Privacy Policy
1. Data controller
Rossi Cristiana, sole proprietorship, VAT number IT02277310989. Address: Via Industriale 16, 25016 Ghedi (BS), Italy. REA registration number: 440518. Official contact for legal communications and privacy rights: info [at] tetrafoam [dot] it.
2. An informational website
Tetrafoam.it presents Tetrafoam® technology and its applications. It offers no purchases, registrations, contact forms, newsletters or request submissions. The website code integrates no Google Analytics, Google Ads, advertising pixels, profiling or visitor measurement tools, and embeds no externally loaded maps, videos, social widgets or testimonials. Images, stylesheets and scripts are served with the website; no remote fonts are requested.
If you write to the official contact address, the controller processes the sender’s address and the necessary message content to handle legal matters and privacy requests. The legal basis is compliance with legal obligations for requests to exercise data protection rights (Article 6(1)(c) GDPR) and, for other relevant communications, the legitimate interest in handling them and protecting rights (Article 6(1)(f) GDPR). The mailbox is hosted by Aruba. Messages are retained for as long as necessary to respond and document their handling, subject to applicable retention duties and the protection of rights. The email link adds no cookies or forms to the website.
3. Page delivery and technical security logs
The infrastructure receives the data needed for an HTTP request, such as IP address, date and time, requested resource and browser information transmitted with the request. Technical logs support service operation, error diagnosis and abuse prevention. They are distinct from the website usage statistics described in section 5; potentially deriving from the same data does not make the purposes equivalent.
For processing attributable to the controller, the legal basis is the legitimate interest in website availability and security under Article 6(1)(f) GDPR; this basis covers only necessary technical activities performed on the controller’s behalf. Transmission of necessary connection data is essential to view the pages. The controller introduces no automated decisions producing legal effects about visitors.
4. Cookies and browser storage
The verified application code does not read or write cookies and does not use localStorage, sessionStorage, IndexedDB or persistent identifiers. Language selection uses ordinary links and is not stored in the browser.
The __cf_bm cookie was observed on the public domain. Cloudflare sets it for security and bot protection and describes it as necessary for its automated traffic management services, expiring after 30 minutes of continuous inactivity. See the official Cloudflare cookie documentation.
This observation is not a complete inventory of hosting technologies and does not establish any identifiers used for Sites statistics. The cookie lifetime does not indicate log or statistics retention. The informational notice closes with “Got it”: it does not collect consent or store the choice.
5. Automatic ChatGPT Sites usage statistics
Sites documents automatic page-view and unique-visitor counts without requiring an analytics SDK in the website. These counts serve a purpose distinct from security logging.
The controller has installed no separate statistical or advertising tools and does not request statistics for commercial purposes. Not consulting a dashboard does not disable automatic platform processing.
6. Testimonials received directly from customers
The “Success stories” page presents testimonials received directly from customers and published with permissions already obtained, as confirmed by the controller. Only the approved text, initials, motorcycle model and, where included in the approved attribution, location are displayed. Full names, email addresses, customer photographs or complete messages beyond the approved text are not published.
The purpose is to present genuine experiences with seats made using Tetrafoam® technology. Publication respects the scope of the permissions received; for processing based on consent, the legal basis is Article 6(1)(a) GDPR. Initials and testimonial details are not described as necessarily anonymous data.
Authors may request removal of their testimonial and withdraw consent to publication through the controller’s privacy contact in section 1. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Content is retained within the authorised purposes and scope; the controller retains permissions to document what was authorised and handle any requests, for as long as necessary for those purposes and applicable obligations.
Testimonials are static text hosted on the website: they are not loaded through external platforms or widgets, and displaying them introduces no tracking tools.
7. Providers, retention and transfers
The website is hosted on ChatGPT Sites. The Sites Terms identify OpenAI Ireland Ltd. as the contracting entity for an operator located in the European Economic Area. OpenAI processes data entrusted to the service on the controller’s behalf under the Data Processing Addendum referenced by the Sites Terms.
The DPA provides for data return or deletion when the relationship ends, subject to legal retention duties, and for standard contractual clauses or adequacy decisions for transfers outside the EEA. These safeguards may be consulted in the DPA or requested from the controller. These general provisions do not by themselves establish how long individual logs or data used for statistics are retained.
The official OpenAI sub-processor list includes Cloudflare, Ltd. for content delivery and web hosting, including processing in the United States. The list expressly covers Sites for Plus and Pro users. Processing is therefore not described as exclusively European.
Aruba S.p.A. provides the official mailbox. Article 23 of its public Hosting and Domains terms provides for a processor role for data processed on the customer’s behalf, separate from Aruba’s own processing. Browsing this website does not load Aruba’s email service. Messages handled by the controller follow the retention criteria in section 2. The terms provide for data deletion or return when the service ends and for contractually bound sub-processors.
Authorised persons and providers access data within the scope of their respective activities; any disclosures to authorities take place as provided by law. Publishing only the authorised testimonials makes them accessible to website users and search engines.
8. Rights
Subject to the conditions and limits of the GDPR, individuals may request access, rectification, erasure and restriction, object to processing based on legitimate interests and obtain portability where its conditions apply. Where processing is based on consent, it may be withdrawn without affecting the lawfulness of prior processing. Requests may be sent to the controller’s privacy contact info [at] tetrafoam [dot] it.
A complaint may be lodged with the Italian Data Protection Authority: www.garanteprivacy.it.
9. Updates
Last updated: 21 October 2026. This notice is updated when the website’s processing changes.