Privacy Policy
Last updated: 1 October 2026
This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), describes how the personal data of visitors to karstia.com and people contacting Karstia through the contact details on the website are processed.
1. Data controller
The data controller is the promoter of the Karstia project.
Email: [email protected]
No Data Protection Officer (DPO) has been appointed, as this is not mandatory.
2. Data processed
Browsing data. The systems operating the website automatically record certain technical data associated with Internet protocols: IP address, date and time of the request, requested page, server response code, browser type and operating system.
Data provided by the user. If a user writes to an email address listed on the website, their email address and any information they choose to include in the message are processed (for example, name, company, role and telephone number). Please do not send information unnecessary to your request.
The website does not contain data collection forms, does not require registration and does not process special categories of personal data. Applications are sent by email (see section 12).
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Website operation and security | Browsing data | The controller's legitimate interest (Article 6(1)(f)) |
| Responding to email enquiries | Data provided by the user | Steps taken at the data subject's request prior to entering into a contract (Article 6(1)(b)) or legitimate interest in managing professional relationships (Article 6(1)(f)) |
| Compliance with legal obligations | Necessary data | Legal obligation (Article 6(1)(c)) |
| Protection of the controller's rights | Necessary data | Legitimate interest (Article 6(1)(f)) |
Data are not used for promotional communications, profiling or automated decision-making.
4. Provision of data
Browsing data are necessary to access the website. Sending data by email is optional; without those data, however, it is not possible to respond to the enquiry.
5. Processing methods
Data are processed electronically, using appropriate technical and organisational measures to protect against unauthorised access, loss, alteration or disclosure.
6. Recipients
Data may be processed on the controller's behalf by the following categories of service providers acting as processors under Article 28 GDPR:
- the website hosting provider, with infrastructure in Italy;
- the email service provider;
- the network services provider that delivers and protects the website (CDN and security), which processes browsing data to serve pages and filter malicious traffic.
Data may also be disclosed to professional advisers bound by confidentiality and to competent authorities where required by law. Data are neither publicly disseminated nor sold.
7. Transfers outside the European Economic Area
The email service provider and the network services provider may also process data outside the European Economic Area. Such transfers take place on the basis of the European Commission's adequacy decision concerning the EU-U.S. Data Privacy Framework and/or standard contractual clauses approved by the Commission. Further information can be requested by writing to [email protected].
8. Retention
| Data | Retention period |
|---|---|
| Browsing data and technical logs | Up to 12 months, unless needed to investigate incidents or unlawful activity |
| Emails not followed by a professional relationship | 24 months from the last exchange |
| Data relating to a contractual relationship | 10 years after its conclusion, for civil-law and tax obligations |
After these periods, data are deleted or anonymised.
9. Data subject rights
Data subjects may request access, rectification, erasure, restriction of processing and, where applicable, data portability at any time (Articles 15–20 GDPR).
Right to object. Where processing is based on legitimate interest, data subjects may object at any time on grounds relating to their particular situation (Article 21 GDPR).
Requests should be sent to [email protected] and will receive a response within one month.
10. Complaints
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
11. Cookies and external links
For cookies, please see the Cookie Policy. The website contains links to third-party websites (such as LinkedIn), which process data under their own notices.
12. Applications (Careers)
Anyone who applies by writing to [email protected] provides their email address and the information they choose to include (for example name, profile of interest, links to profiles or portfolios). The data is used only to assess the application and to contact the candidate when a suitable opportunity arises.
Legal basis: pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR). Retention: 24 months from receipt, unless earlier deletion is requested at [email protected]. Please do not send unnecessary data such as photos, age, marital status or special categories of data.
13. Changes
This notice may be updated. The current version is always published on this page with its last-updated date.