Privacy notice on the processing of personal data

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

Website: www.rayergroup.it (and the domain www.rayergroup.com, which automatically redirects to it)
Version: 1.7 | Last updated: 12 November 2026

1. Data Controller

The data controller of the personal data collected through the website www.rayergroup.it (and the domain www.rayergroup.com, which automatically redirects to it) is:

Riccardo Rocchi, a self-employed professional trading under the brand "RAYER Group"
Via San Francesco d'Assisi 100 — 00035 Olevano Romano (RM)
VAT number: IT18343201002
Email: info@rayergroup.com

For any request concerning the processing of personal data, you can contact the Controller at the email address given above.

Data Protection Officer (DPO). The Controller has not appointed a Data Protection Officer, as it does not fall within the cases set out in Art. 37, para. 1 GDPR (core activities not consisting of large-scale systematic processing or of large-scale processing of special categories of data).

2. Types of Personal Data Processed

2.1 Browsing data

The computer systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server and other parameters relating to the user's operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the website and to check that it is working correctly.

2.2 Data provided voluntarily by the user

The Controller collects the personal data that users voluntarily provide through the features available on the website. In particular:

• Requesting a call via the “Let's talk” form: by filling in the form on the /parliamo page, the user provides first name, surname, email address, role, service of interest, a short description of their case and, optionally, telephone number and the name of their company or project. The date and time of submission, the page of origin and the choice made in the optional checkbox concerning promotional communications are also recorded, together with the exact text of the checkbox, as proof of consent. After submission, the user is directed to the booking calendar, where they choose the day and time of the appointment and enter the data requested by the scheduling system.
• Newsletter subscription (where active): first name, surname and email address provided by the user through the subscription form on the website.
• Direct communications: first name, surname, email address and any further information the user chooses to share when contacting the Controller directly.

2.3 Data collected through cookies and tracking tools

The site uses one technical cookie (rx_consenso), which remembers the choice you made on the banner, and two marketing tools that are activated only if you accept: the Meta Pixel and the LinkedIn Insight Tag. Until you choose, and if you decline, these tools are not loaded and receive no data. If you accept, the cookies and data processed are described in the Cookie Policy.

The site also measures visits in aggregate form with Cloudflare Web Analytics, without cookies.

Record of choices. When you choose on the banner (“Accept” or “Decline”) or change your choice from “Cookie preferences”, the site sends the Controller a record so that the choice made can be demonstrated: a random identifier (the same one as in the technical cookie), date and time, the choice, the versions of the banner and of the policies, the address of the page without parameters, the language of the page, the type of device (phone or computer) and the country of origin, obtained from the Cloudflare network. The Controller does not store your IP address and does not link you to a name or an email address.

2.4 Data of minors

The website is intended exclusively for users of legal age. The Controller does not knowingly collect personal data from persons under 18 years of age. Should the Controller become aware that data of minors have been collected without the consent of a parent or legal guardian, it will delete them immediately.

2.5 Data for the protection of the form

To protect the request form from automated submissions, the website uses the Cloudflare Turnstile service, which verifies that the submission comes from a person and not from an automated program. For this purpose, the service processes the IP address, certain characteristics of the browser and device, and signals of interaction with the page. The Controller receives only the outcome of the verification and does not use these data for profiling or advertising purposes.

3. Purposes and Legal Bases of Processing

Users' personal data are processed for the following purposes, each supported by an appropriate legal basis pursuant to Art. 6 GDPR:

3.1 Provision of the requested services

The Controller processes the data provided by the user in order to respond to requests for information, manage call bookings and provide the consultancy services requested.

Legal basis: performance of pre-contractual measures taken at the request of the data subject (Art. 6.1.b GDPR).

To prepare the call, the Controller may use a generative artificial intelligence assistant (Claude, provided by Anthropic), to which it submits the data sent through the form in order to organise them and identify the topics to be explored further. The assistant does not take decisions about the user: the outcome of the request and the content of the call remain decided by the Controller.

3.2 Sending of newsletters and commercial communications

Where the user has given specific consent, the Controller processes contact data in order to send informational and promotional communications concerning funding calls, incentives, regulatory news and services offered by RAYER Group.

Legal basis: consent of the data subject (Art. 6.1.a GDPR). Consent can always be withdrawn, without prejudice to communications previously received.

For those using the “Let's talk” form, consent is given by ticking the specific optional checkbox, which in no way affects the possibility of booking the call (Art. 130 of Italian Legislative Decree 196/2003).

3.3 Statistical analysis of traffic and website improvement

The Controller analyses browsing data and uses, or may in future use, web analytics tools to understand how users interact with the website and to improve its content and usability.

Legal basis: consent of the data subject (Art. 6.1.a GDPR) for tools that use non-essential cookies, or legitimate interest of the Controller (Art. 6.1.f GDPR) for aggregated and anonymous statistics that do not allow the user to be identified.

