Privacy policy

1. Who is responsible for your data

The controller is Gitogi Srl, Piazza IV Novembre 4, 20124 Milano, Italy, VAT and tax identification number 14288420962 (Gitogi, we, us).

For privacy enquiries or to exercise your rights, contact info@gitogi.com or our certified email address, pec@pec.gitogi.com.

Gitogi has not appointed a data protection officer.

Last updated: 21 October 2026.

This English version is provided for convenience. If the language versions conflict, the Italian version prevails, without limiting your statutory rights.

2. Who this notice covers

This notice provides information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) for:

• visitors to www.gitogi.com, the Website;
• people contacting Gitogi through forms, email, telephone, messaging or professional platforms;
• users of Gitogi AI and newsletter subscribers;
• clients, prospective clients, suppliers, partners and their representatives;
• authorised Website administrators.

Section 3.7 also applies if you send an unsolicited job application.

This notice covers processing for which Gitogi determines the purposes and means. Where we process personal data on a client's behalf, Gitogi acts as a processor or, if the client is itself a processor for another controller, as a sub-processor. The controller is responsible for providing the notice for that processing, in accordance with the allocation of obligations within the processing chain. That relationship must be governed by the Data Processing Agreement and the instructions applicable to the project.

3. What we process, why and for how long

3.1 Website delivery and security

Delivering and protecting the Website involves processing request data such as IP addresses, browser and device details, requested pages, timestamps and request outcomes, together with error and performance information.

We rely on our legitimate interests in keeping the Website available and secure and preventing abuse, under Article 6(1)(f) GDPR.

Rate limiting uses identifiers pseudonymised through HMAC-SHA-256 with a secret key. These are neither anonymous data nor reversibly encrypted IP addresses. The control windows last no more than 24 hours.

Sentry receives error reports and performance traces regardless of your analytics consent. Before transmission, a filter applied to errors, transactions and breadcrumbs in both the browser and the server removes user data, email addresses including those encoded in URLs, and the values of the email, token and code parameters. The default inclusion of identifying information is disabled, and IP address filters also apply. The selected data region is in the EU. Session recording is a separate feature requiring the consent described in section 3.9.

Retention of hosting logs and providers' diagnostic data depends on service settings and the need to investigate and resolve faults or incidents. The 90-day retention period for chat conversations (section 3.3) does not apply to Sentry reports.

3.2 Contact requests

We process your name, email address, message and enquiry topic. We also process any optional information you choose to provide: your company name, role, phone number, current business software, company size and preferred timeframe for starting. The form also records the page you came from and any campaign parameters (utm) present in the page address. If you contact us through another channel, we process the information and content you provide.

We use these details to reply, arrange a meeting or prepare a proposal:

• if you act personally as a prospective contracting party, we rely on steps taken at your request before entering into a contract, Article 6(1)(b) GDPR;
• if you represent an organisation, or your enquiry has another purpose, we rely on our legitimate interests in handling enquiries and professional relationships, Article 6(1)(f) GDPR.

The mandatory checkbox records that you have read this notice. It is not consent to processing.

When you submit the form, the Website saves your request and a commercial contact record that also includes your enquiry topic, company size and the source of your enquiry. It also sends a confirmation to your email address, including a link to book a meeting, and a notification to info@gitogi.com. The contact-request table does not store your IP address. Your acknowledgement is recorded separately with its wording, date, pseudonymised IP fingerprint, browser information, document version and language.

Within the Website database:

• form requests are deleted 24 months from submission, regardless of status;
• commercial contact records are deleted after 24 months without activity, regardless of their stage.

These are separate records with separate retention periods, which continue to apply if you become a client. Section 3.6 covers contractual and accounting records; section 7 addresses email copies.

3.3 Gitogi AI

Gitogi AI is an artificial intelligence assistant. Its responses are generated automatically and may contain errors. The chat window always displays the notice “You are talking to an AI assistant, not a person” above the messages.

Before use, we request specific consent to process your messages under Article 6(1)(a) GDPR. You can withdraw consent in the chat or through Your consents. Withdrawal does not affect the lawfulness of earlier processing. Further use of the chat requires fresh consent. You can also contact us by form or email.

Data and operation

• We store your messages, generated responses, language and the page where you opened the chat. We do not add your IP address or browser information to the conversation.
• The models are Claude Sonnet, through AWS Bedrock using EU inference profiles, and alternatively Mistral Large, also through AWS Bedrock in the EU.
• Model execution is provided by Amazon Web Services EMEA SARL, Luxembourg. No direct APIs from other model providers are used. If neither model responds, the chat cannot provide an answer.
• Under the Bedrock service terms, AWS does not retain the content processed by the service or use it to train models. Gitogi separately stores conversations for the periods below.
• EU model execution does not mean that every infrastructure and email provider is European. See sections 5 and 6.

