Privacy notice
Last updated:
This page explains what personal data the Orafila website processes, why and for how long, as required by Article 13 of the EU General Data Protection Regulation 2016/679 (GDPR). It covers everyone who visits the site, including the documentation pages, and everyone who writes to us through the contact form.
- No profiling cookies, no visitor analytics, no advertising.
- The data from the form is only used to reply to you, and we never sell it.
- Google Fonts and jsDelivr only load if you accept them.
- You can see, correct or delete your data whenever you like by writing to us.
1. Who the controller is
The data controller, meaning whoever decides how and why the data is used, is:
Orafila · [to be completed: company name, registered office and VAT number]
Email for all privacy requests: sindistafa98@gmail.com
2. What data we process and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Browsing: IP address, browser and operating system, page requested, date and time, referring site | To show you the pages and protect the site from abuse and attacks | Legitimate interest in keeping the site working and secure (Art. 6(1)(f) GDPR) | In Cloudflare's technical logs, for as long as strictly necessary for these purposes |
| Contact form: full name, company, work email, phone if you give it, number of people, what you're interested in, message, page and language you write from, date and time | To reply to you, arrange the demo and tell you how to get started with Orafila | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) | 24 months from the last contact. If you become a customer, for the length of the relationship and then for the periods required by law |
| Consent choice: fonts and 3D animations yes or no, with the date | To respect your choice without asking on every page | It stays in your browser and we never receive it; it is strictly necessary, so it needs no consent (Article 122 of the Italian Privacy Code) | 6 months, then we ask again |
| Fonts and 3D animations: IP address and technical details about your browser, received by Google Fonts and jsDelivr | To show the site with its typefaces and the 3D scenes on the home page | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time | According to Google's and jsDelivr's own rules: we never receive this data |
The figures you enter in the “What the training you won't need would cost” calculator stay in your browser: they never reach us and we don't store them. The site is aimed at businesses and does not knowingly collect data from children.
3. What happens if you don't give us the data
We need your full name, company and email to reply to you: without them the form won't send. Everything else is optional. If you decline the fonts and 3D animations, the site works just the same, with your device's fonts and no animations.
4. Who receives the data
Requests from the form are only read by the people at Orafila who reply to them. Beyond them, the data reaches:
- Cloudflare, Inc. (United States), which hosts the site on Cloudflare Pages, stores the form requests in the Cloudflare D1 database and protects the site from abuse. It processes the data on our behalf, as a processor (Art. 28 GDPR), under its data processing agreement. Your browser may also send Cloudflare technical reports about connection errors (Network Error Logging).
- The tools we use to handle requests, if we connect them to the form: for example a CRM, or an automation service that tells us when a new request arrives. They too process the data on our behalf, as processors.
- Google Ireland Limited (Google Fonts) and Volentio JSD Limited (jsDelivr), only if you accept the fonts and 3D animations. They receive the data directly from your browser and process it under their own privacy policies, from Google and jsDelivr. The details are in the cookie policy.
- The provider that handles Orafila's pricing and payments, if you decide to buy: we tell you who it is before you purchase, and it processes the data you give it under its own privacy policy. The site does not take payments or card details.
- Public authorities, only where the law requires it.
We don't sell your data, we don't hand it over for advertising, and we don't sign you up to newsletters without asking.
5. Data outside the European Union
Cloudflare and Google may also process data in the United States. They do so with the safeguards the GDPR requires: both are part of the EU-US Data Privacy Framework, which the European Commission found adequate on 10 July 2023, and Cloudflare's data processing agreement also includes the Commission's standard contractual clauses. jsDelivr is based in the United Kingdom, which the European Union recognises as providing an adequate level of protection, and delivers files from servers around the world.
6. Your rights
You can ask us at any time to:
- tell you what data we hold about you and give you a copy (Art. 15 GDPR);
- correct or complete it (Art. 16);
- delete it (Art. 17);
- restrict how it is used (Art. 18);
- give it to you in a machine-readable format, so you can take it elsewhere (Art. 20);
- stop processing based on legitimate interest (Art. 21);
- withdraw your consent to the fonts and 3D animations, from “Cookie preferences” at the bottom of the page: it applies from that moment.
Write to sindistafa98@gmail.com: we reply within one month, as the GDPR requires. If you think we are handling your data incorrectly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority in the country where you live or work.
7. How we protect the data
The site only opens over HTTPS. Its security headers stop it being loaded inside other sites and only allow scripts and fonts from the services listed here. Form requests can only be read by whoever manages the site's Cloudflare account. To stop spam, the form uses a hidden field rather than a CAPTCHA that tracks whoever fills it in.
8. No automated decisions
The site makes no automated decisions about you and does not profile you. The AI agents described on the home page work inside the business software, not on the website: the conversations you see are pre-written examples, and the form does not pass your data to any artificial intelligence system.
9. Data entered into the business software
This notice covers the website. The data a customer company enters into Orafila (its own customers, contacts and employees) is processed by that company as controller, and by Orafila on its behalf as processor, under the service contract and the data processing agreement. The security measures and the providers involved are described in the documentation, under Security and privacy.
10. Changes to this notice
If the way we process data changes, we update this page and the date at the top. If we add an external service, the banner asks for your consent again before loading it.