3.4 Digital marketing and retargeting activities

With your explicit consent, the site loads the Meta Pixel and the LinkedIn Insight Tag, described in section 3.8, to measure Rayer Group’s advertising on Facebook, Instagram and LinkedIn and to show our ads to people who have visited the site.

Legal basis: consent of the data subject (Art. 6.1.a GDPR).

3.5 Legal obligations

The Controller may process users' data in order to comply with legal, regulatory or tax obligations, or in execution of orders from competent public authorities.

Legal basis: legal obligation (Art. 6.1.c GDPR).

3.6 No automated decision-making

The Controller declares that it does not carry out, through the data collected on the site, fully automated decision-making that produces legal effects or similarly significantly affects the data subject, nor profiling on its own initiative within the meaning of Art. 22 GDPR (if you accept marketing cookies, Meta and LinkedIn may instead use the data they receive to measure and show advertising, as described in section 3.8). Should such processing be introduced in the future, the user will be informed by an update of this notice and, where required, through a specific request for consent.

On the use of artificial intelligence in Rayer Group's content and services — role, risk class, human oversight and editorial responsibility — the reference page is AI transparency.

3.7 “G.A.P.” web audit and security scan (Compromise Scan)

From 7 November 2026, the G.A.P. audit and the security scan are requested on the Digitalizziamo.online website, with the same data controller: how the data are processed is set out in the privacy notice of that website. The old addresses rayergroup.it/gap and rayergroup.it/scan lead there. For requests sent from this website before that date, the purposes, legal bases and retention periods set out in version 1.5 of this notice remain valid; you can request it at info@rayergroup.com.

3.8 Advertising and measurement with Meta and LinkedIn (only with consent)

If you accept marketing cookies, the Meta Pixel and the LinkedIn Insight Tag are loaded in your browser and send Meta and LinkedIn information about your visit: for example the page visited, the referring site, the type of browser and device, the screen size, a browser identifier and your IP address. They serve to measure the effectiveness of Rayer Group’s advertising on Facebook, Instagram and LinkedIn and to show our ads to people who have visited the site. The tools are configured to send only page views: the Controller does not send Meta or LinkedIn the data you enter in the forms.

Legal basis: consent (Art. 6.1.a GDPR and Art. 122 of the Italian Personal Data Protection Code), optional and revocable at any time from “Cookie preferences”, at the bottom of every page, with no consequences for your use of the site. Withdrawal does not affect the earlier processing. For the processing of the data they receive, Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company refer to their own notices: Meta’s notice, LinkedIn’s notice.

3.9 Record of cookie choices

The Controller keeps the record of the choices made on the banner (data in section 2.3) in order to be able to demonstrate, if necessary, when and how you accepted or declined marketing cookies. Legal basis: the Controller’s obligation to be able to demonstrate consent (Art. 7(1) GDPR; Art. 6.1.c GDPR). Retention: 25 months from the record, then automatic deletion.

4. Methods of Processing

Personal data are processed with automated tools for the time strictly necessary to achieve the purposes for which they were collected. The Controller adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR, including encryption of data in transit (HTTPS protocol), control of access to systems and minimisation of the data processed.

The data will not be disclosed to unauthorised third parties nor processed in a manner incompatible with the purposes for which they were collected.

5. External Data Processors and Third Parties

To provide its services, the Controller uses third parties that process personal data on its behalf as data processors pursuant to Art. 28 GDPR, with whom specific contractual agreements have been entered into. The categories of processors currently in use or potentially usable include:

• Hosting and web infrastructure service providers (current: Vercel Inc., USA)
• Scheduling and appointment management platforms (current: Google LLC for Google Calendar, and Google Workspace for email, including the internal notification that flags each new call request)
• Web traffic statistical analysis service providers (current: Cloudflare Inc. — Web Analytics, a privacy-preserving service that does not use cookies, and anti-spam verification of the request form with Turnstile)
• Email marketing and newsletter management platforms (current: Brevo — Sendinblue SAS, France; data hosted on EU servers: France, Germany, Belgium).
• Customer relationship management (CRM) systems
• Advertising and retargeting platforms (subject to consent; current: Meta Platforms Ireland Limited, Ireland, and LinkedIn Ireland Unlimited Company, Ireland)
• IT security and website protection service providers
• Notion Labs, Inc. (USA, participating in the EU-US Data Privacy Framework) — storage of the call requests sent through the form and of the requests and outcomes of the automated funnels (G.A.P. and Compromise Scan).
• Hetzner Online GmbH (Germany) — provision of the server on which the automation system that receives the requests sent through the form runs.
• Anthropic (USA) — artificial intelligence assistant (Claude) used to prepare calls, as described in section 3.1.
• Record of cookie choices: Cloudflare, Inc. (USA); the database is stored in the European Union.

If you accept marketing cookies, the data collected by the Pixel and the Insight Tag are also received by Meta Platforms Ireland Limited (Ireland) and LinkedIn Ireland Unlimited Company (Ireland), which process them according to their own notices (section 3.8).

The up-to-date list of data processors is available upon written request sent to the Controller's email address.

