Privacy Policy

011. Data controller

The data controller is Tomaso Forno — Partita IVA IT02759140995 — Via Anton Giulio Barrili 5 — 16143 Genova (GE), Italia — mail@triskellecosystem.com.

For any question or request about your data write to mail@triskellecosystem.com. We have not appointed a Data Protection Officer, as it is not mandatory in our case.

022. Browsing the site

When you visit the site, the hosting servers record technical data needed to deliver pages and protect the service (IP address, browser type, requested page, date and time). These are log data handled by our infrastructure providers.

Legal basis: our legitimate interest in running the site securely (Art. 6.1.f GDPR). Retention: short technical periods set by the providers.

033. Accounts and members area

If you create an account we collect your email, password (stored encrypted only, never visible to us), name and phone number if you provide it. We also handle the role assigned to your account and the private documents made available to you in the members area.

Purpose: creating and managing the account, sign-in, password reset, delivering the content and documents you are entitled to.

Legal basis: performance of the contract or of your request (Art. 6.1.b GDPR).

Retention: as long as the account is active. On deletion request we remove the account and linked documents, except data we must keep for tax obligations (see section 4).

044. Purchases and payments

When you buy a digital product we collect name, email, phone number, amount and currency, plus the technical transaction identifiers generated by Stripe (checkout session and payment identifiers).

Card data never passes through our systems: payment is handled entirely by Stripe.

Purpose: completing the purchase, delivering the product, sending confirmation, support and disputes, accounting and tax compliance.

Legal basis: performance of the contract (Art. 6.1.b GDPR) and legal obligation for accounting and tax data (Art. 6.1.c GDPR).

Retention: data needed for tax and accounting documentation is kept for 10 years, as required by Italian law. This also applies if you request deletion: we can delete everything else, but not data the law requires us to keep.

055. AI chat assistant

The site offers a conversational assistant. To run it and protect it from abuse we record: your question, the generated answer, a session identifier, your IP address in truncated form (the last part is removed, so it does not precisely identify your device) and a short indication of the browser used. We also keep a message counter to enforce a usage limit.

Please do not enter sensitive or confidential data into the chat: it is not the right channel.

Legal basis: performance of your request (Art. 6.1.b GDPR) and legitimate interest in service security (Art. 6.1.f GDPR).

Retention: to be transparent — there is currently no automatic deletion period for these conversations. You may ask us to delete them at any time, indicating the approximate date and time of the conversation.

066. Email and communications

We send two kinds of email: service email (registration confirmation, password reset, purchase confirmation and product delivery) and informational or promotional email, only if you subscribed.

We use Brevo to send them. We keep a technical send log (recipient, template used, outcome, any error), the tokens that make the unsubscribe link valid, and the list of addresses no longer to be contacted (because you unsubscribed or the address is invalid).

Legal basis: performance of the contract for service email (Art. 6.1.b GDPR); consent for promotional email (Art. 6.1.a GDPR); legitimate interest and legal duty to honour your objection for the suppression list (Art. 6.1.f and 6.1.c GDPR).

Every non-service email always contains an unsubscribe link. The address stays on the suppression list precisely to make sure it is not contacted again.

077. Contact form and WhatsApp

If you write to us through the contact form or the WhatsApp number shown on the site, we process the data you provide (name, email, phone if given, message content) to answer you. The contact form is provided through Brevo. WhatsApp conversations run on WhatsApp/Meta infrastructure under their terms.

Legal basis: performance of your request and legitimate interest in replying. Retention: as long as needed to handle the request and its consequences.

088. Cookies, pixels and campaign measurement

We use technical cookies necessary for the site to work and, only with your consent, marketing tools: the Meta Pixel with its Conversions API and the ChatGPT Ads pixel. None of these tools loads before your consent.

When you give or refuse consent we record proof of your choice: a random identifier generated on your device (not linked to your name), the categories accepted, the policy version, the browser used and the date. We do not record your IP address in this register.