If you request contact from our team

The contact tool collects your name, email address, company, telephone number if supplied, requirements and service of interest. It creates or updates a commercial contact record and emails info@gitogi.com with those details and the last 12 conversation messages, each limited to 700 characters.

The phone number and description of your needs that you provide through the chat's callback feature are sent by email and stored in your commercial contact record. The record is deleted after 24 months of inactivity. If you type a telephone number in a message, that text remains in the stored conversation for the periods set out below.

The legal basis for the requested contact is Article 6(1)(b) GDPR if you act personally as a prospective contracting party. If you represent an organisation, it is our legitimate interest in responding to its request, Article 6(1)(f) GDPR.

Logs and security

A technical log records character and token counts, the model and processing layer, response times, tools invoked and a fingerprint of the system instructions. It does not contain message or response text. We rely on our legitimate interests in security and checking how the service operates.

Consent is recorded separately. A signed cookie, inaccessible to page scripts, remembers consent for 180 days.

Retention

• Conversations without a contact request: 90 days.
• Conversations linked to a contact request: for as long as the associated commercial contact record remains, subject to deletion after 24 months without activity.
• AI technical log: 5 years from the interaction. Chat consent records: throughout processing and for 5 years after it ends. Processing ends when you withdraw consent or 180 days after you give it, whichever comes first.

Withdrawal is recorded and deletes the chat consent cookie. In the current configuration, it does not delete conversations already stored: conversations without a contact request remain until automatic deletion after 90 days; those linked to a contact request remain for as long as the commercial contact record remains, subject to deletion after 24 months without activity. Records of your choices and the contact request processed on the legal basis stated above remain separate. You can exercise the rights described in section 9. The automatic deletion periods do not override erasure obligations under the GDPR.

Do not enter health information, other particularly sensitive data, other people's personal data or confidential information unnecessary for your enquiry.

3.4 Newsletter

We process your email address, language and subscription request, confirmation and consent information.

The purpose is to send Gitogi updates about business management systems, software and business uses of AI, including commercial content. We rely on consent under Article 6(1)(a) GDPR and Article 130 of the Italian Privacy Code.

Subscription requires email confirmation:

• the confirmation link expires after 24 hours;
• unconfirmed requests are deleted after 7 days;
• active subscriptions remain until you unsubscribe;
• unsubscribed addresses are deleted 3 months after you unsubscribe;
• addresses marked as undeliverable are deleted after 3 months.

We retain evidence of your consent and any withdrawal throughout processing, then for 5 years after you unsubscribe or withdraw consent.

No newsletters have been sent as at this notice's update date. The email delivery service's open and click tracking features are disabled. You can unsubscribe through the link in the welcome email or through Your consents.

3.5 Consent to commercial emails

The contact form has a separate, optional checkbox for Gitogi commercial emails. Declining does not prevent you from submitting your enquiry or affect our response.

The legal basis is consent under Article 6(1)(a) GDPR and Article 130 of the Italian Privacy Code. At the update date, the Website records this choice, but no commercial email sending system is operational.

You can withdraw consent through Your consents or by emailing info@gitogi.com. Contact details follow the retention periods of their respective records. We keep evidence of your choice throughout processing and for 5 years after it ends. This record documents your choice and is not a mailing list.

3.6 Clients, prospective clients, suppliers and partners

Our business activities involve identification and contact details, professional roles, proposals, contracts, invoices, payment information, correspondence and documents needed for projects and business relationships.

The purposes and legal bases are:

• proposals, contracts and support: Article 6(1)(b) GDPR where you are personally a party to the relationship;
• dealings with organisational representatives and operational administration: our legitimate interests in conducting and organising our business, Article 6(1)(f) GDPR;
• tax and accounting compliance: legal obligations, Article 6(1)(c) GDPR;
• establishing, exercising or defending legal claims: legitimate interests, Article 6(1)(f) GDPR.

We use Odoo for clients, proposals and invoices and engage an external accountant. We use Google Workspace email, Google Meet and WhatsApp, and join Microsoft Teams meetings when invited by a client.

Operational data is retained in relation to outstanding work and the business relationship. Accounting records and correspondence covered by Article 2220 of the Italian Civil Code must be retained for 10 years, calculated as required by that provision. Tax obligations or disputes may require longer retention. This period does not apply indiscriminately to every project document, credential or contact.

Retention for legal claims depends on the particular right, its limitation period and any dispute. The ordinary ten-year limitation period does not, by itself, justify retaining all data in full.

The Website's automatic deletion periods do not describe retention in Odoo, email accounts or the accountant's records.

3.7 Unsolicited job applications

If you send an application, we process your CV and related communications to assess it and manage necessary contact, as steps taken at your request before entering into a contract, Article 6(1)(b) GDPR.