6. Transfer of Data to Third Countries

Some of the service providers used by the Controller are based in the United States of America or in other countries outside the European Economic Area (EEA). Data are transferred to these countries in compliance with the safeguards provided for by Articles 44-49 GDPR, in particular:

• Adequacy decision of the European Commission, where applicable (e.g. the EU-US Data Privacy Framework adopted in July 2023, in which Google LLC, Cloudflare Inc. and Notion Labs, Inc. participate; for Vercel Inc., which hosts this website, the transfer takes place on the basis of the standard contractual clauses or, where the provider participates in it, of the same Framework);
• Standard contractual clauses approved by the European Commission (Standard Contractual Clauses — SCC), where the provider does not participate in a recognised adequacy mechanism.

For Anthropic, the transfer takes place on the basis of the safeguards provided by its commercial contract (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework). Meta Platforms, Inc. and LinkedIn Corporation, which receive the data if you accept marketing cookies, are based in the United States. In the official Data Privacy Framework list (dataprivacyframework.gov), read on 12 November 2026, LinkedIn Corporation and Cloudflare, Inc. are listed as “Active”; Meta Platforms, Inc. is listed as “Active - Re-certification under Review”. The server of the automation system (Hetzner Online GmbH) is located in the European Union.

The user may request further information on the safeguards adopted for international transfers by contacting the Controller.

7. Data Retention Period

Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected, unless legal obligations require longer retention periods. In particular:

• Browsing data and server logs: retained for a period not exceeding 12 months, unless needed to establish unlawful acts.
• Data relating to call requests (“Let's talk” form and booking): retained for the duration of the pre-contractual relationship and, thereafter, for a period not exceeding 24 months from the last contact, in order to document the pre-contractual relationship; if the request leads to an engagement, for the duration of the relationship and for the periods required by law.
• Accounting and tax data: where the booking is followed by the invoicing of a service, only the data required by tax legislation (name, address, VAT number/tax code, amounts) are retained for 10 years pursuant to Article 2220 of the Italian Civil Code and Article 22 of Presidential Decree 600/1973, solely in relation to the document retention obligation.
• Newsletter data: retained until the data subject withdraws consent or until the service ends. In the absence of interaction for a continuous period of 24 months, the data will be removed from the active list.
• Data processed for marketing and profiling: retained until consent is withdrawn or for a maximum of 12 months from the last interaction, unless otherwise stated at the time of collection.
• Cookies and similar technologies: according to the durations indicated in the Cookie Policy.
• Record of cookie choices: 25 months from the record, then automatic deletion. The technical cookie that remembers the choice lasts 180 days. The data received by Meta and LinkedIn are kept according to their own notices.

8. Rights of Data Subjects

As a data subject, pursuant to Articles 15-22 GDPR, the user has the right to:

• Access (Art. 15): obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, obtain a copy of those data and information on the processing.
• Rectification (Art. 16): obtain the correction of inaccurate personal data or the completion of incomplete data.
• Erasure (Art. 17): obtain the erasure of personal data (“right to be forgotten”), in the cases provided for by law.
• Restriction of processing (Art. 18): obtain the restriction of processing in the cases provided for by law.
• Data portability (Art. 20): receive the personal data concerning them in a structured, commonly used and machine-readable format, as well as the right to transmit them to another controller, in the cases provided for by law.
• Objection (Art. 21): object at any time to the processing of their data on grounds relating to their particular situation, or unconditionally where the data are processed for direct marketing purposes.
• Withdrawal of consent: withdraw the consent given at any time, without affecting the lawfulness of processing carried out before its withdrawal.
• Lodge a complaint: lodge a complaint with the competent supervisory authority (see section 10).

To exercise their rights, the data subject may send a written request to the email address: info@rayergroup.com. The Controller will respond within 30 days of receipt of the request, a period that may be extended by a further 60 days in particularly complex cases, with a reasoned notice to the data subject.

9. Personal Data Breach Notification

In the event of a personal data breach (data breach) likely to result in a risk to the rights and freedoms of natural persons, the Controller will notify the breach to the Italian Data Protection Authority within 72 hours of becoming aware of it, pursuant to Art. 33 GDPR. Where the breach presents a high risk to the rights and freedoms of the data subject, the Controller will also communicate it to the data subject without undue delay, pursuant to Art. 34 GDPR, save for the exemptions provided for by law.

10. Right to Lodge a Complaint with the Garante

The user has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), based at Piazza Venezia 11, 00187 Roma, or with the supervisory authority of the European Union Member State in which they habitually reside or work, or of the place where the alleged infringement occurred.

11. Changes to the Privacy Policy

The Controller reserves the right to amend this notice at any time, publicising the changes to users on this page. In the event of substantial changes, the Controller will take appropriate measures to inform users (e.g. highlighting them on the homepage or by email notification to newsletter subscribers). Users are therefore invited to check this page regularly.

The “Last updated” date at the top of the page indicates when the policy was last modified.