If you consented to marketing, when you complete a purchase we also send the conversion event from our servers to Meta and OpenAI. Without consent no event is sent: the purchase, product delivery and emails work anyway.

Legal basis: consent (Art. 6.1.a GDPR and Art. 122 Italian Privacy Code) for marketing and statistics; legitimate interest and legal compliance for keeping proof of consent.

Details of each cookie are in the Cookie Policy, where you can also change your choice at any time.

099. Who we share data with

We do not sell your data. We share it only with providers we need to run the service, each in its own role:

• Cloud infrastructure, database and website hosting providers: data processors, application data hosted in the European Union.
• Stripe: payments and fraud prevention. Acts as an independent controller for payment aspects.
• Brevo: email sending and contact form. Data processor, infrastructure in the European Union.
• Meta Platforms: Meta Pixel and Conversions API for campaign measurement, only with consent. Independent controller or joint controller under its own terms.
• OpenAI: ChatGPT Ads pixel and Conversions API, only with consent.
• AI model providers used by the chat assistant, to generate the answer to your message.
• Google (Google Fonts): fonts are requested from Google servers, which receive the IP address needed to deliver the file.
• WhatsApp/Meta: if you choose to contact us via WhatsApp.
• Accounting, tax and, where necessary, legal advisors, for statutory compliance.

1010. Work carried out on behalf of the agency's clients

Besides running this website, Tomaso Forno provides online advertising and contact-management services to clients. When a client's campaign collects your data (for example because you fill in a form on one of their ads), that client is the data controller: we process the data on their behalf and on their instructions, as data processor (Art. 28 GDPR).

On the client's behalf we may enter and organise these contacts in contact-management systems (CRM), reach you by phone, message or email through platforms we build and run, and enrich or qualify contacts with information useful to the client. We maintain and optimise these tools so that they work correctly and securely.

These activities are separate from those of this website. The data you leave on this website is not disclosed to the agency's clients without your specific, separate consent, which you are free to refuse and to withdraw at any time.

The legal basis, retention periods and privacy notice for this data are set by the client acting as controller. To exercise your rights over data collected by a client's campaign, you can contact that client directly or write to mail@triskellecosystem.com: we will forward your request to the relevant client.

1111. Transfers outside the European Union

Some providers are based in the United States or may process data outside the EU: in particular Stripe, Meta, OpenAI, Google and WhatsApp. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the provider's participation in the EU-U.S. Data Privacy Framework, with additional security measures.

Website, database and email data (cloud infrastructure and Brevo) are hosted in the European Union.

You can ask for more information about the safeguards in place at mail@triskellecosystem.com.

1212. How long we keep data

• Account and members area: as long as the account is active, then deleted on request.
• Private documents in the members area: as long as the account is active or the related service is available.
• Purchase and tax data: 10 years, as required by law.
• Email send log and suppression list: as long as needed to prove sends and honour your unsubscribe.
• AI assistant conversations: no automatic period today; deleted on request.
• Cookie consent register: kept as proof of your choice, for as long as needed to demonstrate it.
• Technical security logs: short periods set by infrastructure providers.

1313. Your rights

At any time you can request access to your data, its rectification, erasure, restriction of processing, object to processing based on legitimate interest, and portability of the data you provided. You can also withdraw any consent at any time, without affecting the lawfulness of processing carried out before.

To exercise your rights write to mail@triskellecosystem.com, stating your request and, if you have an account, the email you registered with. We reply within one month; in complex cases up to three months, letting you know.

For cookie consent you can change your mind directly on the site, via the "Cookie preferences" link in the footer. For promotional email, the unsubscribe link in every message is enough.

1414. Complaints

If you believe the processing of your data breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garante@gpdp.it — www.garanteprivacy.it) or go to court.

1515. Children's data

The services are not aimed at children under 16. We do not knowingly collect children's data; if we become aware of it, we delete it.

1616. Changes to this notice

We may update this notice to reflect changes in our services or in the law. The date of the last update is shown at the top. If changes affect cookie consent, we will ask for your choice again.