---
title: "Privacy and Cookies"
description: "Notice provided pursuant to Art. 13 of Regulation (EU) 2016/679 (\"GDPR\"), Art. 13 of Italian Legislative Decree 196/2003 (\"Privacy Code\"), and the Guidelines on cookies and other tracking tools issued..."
url: https://www.elfo.net/en/privacy-and-cookies/
date: 2024-11-05
modified: 2026-09-28
author: "Admin"
type: page
lang: en
---

# Privacy and Cookies

*Notice provided pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”), Art. 13 of Italian Legislative Decree 196/2003 (“Privacy Code”), and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante) on 10 June 2021, No. 231 (in force since 10 January 2022)*

*Last updated: 29 July 2026*

**Introduction**

For ELFO S.r.l. con socio unico (“ELFO”, “the Company”), personal data is a valuable asset to be protected. Transparency towards data subjects is a primary objective: this notice describes how personal data is processed for visitors of the website elfo.net (“Site”), in compliance with Regulation (EU) 2016/679, Legislative Decree 196/2003, and the Garante’s cookie guidelines of 10 June 2021.

**Data Controller and Contacts**

|   |   |
| --- | --- |
| **Data Controller** | ELFO S.r.l. con socio unico |
| **Registered office** | Via Pastore, 3/5 – 29017 Fiorenzuola d’Arda (PC), Italy |
| **Phone** | +39 0523 985811 |
| **Data Protection Officer (DPO)** | Luca Salini – Tel. 0523.713250 – Email: [dpo@ecoreholding.it](mailto:dpo@ecoreholding.it) |

Data subjects may contact the DPO to exercise the rights set out in Arts. 15-21 GDPR (access, rectification, erasure, restriction, portability, objection) and to withdraw a previously given consent. In the absence of a response, the data subject may lodge a complaint with the Garante for the protection of personal data ([www.garanteprivacy.it](http://www.garanteprivacy.it)).

1. ** Processing of data related to browsing the Site**

**1.1 Browsing data**

The computer systems used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (IP addresses, domain names, URIs of requested resources, request time, method used, response size, server status code, and other parameters relating to the user’s operating environment).

**Purpose and legal basis:** anonymous statistics on Site usage, monitoring of correct functioning, and establishing liability in the event of computer crimes against the Site (Controller’s legitimate interest, Art. 6(1)(f) GDPR).

**Recipients:** authorised internal personnel (Art. 29 GDPR) and any external providers appointed as data processors (Art. 28 GDPR) for platform maintenance. No disclosure to third parties except upon request by judicial authorities.

**Retention:** for the time necessary for the above purposes, normally not exceeding 12 months, save for extensions connected to ongoing investigations.

**Provision:** not required from the data subject, automatically acquired by technological systems.

**1.2 Cookies and other tracking tools**

The Site uses cookies and similar technologies according to the categories described below, in compliance with the Garante’s Guidelines of 10 June 2021, No. 231.

**What cookies are.** Small text files that the browser stores on the user’s device and returns to the Site on each subsequent visit, to recognise the device and personalise the experience.

**Consent management.** On first access, a banner managed via the Iubenda platform is shown, allowing the user to accept, reject (with an action of equal simplicity to acceptance) or customise preferences, before any non-technical cookies are installed. Consent may be changed or withdrawn at any time by opening the “Manage cookie preferences” panel, accessible via the dedicated button present on every page of the Site, or directly through browser settings.

**a) Technical (strictly necessary) cookies**

Do not require consent (Art. 122(1) Privacy Code). They ensure the operation of the Site: session management and storage of consent preferences.

| **Purpose** | **First/third party** | **Duration** |
| --- | --- | --- |
| User session management | First party | Session |
| Storage of cookie preferences | First party | 2 months |

 

**b) Analytics cookies**

Used, subject to consent, to measure traffic and understand user behaviour in aggregate form, in order to improve the Site.

The Site uses **Google Analytics 4 (GA4)**: data is processed by Google Ireland Ltd. and may involve a transfer of data to the United States by Google LLC, which adheres to the **EU-US Data Privacy Framework** (European Commission adequacy decision 2023/1795 of 10 July 2023), currently the applicable legal basis for such transfer. For further information: [Google’s privacy policy](https://policies.google.com/privacy) and [Google Analytics opt-out page](https://tools.google.com/dlpage/gaoptout).

| **Service** | **Purpose** | **Duration** | **Extra-EU transfer** |
| --- | --- | --- | --- |
| Google Analytics 4 (GA4) | Aggregate usage statistics | 2 months | USA – EU-US Data Privacy Framework |

 

**c) Functionality cookies**

Improve the user experience by remembering user preferences (language, layout, answers already given to surveys) and enabling optional features (e.g. video, forms).