Within the scope of Article 111-bis of the Italian Privacy Code, consent is not required for processing information contained in unsolicited CVs. The relevant notice must be provided at the first appropriate opportunity to contact you after submission.

Retention must be proportionate to the assessment. Keeping an application for later recruitment requires specific information about that purpose and its duration. Do not send unnecessary sensitive information.

3.8 Spam prevention

The Website uses Google reCAPTCHA v3:

• on contact and newsletter forms, it loads when you interact with the form, including by pointing at it, touching it or moving keyboard focus to it;
• on administrator sign-in pages, it loads immediately.

The service processes information such as IP addresses, browser and device characteristics and interactions to prevent automated requests and abuse. We rely on our legitimate interests in security, Article 6(1)(f) GDPR.

Device storage and access are separately governed by Article 122 of the Italian Privacy Code. Legitimate interests do not replace any consent required under that provision. See the Cookie policy.

3.9 Analytics and session recording

Consent to the “Analytics” category enables:

• Google Analytics 4, for navigation statistics;
• PostHog EU Cloud, for page views, interactions and usage paths, with possible session recording and masked input fields;
• Sentry Session Replay, to understand Website use and faults, with text, fields and media masked.

These tools may process pseudonymous browser identifiers, technical information and browsing activity. Masking does not make all collected data anonymous.

We rely on consent under Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code. You can change or withdraw it through “Manage cookies” at the bottom of the pages. When you reject analytics or withdraw consent to them, the Website deletes _ga* and ph_* cookies and the ph_* and sentryReplaySession storage keys from your browser. This does not automatically delete data already received by providers. The Cookie policy describes browser storage periods, which are separate from retention on providers' servers.

3.10 Rights requests and records of choices

For data rights requests, we process your email address, verification information and the details needed to handle your request. Email verification codes are valid for 10 minutes.

Handling requests is a legal obligation under Article 6(1)(c) GDPR. Recording consent supports the obligations in Articles 5(2) and 7(1). Retaining relevant evidence for disputes serves our legitimate interests in protecting legal rights, Article 6(1)(f).

Consent logs retain evidence of consent and withdrawal throughout processing and for 5 years after it ends. Withdrawing consent ends processing for any purpose. Analytics processing also ends when your choice expires after six months and the banner asks you to choose again. For contact requests, processing also ends when the request's retention period expires (24 months), or, if it has become a commercial negotiation, when that retention period expires (24 months without activity). Completed deletion requests are kept for 5 years from completion. Cookie choices are also recorded on the server, without a copy of the banner wording.

Gitogi chose 5 years so it can provide evidence of consent if the processing is challenged. The GDPR does not impose this as a general retention period.

3.11 External platforms and social pages

The Website links to Google Calendar for booking calls, WhatsApp, LinkedIn, X, Instagram and YouTube. These pages are not embedded. Following a link also brings the destination platform's terms and privacy notice into play.

For Page Insights relating to our LinkedIn company page, Gitogi and LinkedIn Ireland Unlimited Company are joint controllers within the scope of that service. The joint controller addendum allocates responsibilities, including LinkedIn's operational obligations and handling of requests concerning Insights data. You may nevertheless exercise your rights against Gitogi.

For other processing, the platform's role depends on the service and applicable contract. Client-organised Teams meetings also involve the client's settings and privacy notice.

3.12 Restricted administration area

The restricted area is exclusively for authorised administrators. There is no public registration.

Account data, credentials and access verification information are processed to administer the Website and prevent unauthorised access, based on Gitogi's legitimate interests under Article 6(1)(f) GDPR.

Access uses a password or a single-use link, mandatory multi-factor authentication and logout after 30 minutes of inactivity. A cookie's lifetime does not equal the usable session duration. Account data is needed while authorisation continues; any subsequent records must be limited to security or legal requirements.

We record every action taken in the restricted area in the administrator activity log, which contains the administrator's email address, the action, the type and identifier of the item concerned, some details of the action and a pseudonymised fingerprint of the IP address. When the action involves carrying out a deletion request, the details also include the email address of the person who submitted it. The log allows us to demonstrate who did what with the data, including in relation to requests to exercise rights. We retain each entry for 5 years from the recorded action.

4. Sources of data and whether provision is required

Data mainly comes from you and your use of the services described above.

Where an organisation or another business contact supplies a representative's details, these may include name, role, business contact details and relevant business information. The notice must be provided within one month of collection and, if earlier, at the first communication or first disclosure to another recipient, subject to Article 14 GDPR exceptions. You can ask us where your data came from.

To submit the contact form, you must provide your name, email address, message and enquiry topic. You must also confirm that you have read this notice. Your company name, role, phone number, current business software, company size and preferred timeframe for starting are optional. Commercial consent remains optional.

