Privacy Policy

Last updated: 27 May 2026

This notice describes how Virtualux S.r.l. collects and processes the personal data of users visiting virtualux.it and interacting with our contact, download and consultation request forms, pursuant to Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended.

1. Data controller

The data controller is Virtualux S.r.l., based in Via Monte Cervino 14, 37057 Verona (VR), Italy. For any request related to the processing of your data you can write to info@virtualux.it.

2. Data we collect

We process the following categories of data: • Data you voluntarily provide through our forms: name, email, company, role, message, industry, revenue band, timeline and any other information you choose to share. • Navigation and interaction data: IP address (anonymised by PostHog/GTM), referrer URL, UTM parameters, browser, device, click and scroll events. These data are collected only after your explicit consent through the cookie banner. • Technical identifiers: the consent value (vlx_consent in localStorage) and language settings. These data are processed under legitimate interest to keep the site operational.

3. Purposes

Data are processed in order to: (a) respond to contact, demo, audit or resource download requests; (b) send operational communications related to your request (e.g. delivery of the Audit Framework PDF); (c) measure site performance, traffic source and content quality (only with consent to analytics cookies); (d) fulfil legal obligations.

4. Legal basis

Processing is based on: • art. 6(1)(b) GDPR — pre-contractual measures taken at your request (contact / lead forms); • art. 6(1)(a) GDPR — your consent, for analytics/marketing cookies and any promotional communications; • art. 6(1)(f) GDPR — legitimate interest, for site security and abuse prevention; • art. 6(1)(c) GDPR — legal obligation, where applicable.

5. Data retention

Form data are retained for the time needed to handle your request and, in case of a contractual relationship, for the period required by accounting and tax obligations (10 years). Analytics data are aggregated and retained per the provider's defaults (PostHog: 7 years for raw events; GA4: up to 14 months). You can request deletion at any time by writing to info@virtualux.it.

6. Recipients

Your data may be shared with parties acting as data processors on our behalf, including: • Supabase (Snaplet/AWS, EU) — contact form database; • Vercel Inc. (USA) — site hosting; • Klaviyo Inc. (USA) — lead sync for email follow-up (only with consent); • PostHog Ltd. (EU — EU region) — product analytics; • Google LLC (USA) — Google Tag Manager / Analytics (only with consent).

7. Non-EU transfers

Some providers (Vercel, Klaviyo, Google) are based in the United States. Transfers happen on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission and/or via the Data Privacy Framework where applicable. PostHog is hosted in the EU region (eu.posthog.com).

8. Your rights

Pursuant to articles 15-22 GDPR you have the right to: • access your data and obtain a copy; • ask for rectification; • ask for erasure ("right to be forgotten"); • ask for restriction of processing; • object to processing; • receive your data in a structured format (portability); • withdraw consent at any time. To exercise these rights write to info@virtualux.it. We will respond within 30 days.

9. Complaints to the Authority

If you believe that the processing of your data infringes the GDPR you may lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it).

10. Changes to this notice

This notice may be updated. Material changes will be reflected on this page with the updated date shown at the top.