Privacy Notice

AegisX S.r.l. | www.aegisx.ai | Version 1.3 | September 2026 | English courtesy translation: in case of discrepancy, the Italian version prevails

1. Data Controller

For any matter relating to the processing of personal data, you can contact the Controller directly at the addresses above. 

2. Scope

This notice applies exclusively to the processing of personal data collected through the website www.aegisx.ai (the “Site”), in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Legislative Decree 196/2003 as amended by Legislative Decree 101/2018
• Decisions of the Italian Data Protection Authority

3. Data Collected and Purposes of Processing

3.1 Browsing data

Data: IP address, browser type, operating system, pages visited, access times.
Purpose: technical operation of the Site, IT security, prevention of unauthorized access.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Controller.
Retention: 30 days in system logs, then automatic deletion.

3.2 Contact form

Data: first name, last name, email address, phone number (optional), message text.
Purpose: replying to requests for information sent through the Site's contact form.
Legal basis: Art. 6(1)(b) GDPR – performance of pre-contractual measures at the data subject's request.
Retention: 12 months from receipt of the request, unless retention is required by legal obligations.

3.3 Cookies and tracking tools

The Site uses technical cookies necessary for its operation, which do not require consent. Only with the user's consent, given through the banner (art. 6(1)(a) GDPR and art. 122 of Legislative Decree 196/2003), it also uses statistical tools that produce aggregate statistics on the use of the Site: Google Analytics 4 (Google) and Jetpack Stats (Automattic). Consent can be changed or withdrawn at any time from the “Manage consent” tab. No advertising or profiling cookies are used. For the detailed list of cookies in use, please refer to the Cookie Policy, which forms an integral part of this notice.

3.4 Virtual assistant

Service: the Site offers a virtual assistant based on artificial intelligence, which answers questions about AegisX products and services based solely on information provided by AegisX. When the chat is opened, the assistant states that it is an artificial intelligence system. It does not make decisions that produce legal or similarly significant effects on the user (art. 22 GDPR).
Data: messages written in the chat, the page from which the user writes, date and time. The IP address is used only in pseudonymized form (hash) to limit the number of messages and prevent abuse; this data is deleted within 24 hours and is not linked to conversations. The current conversation remains in the user's browser (sessionStorage) until the tab is closed.
Purpose: answering the user's questions, preventing abuse, checking and improving the quality of the answers. Saved conversations can be accessed only by authorized AegisX staff.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at the data subject's request) for the answers; Art. 6(1)(f) GDPR (legitimate interest of the Controller) for abuse prevention and quality control.
Provider: answers are generated through Google's Gemini API service, which acts as Data Processor and does not use the content to improve its own products. Google retains the content for a limited period, solely to detect and prevent violations of its usage policies. For transfers outside the European Union, see section 5.
Retention: 30 days, then automatic deletion.
Contact request from the chat: if the user fills in the assistant's form, name, company, email, phone (optional) and message are processed in order to get back to the user (Art. 6(1)(b) GDPR) and kept for 12 months from receipt. The conversation with the assistant is attached to the request.
Recommendation: please do not enter in the chat any personal data, your own or of third parties, that is not necessary.

4. Sharing with Third Parties

AegisX does not sell or transfer personal data collected through the Site to third parties for their own purposes. Data may be shared exclusively with:

• Technical service providers (hosting, Site maintenance, content delivery, usage statistics, virtual assistant; see also section 5): they act as Data Processors under art. 28 GDPR on the basis of specific contractual agreements
• Competent authorities: exclusively in the event of a legal obligation or an order from a judicial or administrative authority

5. Data Transfers Outside the EU

Personal data collected through the Site is processed on servers located in Italy and in the European Union, with the exceptions listed below, for which data may also be processed outside the European Union, in particular in the United States:

• Google LLC: messages written to the virtual assistant (Gemini API); the visitor's IP address, for loading fonts (Google Fonts); only with the user's consent, usage data collected by Google Analytics 4. Google LLC participates in the EU-U.S. Data Privacy Framework, which is the subject of the European Commission adequacy decision of July 10, 2023 (art. 45 GDPR); where necessary, the Standard Contractual Clauses apply (art. 46 GDPR).
• Automattic Inc.: Jetpack services used by the Site, including the delivery of images and static files, internal search and, only with the user's consent, visit statistics. The transfer is governed by the Standard Contractual Clauses adopted by the European Commission with Decision 2021/914 (art. 46 GDPR).

Apart from these cases, there are no systematic transfers of personal data to third countries. Any new tools involving transfers outside the EU will be listed in this section, together with the relevant safeguards under arts. 44-49 GDPR.

6. Retention Period

7. Data Subjects' Rights

Under arts. 15-22 GDPR, data subjects have the right to:

To exercise your rights, simply send a request to privacy@aegisx.ai or by PEC to aegisxsrl@pec.it. AegisX replies within 30 days of receipt, extendable to 90 days for complex requests (with notice of the extension within the first 30 days).

8. Complaints

Data subjects who believe that the processing of their data does not comply with the law have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

• Website: www.garanteprivacy.it
• Email: garante@gpdp.it
• PEC: protocollo@pec.gpdp.it
• Address: Piazza Venezia 11, 00187 Rome, Italy

9. Data Security

AegisX adopts technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encrypted connections via the HTTPS/TLS protocol for all communications between user and server
• Data access restricted to authorized staff with personal credentials
• Monitoring systems to prevent unauthorized access
• Regular data backup procedures

10. Changes to This Notice

AegisX reserves the right to update this notice to reflect regulatory or operational changes. The latest version is always available on this page, with the date of the last update. Substantial changes will be notified to registered users by email with at least 15 days' notice.

11. Contacts