Chat, newsletter and analytics are optional. Refusal does not prevent public Website browsing or contacting us by email.

Contractual relationships require the data relevant to administration and legal compliance. Without it, we may be unable to prepare a proposal, perform the contract or issue required documents.

5. Who receives data

Depending on the service, data may be available to:

• people authorised to act for Gitogi;
• hosting, database, authentication, email, security, analytics, AI and business software providers;
• our accountant, other advisers involved in the relationship, external collaborators and partner companies;
• authorities and other recipients where disclosure is legally required.

Roles follow the actual activity. A provider processing on Gitogi's behalf must be bound by an Article 28 GDPR agreement. A recipient independently determining purposes and means acts as a separate controller. External professionals and collaborators do not automatically share the same role.

The provider register describes services and available location and transfer information. Listing a provider does not, by itself, authorise its use for a client's data.

6. Transfers outside the European Economic Area

EU server location does not exclude transfers or access from third countries.

The service chain includes companies in the United States and Singapore. Upstash uses a London database. Resend's main processing takes place in the United States despite the sending domain being configured in Ireland. Until the transition announced by Odoo is complete, Odoo Cloud may keep an additional backup in Canada.

The safeguards identified for providers include:

• European Commission adequacy decisions, within their respective scope;
• the EU-U.S. Data Privacy Framework, where the recipient's certification covers the transfer;
• European Commission standard contractual clauses, with the necessary assessments and supplementary measures where required.

These mechanisms do not all apply simultaneously to every transfer. The Providers and sub-processors page identifies the relevant mechanisms and information that depends on a contract or configuration.

You can request information and copies of applicable safeguards from info@gitogi.com. Unnecessary confidential information may be redacted.

7. Retention summary and limits of automatic deletion

The database deletion process runs daily. Expired records are handled by the next run.

Notification emails and conversation extracts sent for contact requests are separate copies. Deletion from the Website database does not establish deletion from email accounts, Odoo or other recipients' records.

Only the provider's automatic backups are enabled for the Website database; no additional external backup is active. The plan and its retention cycle have not been verified. Deletion from the operational database does not entail simultaneous deletion of backup copies.

Legal obligations or a concrete need to protect a legal right may justify retaining relevant data beyond the ordinary periods for as long as that purpose requires.

8. Security

Website measures include administrator access controls, multi-factor authentication, request limits, filters against misuse of the chat and pseudonymised identifiers for rate limits and logs.

The consent log, AI technical log and administrator activity log allow only new entries to be added. Database protections prevent changes to existing entries. We delete entries in all three logs when their respective retention periods expire. For each deleted entry, only a cryptographic receipt remains: an identifier and a hash, with no personal data. The receipt keeps the hash chain verifiable, and we check its integrity daily. No entry can be deleted without a receipt or before 5 years have passed since it was written. These controls do not restrict your GDPR rights.

See Security measures for further information.

9. Your rights

Subject to the GDPR's conditions, you may:

• access your data and obtain a copy;
• request rectification, erasure or restriction;
• obtain data you supplied in a structured format and request transmission to another controller where automated processing relies on consent or contract;
• object on grounds relating to your situation to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent without affecting the lawfulness of earlier processing.

You can use:

• Your data, to export JSON or delete email-linked contact requests, commercial contact records, newsletter data and conversations linked to contact requests;
• Your consents, to manage the available choices;
• “Manage cookies”, for analytics consent;
• info@gitogi.com or pec@pec.gitogi.com, including for data outside the self-service tools.

The self-service pages verify your email with a code valid for 10 minutes. For other requests, we may seek additional information only where needed to verify identity.

Conversations without contact requests are not linked to a verified identity. If we cannot identify the relevant data, Article 11 GDPR applies: we need not collect additional information solely to identify you, but will consider identifying information you choose to supply.

We respond without undue delay and normally within one month of receipt. Where the GDPR permits, this may be extended by two months; we will explain the extension within the first month. Exercising your rights is normally free.

You may complain to the Italian Data Protection Authority or another competent supervisory authority, particularly in the Member State where you habitually reside or work, or where the alleged infringement occurred. You also have the right to a judicial remedy.

10. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Gitogi AI does not score people or decide the outcome of commercial enquiries. Abuse prevention controls may block technical requests. If you experience difficulties, email info@gitogi.com.

11. Professional audience

Gitogi's services are directed at businesses and professionals. This does not exclude the rights of individuals visiting the Website or contacting us.

12. Updates

The date above identifies this version. Updating a notice does not, by itself, amount to fresh consent.

Where a changed purpose or another condition requires new consent, it must be obtained before that processing starts. Information required by the GDPR must be provided before data is used for a new purpose.