Privacy Policy

KiRa Technology S.r.l.
Via Giorgio Amendola, 30/b, 47039 Savignano sul Rubicone (FC), Italy
E-mail: privacy@kiratechnology.com

The Data Controller has not appointed a Data Protection Officer (DPO), based on the information currently available pursuant to Art. 37 of the Regulation.

Data collected: name, e-mail address, message text.

Purpose: to respond to the information request submitted by the user; subject to optional consent, to send commercial communications and updates (newsletter).

Legal basis: Art. 6(1)(b) GDPR (execution of pre-contractual measures taken at the request of the data subject) for requests of a commercial nature. In residual cases of general contact, Art. 6(1)(f) GDPR (legitimate interest of the Data Controller in responding to communications received). For the newsletter: Art. 6(1)(a) GDPR (consent expressed via an optional, unticked checkbox).

Retention: data relating to the request is retained for a maximum of 24 months. Data of contacts who have consented to the newsletter is retained until consent is withdrawn.

Withdrawal of newsletter consent: write at any time to privacy@kiratechnology.com.

Data collected: name, e-mail address, user type, plant information (energy source, heat source, interest in biochar).

Purpose: to send the requested technical material and qualify the request to provide adequate commercial support; subject to a separate optional consent, to send commercial communications and updates (newsletter).

Legal basis: Art. 6(1)(b) GDPR (execution of pre-contractual measures taken at the request of the data subject) for sending the requested documentation. For the newsletter: Art. 6(1)(a) GDPR (consent expressed via an optional, unticked checkbox, separate and independent from the brochure request).

Retention: data is retained for a maximum of 24 months from collection, or until consent is withdrawn. Data of contacts who have consented to the newsletter is retained until consent is withdrawn.

Withdrawal of consent: the data subject may withdraw consent at any time by writing to privacy@kiratechnology.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Data collected: e-mail address; if provided by the user while using the calculator, address/location, consumption and building data required for sizing.

Purpose: to send the report with the summary of the estimated configuration by e-mail; subject to separate, optional consent, to be contacted by our team for a personalized consultation, or to receive commercial communications and updates (newsletter).

Legal basis: Art. 6(1)(b) GDPR (execution of pre-contractual measures taken at the request of the data subject) for sending the report and for the personalized consultation request (via optional checkbox). For the newsletter: Art. 6(1)(a) GDPR (consent expressed via an optional, unticked checkbox, separate and independent from the other purposes).

Retention: data relating to the report is retained for a maximum of 24 months. Data of those who requested a personalized consultation is retained for the duration of the commercial discussion. Data of contacts who have consented to the newsletter is retained until consent is withdrawn.

Withdrawal of consent: write at any time to privacy@kiratechnology.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Data collected: IP address, browser type, operating system, requested page, date and time of access.

Purpose: to ensure the security and proper operation of the site; to detect unauthorised access attempts or technical anomalies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Data Controller in the security of its IT system). Processing is limited to technical data that, as a rule, are not used to directly identify the data subject; the Controller's interest in protecting the site is proportionate and prevailing over the minimal impact on the data subject.

Retention: logs are retained for a maximum of 30 days, unless required for security incident investigations.

Data collected: to understand how the site is used and to improve our services, we collect only anonymous, aggregated statistics, such as:

• the page visited;
• the site language used;
• the visitor's country of origin, determined through a local geographic database associated with the IP address. The IP address is used solely for this purpose and is not stored;
• use of the different steps of the energy independence calculator;
• submission of the contact or information request forms.

No personal identifiers, cookies, fingerprinting or other elements that allow the direct or indirect identification of a person are collected. Individual sessions or browsing paths attributable to individual users are not recorded.

Solely to avoid counting the same visit more than once, the site uses a temporary technical flag stored via the browser's sessionStorage. This information remains exclusively on the user's device and is deleted automatically when the tab or browser is closed.

The system also respects the preferences expressed through the Do Not Track (DNT) and Global Privacy Control (GPC) signals.

Purpose: the anonymous statistics are used exclusively to understand which content and features users find most useful and to improve the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller). The information collected is used exclusively in anonymous, aggregated form.

