Privacy Policy
Oxabyo S.p.A. Società Benefit ("Oxabyo"), with registered office at Via Salaria 292, 00199 Rome (RM), Italy, as Data Controller, hereby informs you pursuant to EU Regulation 2016/679 ("GDPR") that personal data collected through this website will be processed in the ways and for the purposes described below.
For information on cookies and tracking technologies, see our Cookie Policy.
1. Data Controller
Oxabyo S.p.A. Società Benefit — Registered office: Via Salaria 292, 00199 Rome (RM), Italy — Email: privacy@oxabyo.com — PEC: oxabyo@pec.it.
2. Categories of data collected
(a) Browsing data: information whose transmission is implicit in Internet protocols (IP address, user-agent, visited pages, timestamps), processed solely for the technical duration required to deliver the site. (b) Data provided voluntarily: identification and contact data entered in the forms (first name, surname, email, company, role, subject and content of the message). (c) Data collected in the reserved investor form: in addition, declaration of qualified-investor status and nature of the interest.
3. Purposes and legal basis of processing
(i) Response to enquiries submitted through the Contact form — legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR). (ii) Handling of requests for access to the reserved data room — legal basis: explicit consent of the data subject (Art. 6.1.a GDPR). (iii) Compliance with legal obligations — legal basis: Art. 6.1.c GDPR. Provision of data is optional; refusal makes it impossible to respond to the enquiry.
4. Processing methods
Data is processed by electronic means, adopting technical and organisational measures appropriate to ensure a level of security suitable to the risk (Art. 32 GDPR). No automated decision-making or profiling is carried out.
5. External processors
To deliver the site and manage communications, Oxabyo relies on the following providers, appointed as Data Processors under Art. 28 GDPR: (a) InPublish S.r.l. — sending of transactional emails generated by the contact forms (InPortal service); (b) Cloudflare, Inc. — hosting, CDN and site protection; (c) Lovable AB — site delivery and build platform. An up-to-date list of processors is available on request at privacy@oxabyo.com.
6. Transfers of data outside the EU
Some providers (in particular Cloudflare) may involve the transfer of personal data to third countries. Such transfers occur on the basis of the Standard Contractual Clauses adopted by the European Commission (decision 2021/914) and appropriate supplementary measures, guaranteeing a level of protection equivalent to that provided by the GDPR.
7. Retention periods
(a) Emails generated by the Contact form: 24 months from the last useful contact. (b) Reserved data-room access requests: 36 months from the last contact, subject to further retention for legal-defence purposes. (c) Technical site logs: maximum 12 months.
8. Disclosure and dissemination of data
Data is neither disseminated nor sold to third parties for marketing purposes. It may be communicated to the processors listed in point 5, to competent authorities upon request, and to professional advisors bound by confidentiality.
9. Rights of the data subject
Pursuant to Articles 15-22 GDPR the data subject has the right to: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent (without retroactive effect). There is also the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). To exercise these rights: privacy@oxabyo.com.
10. Changes to this notice
Oxabyo reserves the right to update this notice to reflect regulatory, technical or organisational changes. The current version is always published on this page together with the date of last update.
Last updated: 18 June 2026