Privacy Policy.

1. Data controller

The data controller is Arcadia Company S.r.l., with registered office at Piazza Don Enrico Mapelli, 60 - 20099 Sesto San Giovanni (MI) - VAT 09758380969.

• Email: info@arcadiacompany.it
• PEC: arcadiacompany@pec.it

No Data Protection Officer (DPO) has been appointed, as the conditions for mandatory designation under Article 37 GDPR are not met.

2. Types of data collected and purposes

2.1 Contact data (form)

First name and last name, email address, phone number, city, type of request and message text voluntarily provided through the contact form to request information or quotes for investigative and security services. Providing this information is optional, but failure to complete the mandatory fields makes it impossible to process the request. The message is a free-text field: please do not include data about third parties, special categories of data (for example health data) or judicial data unless strictly necessary to describe the request; details can be discussed in the confidential consultation.

2.2 Navigation and interaction data

If the user consents to analytics cookies, Google Analytics 4 collects navigation metadata (visited pages, session duration, operating system, browser, approximate geographic location) for statistical and site‑optimization purposes; GA4 does not log or store IP addresses and does not perform precise user geolocation. If the user consents to behavioural cookies, Microsoft Clarity collects interaction data on the pages (clicks, scrolling, pointer movements) and session recordings, in which the provider masks the text typed into form fields, in order to analyse and improve the usability of the site. Neither tool is loaded before consent is given.

2.3 Data entered in the virtual assistant (chatbot)

User‑typed text in the AI‑based virtual assistance interface. Please note that:

• The conversations are transferred to the third‑party AI service Anthropic (Anthropic PBC, USA), the language‑model provider, acting as an external data processor under Article 28 GDPR. The transfer to the USA is based on the Standard Contractual Clauses (SCC) adopted by the European Commission. Anthropic states that it does not use data received through its API to train its models and retains it only for a limited period.
• Arcadia Company does not retain conversation logs: the text remains in the browser’s memory for the duration of the session and is not written to any controller database. If the user asks to be contacted and explicitly confirms the summary of their details, the assistant sends the controller their name, email, phone number (if provided), type of request and a summary of the request: these data are processed in the same way as those from the contact form (section 2.1).
• The system does not make automated decisions that produce legal effects on the data subject (Article 22 GDPR).

2.4 Data for advertising conversion measurement

If the user provides consent to marketing cookies, the controller measures through Google Ads the conversions originating from its own advertising campaigns (submission of the contact form and clicks on the phone number). To increase measurement accuracy, the Enhanced Conversions feature is active: the email address and phone number possibly entered in the form are turned into a cryptographic fingerprint with the algorithm SHA-256 directly in the user’s browser and transmitted to Google already in pseudonymised form (irreversible hash: it is nonetheless pseudonymous data, not anonymous data). The plaintext data never leaves the device, and Google uses it solely to match conversions, not for profiling purposes.

2.5 Job applications (Careers page)

Applicants who apply through the Careers page provide their first name, last name, email address, phone number (optional), position of interest, availability of their own car, an optional message and an attached curriculum vitae. Any indication of membership of protected categories (Law 68/1999) is health-related data, one of the special categories of data under Article 9 GDPR: it is processed, pursuant to Article 9(2)(b) GDPR, solely for compliance with mandatory employment obligations. The data are used to assess the application (Article 6(1)(b) GDPR), are accessible only to the staff in charge of recruitment and are retained for up to 12 months from receipt, unless the applicant consents to a longer period. Please do not include in your CV any data not relevant to the application.

2.6 Technical data and IP address

The systems hosting the site process the technical data needed to serve and protect the pages (IP address, date and time, requested resource, browser type). The IP address from which the contact form, job applications, requests through the virtual assistant and quote calculator estimates are sent is also used to limit abusive submissions: for this purpose it is kept in the server’s memory for no longer than 1 hour. The same address is included, for security purposes, in the notification email the controller receives together with the request data. The quote calculator sends the controller only the chosen configuration and the municipality indicated, with no contact details.

3. Legal basis for processing

• Article 6(1)(b) GDPR - Performance of pre‑contractual measures: to respond to requests submitted through the form.
• Article 6(1)(f) GDPR - Legitimate interest of the controller: for monitoring site security, preventing abusive form submissions (by means of the IP address) and technical improvement of the virtual assistance service.
• Article 6(1)(a) GDPR - Data subject’s consent: for analytics cookies (Google Analytics) and behavioural cookies (Microsoft Clarity), given by accepting the cookie banner. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Article 6(1)(a) GDPR - Data subject’s consent: for marketing cookies and conversion measurement via Google Ads (including Enhanced Conversions), given by accepting the cookie banner and revocable at any time.
• Article 6(1)(b) and Article 9(2)(b) GDPR - Job applications: pre‑contractual measures taken at the applicant’s request to assess their profile; any membership of protected categories is processed solely to fulfil mandatory employment obligations (Law 68/1999).