Retention: the aggregated statistics are stored temporarily on the server and periodically downloaded to the Controller's systems. They are then removed from the server.

Source of geographic data: the country of origin is determined using the IP-to-Country Lite database provided by DB-IP.com, distributed under the Creative Commons Attribution 4.0 (CC BY 4.0) licence.

The resulting statistics are aggregated and anonymous and do not allow users to be identified. The IP address is processed only transiently, in memory, to determine the country, and is not stored. This section is provided for transparency purposes.

The site uses only technical cookies necessary for the operation of the service. In particular, when you manually choose the language from the language selector, a language preference cookie (kira_lang, duration 1 year) is saved, which is used to take you back to the chosen language when you return to the site. The cookie contains only the language code (for example "de") and is not used to identify or profile you. Such cookies do not require consent pursuant to Art. 122 of Italian Legislative Decree no. 196/2003 (Privacy Code) and the relevant rulings of the Italian Data Protection Authority.

No profiling cookies, tracking cookies or third-party cookies for advertising purposes are used.

To ensure the correct functioning of certain site features, components are loaded from third-party providers. These providers may receive the user's IP address as a normal part of the HTTP protocol:

• jsDelivr (jsdelivr.net) and unpkg (unpkg.com): content delivery networks (CDN) used to load open-source software libraries. Policy: jsDelivr Privacy Policy, unpkg.
• OpenStreetMap (openstreetmap.org): open-source mapping service used to display the partner map. Policy: OpenStreetMap Privacy Policy.

The IP address is considered personal data under the GDPR. The Data Controller does not voluntarily transmit any personal data beyond the technical IP address to these providers. These providers may process the IP address as independent data controllers; in relation to such processing, the Controller does not determine the purposes and means.

Providing personal data through the site's forms is voluntary. However, failure to provide the mandatory data (name and e-mail) makes it impossible to respond to the contact request or send the requested technical documentation. Providing additional data (telephone number, plant information) is always optional and does not affect the handling of the main request. The data collected is limited to what is strictly necessary for the stated purposes (principle of data minimisation, Art. 5(1)(c) GDPR).

Personal data collected through the forms is not sold, transferred or disclosed to third parties for commercial or marketing purposes.

Access to data may be granted, to the extent strictly necessary, to:

• Authorised internal staff of KiRa Technology S.r.l.;
• Technical service providers acting as Data Processors pursuant to Art. 28 GDPR, including: hosting and web infrastructure providers, e-mail service managers, internal communication platforms.

The updated list of Data Processors is available on request by writing to privacy@kiratechnology.com.

Data collected through the forms is processed within the European Union. The CDN providers mentioned in section 4 (jsDelivr, unpkg) are based or have infrastructure in third countries (including the USA): transfers are made on the basis of Standard Contractual Clauses adopted pursuant to Art. 46 GDPR and, where necessary, supplementary security measures (technical and organisational) adopted by the providers to ensure an adequate level of protection. Please refer to their respective privacy policies for details.

The data subject may exercise the following rights at any time, pursuant to Arts. 15-22 GDPR:

• Access (Art. 15): obtain confirmation that personal data is being processed and receive a copy.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): obtain erasure of personal data ("right to be forgotten"), where the conditions set out in the provision are met.
• Restriction (Art. 18): obtain restriction of processing in certain cases.
• Portability (Art. 20): receive personal data in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Objection (Art. 21): object to processing based on legitimate interest, unless the Controller demonstrates compelling legitimate grounds.
• Withdrawal of consent (Art. 7(3)): withdraw consent at any time, without prejudice to the lawfulness of prior processing.
• Complaint (Art. 77): lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of the Member State where the data subject habitually resides.

Requests should be sent to: privacy@kiratechnology.com. Exercise of rights is free of charge and is not subject to any formal requirements. The Controller will respond within 30 days of receipt; in cases of particular complexity, this period may be extended by a further 60 days, with a reasoned notification to the data subject.

The Data Controller does not carry out decision-making processes based solely on automated processing, nor does it carry out user profiling activities pursuant to Art. 22 GDPR.

This notice may be updated following regulatory, technological or operational changes. The current version is always available on this page with the date of the last update.