Privacy Policy.

1. Data controller

The data controller is Arcadia Company, with registered office at Piazza Don Mapelli 60, 20099 Sesto San Giovanni (MI) — VAT 09758380969.

• Email: info@arcadiacompany.it
• PEC: arcadiacompany@pec.it

No Data Protection Officer (DPO) has been appointed, as the conditions for mandatory designation under Article 37 GDPR are not met.

2. Types of data collected and purposes

2.1 Contact data (form)

First name, last name, email address, and phone number voluntarily provided through the contact form to request information or quotes for investigative and security services. Providing this information is optional, but failure to complete the mandatory fields makes it impossible to process the request.

2.2 Navigation data

Navigation metadata (visited pages, session duration, operating system, browser, approximate geographic location derived from IP address) collected via Google Analytics 4 for statistical and site‑optimization purposes. Precise user geolocation is not performed.

2.3 Data entered in the virtual assistant (chatbot)

User‑typed text in the AI‑based virtual assistance interface. Please note that:

• The conversations are transferred to the third‑party AI service Ollama (Ollama Inc., USA), the language‑model provider, acting as an external data processor under Article 28 GDPR. The transfer to the USA is based on the Standard Contractual Clauses (SCC) adopted by the European Commission. Ollama states that it does not retain or record conversation texts nor uses them to train its models.
• Arcadia Company does not retain conversation logs: the text remains in the browser’s memory for the duration of the session and is not written to any controller database.
• The system does not make automated decisions that produce legal effects on the data subject (Article 22 GDPR).

3. Legal basis for processing

• Article 6(1)(b) GDPR — Performance of pre‑contractual measures: to respond to requests submitted through the form.
• Article 6(1)(f) GDPR — Legitimate interest of the controller: for monitoring site security and technical improvement of the virtual assistance service.
• Article 6(1)(a) GDPR — Data subject’s consent: for the collection of analytical cookies via Google Analytics, given by accepting the cookie banner. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.

4. Transfer of data outside the EU

The following transfers to third countries are carried out based on the Standard Contractual Clauses (SCC) under Article 46(2)(c) GDPR or the EU‑USA Data Privacy Framework:

• Google Analytics 4 (Google LLC, USA) — navigation metadata and approximate geographic location.
• Ollama Inc. (USA) — texts entered in the chatbot, processed solely for generating a response. Ollama states that it does not retain or record conversation data nor uses it to train its models. See the Ollama Privacy Policy.

5. Retention period

• Contact form data: retained for the time necessary to handle the request, and in any case no longer than 24 months, unless a legal obligation requires otherwise.
• Navigation data (Google Analytics): 14 months according to GA4’s default configuration.
• Chatbot conversations: not retained by the controller. The chat session is deleted upon closing or reloading the page.

6. Data subject rights (Articles 15‑22 and 77 GDPR)

The data subject may exercise the following rights at any time:

• Access (Art. 15) — obtain confirmation and a copy of the processed data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — obtain removal of the data ("right to be forgotten").
• Restriction (Art. 18) — request temporary suspension of processing.
• Portability (Art. 20) — receive your data in a structured, machine‑readable format.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)) — withdraw consent at any time, without retroactive effect.

Requests should be sent to info@arcadiacompany.it. The controller will respond within 30 days (extendable by a further 60 days in case of complexity, per Art. 12(3) GDPR).

Note on chatbot conversations: because neither the controller nor Ollama retain the conversation texts, there are no data on which to exercise access, rectification or erasure rights related to such processing.

Right to lodge a complaint (Art. 77 GDPR)

The data subject has the right to lodge a complaint with the competent supervisory authority. In Italy:

7. Cookies

For detailed information on the cookies used by the site, their purpose and how to manage preferences, please refer to the Cookie Policy.