Privacy Policy

The data controller is: Keryx Design Davide Filippini – M26525203S Email: [email protected]

We collect the following types of data: Browsing data (analytics cookies) - IP address (anonymized) - Pages visited - Time spent on site - Device and browser used Voluntarily provided data - Name and email (when you subscribe to our newsletter via ConvertKit) - Data entered in contact forms (via Tally.so) Data collected via AI chatbot (Kira) - Name, email, phone number or WhatsApp (voluntarily provided) - Business sector and type (B2B/B2C) - Service of interest and project details - Conversation messages exchanged with the chatbot

Data is used for: - Statistical analysis: Understanding how users interact with the site (Google Analytics) - Direct marketing: Sending newsletters and promotional communications (only with explicit consent) - Request handling: Managing contact forms - Lead qualification (Kira chatbot): Collecting project requirements and contact information to provide a personalized follow-up. Data is processed via Anthropic's Claude API (based in the United States) solely for generating conversational responses. Explicit consent is required before starting a chat session. - Security monitoring (Kira chatbot): Conversation logs are stored for security, abuse prevention, and service improvement purposes under legitimate interest (Art. 6(1)(f) GDPR). Logs are retained for 30 days and accessible only to the data controller.

Technical Cookies (always active) Necessary for the proper functioning of the site. Analytics Cookies (with consent) - Google Analytics (G-6HYH09CZ3Z): Used to collect anonymous statistics about site usage. Data is transmitted to Google LLC in the United States. Third-Party Cookies (on interaction) - ConvertKit: Activated when you subscribe to the newsletter - Tally.so: Activated when you fill out a contact form Session Identifiers (Kira chatbot) - A random session ID is generated when you open the chatbot. It is not stored persistently and is used solely to maintain conversation context during your session.

- Technical cookies: Legitimate interest of the controller - Analytics cookies: Explicit user consent - Newsletter: Explicit user consent - Contact forms: Execution of pre-contractual measures - Kira chatbot: Explicit user consent (Art. 6(1)(a) GDPR), collected via mandatory checkbox before starting a chat session

- Analytics data: 26 months (Google Analytics setting) - Newsletter data: Until unsubscription by the user - Form data: The time necessary to handle the request - Chatbot data (in-memory): Active conversation data is stored in server memory for a maximum of 24 hours, then automatically deleted. Users can request immediate deletion at any time via the "Delete my data" button in the chatbot interface. - Chatbot logs (persistent): Anonymized conversation logs (session ID truncated to 8 characters) are retained for up to 30 days for security monitoring and abuse prevention.

Under the GDPR (EU Regulation 2016/679), you have the right to: - Access: Request what data we have about you - Rectification: Correct inaccurate data - Erasure: Request deletion of your data - Portability: Receive your data in a readable format - Objection: Object to processing for marketing purposes - Withdraw consent: Withdraw your consent at any time To exercise these rights, contact us at: [email protected]

Some services used may transfer data to the United States: - Google Analytics (Google LLC): Anonymous usage statistics - ConvertKit: Newsletter subscriber data - Anthropic (Kira chatbot): Conversation messages are sent to Anthropic's Claude API for processing. Anthropic acts as a data processor and does not use conversation data for model training. Such transfers occur in compliance with GDPR safeguards (standard contractual clauses and/or EU-US Data Privacy Framework).

This privacy policy may be updated periodically. We encourage you to review it regularly. The date of the last update is indicated at the top.