**d) Third-party / social cookies**

When the user interacts with social content embedded in the Site, third-party cookies not controlled by ELFO may be installed:

| **Service** | **Service provider** | **Place of processing** |
| --- | --- | --- |
| Meta (Facebook) widget/buttons | Meta Platforms, Inc. | USA – [Meta’s privacy policy](https://www.facebook.com/privacy/policy/) |
| Apollo.io (identification of visiting companies for commercial purposes) | Apollo.io, Inc. | USA – [Apollo.io’s privacy policy](https://www.apollo.io/privacy-policy) |

For these services, the transfer of data to the USA is based, where applicable, on the EU-US Data Privacy Framework or, absent the provider’s adherence to it, on Standard Contractual Clauses (Art. 46 GDPR).

**e) Marketing / advertising targeting cookies**

The Site uses, subject to consent, a **Google Ads (Conversion Linker)** tool, which links clicks on online advertisements to conversions completed on the Site. Data is processed by Google Ireland Ltd. and may involve a transfer of data to the United States by Google LLC, which adheres to the EU-US Data Privacy Framework (adequacy decision 2023/1795 of 10 July 2023).

| **Service** | **Purpose** | **Duration** | **Extra-EU transfer** |
| --- | --- | --- | --- |
| Google Ads – Conversion Linker | Linking ad clicks to conversions on the Site | up to 90 days | USA – EU-US Data Privacy Framework |
| OpenAI Ads – Measurement Pixel | Linking clicks on ads shown in ChatGPT to conversions on the Site | __oppref: 30 days (renewed on each ad click); __obref: 365 days | USA – Standard Contractual Clauses (SCCs) |

The Site does not currently use third-party behavioural profiling or retargeting advertising cookies other than as indicated above.

**1.3 How to manage cookies from the browser**

In addition to the Site’s preference management panel, users can act directly through their browser: [Chrome](https://support.google.com/chrome/answer/95647), [Firefox](https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop), [Safari](https://support.apple.com/guide/safari/sfri11471/mac), [Edge](https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09). Disabling technical cookies may impair the operation of the Site.

**1.4 Careers**

The “Careers” page allows for the spontaneous submission of job applications (CVs). **Purpose:** personnel selection, based on the data subject’s specific and informed consent (Art. 6(1)(a) GDPR). In the event of hiring, a dedicated notice regarding the professional relationship will be provided. **Retention:** for the time necessary for the selection process, unless consent is given to retain data for future opportunities. **Provision:** necessary to submit an application.

**1.5 Information requests / contact**

Identification and contact data submitted through the Site’s forms are processed to respond to received requests, based on the data subject’s consent (Art. 6(1)(a) GDPR), and retained for the time necessary to handle the request.

1. ** Processing of data related to client and supplier relationships**

**2.1 Purpose of processing**

ELFO processes identification data of clients, suppliers, and their operational contacts (name, company name, tax data, address, contact details, payment references) in connection with the provision of its software development services and solutions. ELFO may also process personal data (usually anonymised) in connection with software development activities carried out on behalf of clients. Where ELFO acts as a **data processor** on behalf of its clients, the terms of such processing are governed by a dedicated **Data Processing Agreement (DPA)** pursuant to Art. 28 GDPR, separate from this notice.

**2.2 Purpose and legal basis**

- Conclusion and performance of contractual relationships (Art. 6(1)(b) GDPR);
- fulfilment of pre-contractual, contractual, tax and legal obligations (Art. 6(1)(b), (c) GDPR);
- Controller’s legitimate interest, including legal defence and operational/accounting management (Art. 6(1)(f) GDPR).

Failure to provide the data makes it impossible to establish the relationship. Additional consent will be requested for any further purposes.

**2.3 Methods and scope of processing**

Processing is carried out using paper-based and electronic tools, in compliance with the principles set out in Art. 5 GDPR and with the security measures required by Art. 32 GDPR. Data is processed by authorised internal personnel and, where necessary, by external parties appointed as data processors (IT providers, hosting providers, consultants). The list of external processors is available upon request to the DPO.

**2.4 Extra-EU transfers**

Where, in the course of providing its services, certain data is processed by providers based in or operating infrastructure in the United States, the transfer is based on the EU-US Data Privacy Framework (adequacy decision 2023/1795), where the provider adheres to it, or on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR).

1. ** Policy updates**

This notice may be subject to periodic review in light of regulatory or case-law developments. Any significant changes will be announced on the Site’s home page. Users are advised to review this page periodically.