Things5. Let your physical product become intelligent

This notice describes the processing of personal data of users who visit the things5.com website, in its Italian and English language versions, fill in the forms on the site or interact with its content.

It does not apply to:

the Things5 platform, accessible after authentication, which operates on infrastructure separate from that of the website and for which the contractual terms and the dedicated notice apply.
third-party websites reachable via links on the site, for which please refer to the respective notices.

Browsing data. IP address, browser and operating system type and version, pages visited, date and time of the request, referring page, duration of the visit. This data is collected automatically by the IT systems that manage the site and, by its nature, could allow users to be identified through processing and association with data held by third parties.

Data you provide voluntarily. The data you enter in the forms on the site: first name, last name, email address, phone number, company, role and message content. Mandatory fields are marked on the form; failure to provide them prevents us from following up on the request.

Data collected through cookies and tracking tools. Information about your interaction with the site, including pages viewed, clicks and cursor movements. In addition to cookies, some tools use the browser’s local and session storage. Details of the tools used, their purposes and their duration are in the Cookie Policy.

Data processed: browsing data, technical cookies.
Legal basis: the Controller’s legitimate interest in providing the requested service and ensuring the security of its infrastructure (Art. 6.1.f GDPR). Technical cookies do not require consent pursuant to Art. 122 of Legislative Decree 196/2003.
Retention: technical logs are retained for the time necessary for the operation, diagnostic and security purposes of the service, according to the retention periods applied by the platform hosting the site, and are in any case deleted or anonymized when no longer necessary for such purposes, save for the need for longer retention in the event of an investigation into unlawful conduct or a request from the authorities.

Data processed: email address and, if provided, name and company.
Legal basis: your express consent (Art. 6.1.a GDPR), collected through a checkbox that is not pre-selected and confirmed by means of a verification message sent to the address provided (double opt-in).
Withdrawal: you can withdraw your consent at any time via the unsubscribe link included in every communication or by writing to dpo@visup.it. Withdrawal does not affect the lawfulness of processing carried out before it.
Retention: until consent is withdrawn. Proof of the consent given is retained for the period necessary to demonstrate its validity and in any case for no longer than 5 years from withdrawal.

Tools: Google Analytics 4, via Google Tag Manager.
Data processed: browsing data, pages viewed, interactions and identifiers collected through tracking tools, in pseudonymized form.
Legal basis: your consent, given through the preference panel for tracking tools (Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003).
Processing of the IP address: the provider documents that Google Analytics 4 does not log or store IP addresses. Data originating from devices located in the European Union is collected through domains and servers located in the Union, and the IP address is used solely to derive approximate city- or area-level geolocation information, after which it is immediately discarded without being logged.
Retention: user- and event-level data is retained for 14 months. This period does not apply to aggregated data in standard reports, which does not allow individual users to be identified.

Tool: Hotjar, provided by Hotjar Ltd, a company based in the European Union (Malta) belonging to the Contentsquare SAS group.
Data processed: interactions with pages, clicks, cursor movements, scrolling, screen size and characteristics, device type, operating system and browser, pages visited. The provider temporarily processes your IP address to monitor the performance of its own service and application errors, and automatically deletes it within thirty days.
Legal basis: your consent (Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003).
Measures adopted: the tool is configured to exclude the content of text input fields from recording, so that the data you type into forms is not captured.
Tracking tools used: Hotjar’s code installs first-party cookies and also uses the browser’s local and session storage. Durations range from a few milliseconds, for cookies that verify browser functionality, to three hundred and sixty-five days for the user identifier. The full list is in the Cookie Policy.
Retention: session recordings and heatmaps are retained for 365 days from the date of capture, after which the provider initiates an automatic deletion process that removes the data from its servers, including backups, in a non-recoverable manner. Any associated user attributes are deleted after 365 days of inactivity for users with an identifier and after three months for unidentified users.

Provider	Role	Location	Basis for transfer
Duda, Inc. — 577 College Avenue, Palo Alto, CA 94306 (USA)	Website hosting and management platform; collection and storage of form submissions	United States	EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses (EU Decision 2021/914) where applicable
Google Ireland Limited	Tag management, statistical analysis, video content	Ireland, with possible transfers to Google LLC	EU-U.S. Data Privacy Framework
Hotjar Ltd (Contentsquare SAS group)	Browsing behavior analysis	Malta, European Union	Storage predominantly within the EU; for limited cases of access or transfer to third countries, the provider states it has entered into Standard Contractual Clauses
Google Ireland Limited	Company email, receipt of form notifications	Ireland, with possible transfers to the United States	EU-U.S. Data Privacy Framework
HubSpot, Inc.	CRM management and newsletter delivery	United States	EU-U.S. Data Privacy Framework
Meta Platforms Ireland Limited	Advertising campaign measurement	Ireland, with possible transfers to the United States	EU-U.S. Data Privacy Framework
IT service providers and consultants	Maintenance, development, consulting	European Union	—

The processors listed above may engage additional providers (sub-processors), bound by contractual obligations no less stringent than those undertaken toward the Controller. In particular, the platform hosting the site relies on cloud infrastructure providers with servers in the United States and Germany, on application monitoring and technical support services, as well as on companies belonging to its own group based in Israel, Canada and the United Kingdom. The updated list of sub-processors is made available by the provider and can be requested by writing to dpo@visup.it.

Some of the providers listed in point 5 are based in the United States, where the systems hosting the site are located: the data you enter in the forms is therefore stored in the United States. In these cases, the transfer takes place on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, for entities that are certified, or on the basis of the Standard Contractual Clauses adopted by the European Commission, supplemented by additional safeguards where necessary. You can request a copy of the safeguards adopted by writing to dpo@visup.it.

With regard to the data processed, you may exercise the following rights at any time:

access to your personal data and information about its processing (Art. 15)
rectification of inaccurate data or completion of incomplete data (Art. 16)
erasure of data, in the cases provided for (Art. 17)
restriction of processing (Art. 18)
portability, i.e. receiving the data in a structured, commonly used format and having it transmitted to another controller (Art. 20)
objection to processing based on legitimate interest (Art. 21)
withdrawal of consent at any time, for processing based on it, without prejudice to the lawfulness of processing carried out previously (Art. 7.3)

To exercise these rights, simply write to dpo@visup.it. You will receive a response within one month of the request, extendable by two months in cases of particular complexity, with notice of the reasons for the extension.

If you believe that processing is taking place in violation of the applicable regulations, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome — garante@gpdp.it — www.garanteprivacy.it) or to bring the matter before a court.

This notice may be updated to reflect regulatory changes, the introduction of new tools, or changes in processing methods. The version in force is always the one published at this address, with an indication of the date of the last update. In the event of substantial changes affecting processing based on consent, we will inform you again and, where necessary, new consent will be requested.

In the event of a discrepancy between the Italian version and the English translation of this document, the Italian version shall prevail.

Privacy policy - Personal Data Processing Notice

1. Who processes your data

2. What this notice covers

3. What data we collect

4. Why we process your data and on what legal basis

5. Who can access your data

5.1 Sub-processors

6. Links to third-party sites and platforms

7. Transfers to third countries

8. Cookies and tracking tools

9. How we process your data

10. Your rights

11. Minors

12. Changes to this notice

Keep informed. Subscribe to our monthly digest!

Contact Us