4. Transfer of data outside the EU

The following transfers to third countries are carried out based on the Standard Contractual Clauses (SCC) under Article 46(2)(c) GDPR or the EU‑USA Data Privacy Framework:

• Google Analytics 4 (Google LLC, USA) - navigation metadata and approximate geographic location.
• Google Ads (Google Ireland Ltd. / Google LLC, USA) - conversion data and, for Enhanced Conversions, email and phone number in pseudonymised form (SHA-256 hash) solely for conversion matching.
• Microsoft Clarity (Microsoft Corporation, USA) - interaction data and session recordings, only with prior consent to behavioural cookies. Microsoft participates in the EU‑US Data Privacy Framework.
• Anthropic PBC (USA) - texts entered in the chatbot, processed solely for generating a response. Anthropic states that it does not use data received through its API to train its models and retains it only for a limited period. See the Anthropic Privacy Policy.

5. Retention period

• Contact form data: retained for the time necessary to handle the request, and in any case no longer than 24 months, unless a legal obligation requires otherwise.
• Navigation data (Google Analytics): for the period set in the Google Analytics property (no more than 14 months).
• Chatbot conversations: not retained by the controller. The chat session is deleted upon closing or reloading the page.
• Interaction data (Microsoft Clarity): retained by the provider according to its own policies; in the browser the _clck cookie lasts up to 1 year and _clsk 1 day.
• Job applications: up to 12 months from receipt, unless the applicant consents to a longer period.
• IP address for abuse prevention: kept in the server’s memory for no longer than 1 hour; the IP included in notification emails follows the retention period of the request it relates to.

6. Data subject rights (Articles 15‑22 and 77 GDPR)

The data subject may exercise the following rights at any time:

• Access (Art. 15) - obtain confirmation and a copy of the processed data.
• Rectification (Art. 16) - correct inaccurate or incomplete data.
• Erasure (Art. 17) - obtain removal of the data ("right to be forgotten").
• Restriction (Art. 18) - request temporary suspension of processing.
• Portability (Art. 20) - receive your data in a structured, machine‑readable format.
• Objection (Art. 21) - object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)) - withdraw consent at any time, without retroactive effect.

Requests should be sent to info@arcadiacompany.it. The controller will respond within 30 days (extendable by a further 60 days in case of complexity, per Art. 12(3) GDPR).

Note on chatbot conversations: the controller does not retain the conversation texts and therefore holds no data on which to exercise access, rectification or erasure rights. Anthropic, as processor, retains them for a limited period under its own privacy policy. Any request concerning such data may be sent to the controller, who will forward it to the provider.

Right to lodge a complaint (Art. 77 GDPR)

The data subject has the right to lodge a complaint with the competent supervisory authority. In Italy:

7. Cookies

For detailed information on the cookies used by the site, their purpose and how to manage preferences, please refer to the Cookie Policy.

8. Recipients and data processors

Data are processed by Arcadia Company staff authorised and instructed under Article 29 GDPR and may be disclosed, solely for the purposes described, to: the site’s hosting provider, with servers in the European Union; the email (SMTP) service provider through which requests sent via the forms are delivered; Google, Microsoft and Anthropic for the services described in sections 2 and 4. These parties act as data processors under Article 28 GDPR or, where provided for by their respective terms of service, as independent controllers. Data are not disseminated or transferred to third parties for commercial purposes.

9. Persons subject to checks on behalf of clients

In carrying out investigative assignments authorised under art. 134 TULPS, Arcadia Company processes personal data of persons other than its clients, collected from lawful sources, in order to establish, exercise or defend a legal claim or to carry out defensive investigations. This processing complies with the Code of Conduct for the processing of personal data carried out for defensive investigations or to establish, exercise or defend a legal claim (decision of the Italian Data Protection Authority of 19 December 2018), limited to the data and time necessary for the assignment. Information to these data subjects may be omitted or deferred in the cases provided for by Article 14(5) GDPR, in particular where it would render impossible or seriously impair the achievement of the purposes of the assignment; the exercise of their rights may be restricted in the cases provided for by Article 2-undecies of Legislative Decree 196/2003.