact form are kept for the time necessary to manage the request and any commercial negotiation, and in any case no later than 24 months from the last contact, unless a contractual relationship is established, in which case the retention terms established by tax and civil legislation apply. The same goes for data stored in HubSpot CRM.

– Browsing data collected through HubSpot tracking is stored in the CRM along with the contact it is associated with, for the same 24-month period from the last contact. HubSpot tracking cookies last approximately 6 months (__hstc and hubspotutk), 30 minutes (__hssc) or session (__hssrc).

– The analysis data collected through Google Analytics and Amplitude are stored according to the retention settings configured on these platforms (approximately 14 months for Google Analytics, unless otherwise configured).

– Technical error monitoring reports collected via Sentry are retained for 90 days.

8. YOUR RIGHTS

As an interested party, you have the right to:

– access your personal data (art. 15 GDPR);

– obtain the rectification of inaccurate data (art. 16 GDPR);

– obtain the deletion of data, in the cases provided for (art. 17 GDPR);

– obtain the limitation of processing (art. 18 GDPR);

– obtain data portability (art. 20 GDPR);

– object to the processing (art. 21 GDPR);

– revoke consent at any time, without prejudice to the lawfulness of the processing carried out before the revocation;

– lodge a complaint with the Guarantor for the Protection of Personal Data (www.garanteprivacy.it), if you believe that the processing violates the GDPR.

To exercise these rights you can write to: ciao@avoflow.it

9. MINORS

The site and the contact form are not aimed at children under 16 years of age. We do not knowingly collect data from minors.

10. COOKIES

For detailed information on the cookies and tracking tools used on the site, please see our Cookie Policy.

11. CHANGES TO THIS INFORMATION

This information may be updated periodically, for example in the event of regulatory changes or new tools/suppliers adopted. We invite you to consult it periodically. The date of last update is indicated at the top of the document.