Privacy Policy
Last updated: August 9, 2026
This Privacy Policy describes how personal data of users visiting optiwize.cloud, the preview site beta.optiwize.cloud and their related subdomains (the "Site") is processed, pursuant to Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended ("Italian Privacy Code").
1. Data Controller
The data controller is evoseed S.r.l., registered office at Via Lucrezio 13 — 34134 Trieste (TS), Italy, VAT/Tax ID 01361650326, REA TS-208336, certified email [email protected], contact email [email protected].
The controller is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. For any privacy-related request, please contact the controller at the addresses above.
2. Categories of data processed
The Site processes only data voluntarily provided by the user or generated automatically by navigation:
- Business contact data — name, surname, company name, email address, phone number, role, subject and content of the message. Collected via the "Contact" form.
- Data for OptiWize Cloud free-trial activation — name, surname, email address, company name, phone, role, estimated number of MikroTik devices managed, UTM parameters of the originating campaign, preferred language, privacy consent and (optional) marketing consent. Collected via the "Free 30-day Trial" form.
- Newsletter subscription data — email address, collected via the subscription form in the page footer.
- Technical security data — IP address, user agent, request timestamps, processed solely for security and abuse-prevention purposes and retained for no more than 30 days.
The Site does not use profiling cookies, third-party marketing cookies, third-party analytics tools or advertising pixels. For details on the technical cookies used, please refer to the Cookie Policy.
For traffic statistics the controller uses Umami, an analytics platform self-hosted on its own servers and configured in cookieless mode: it sets no cookies, uses no persistent identifiers and does not store IP addresses. The resulting data is pseudonymous, used in aggregate form, and does not allow the user to be identified. As the processing involves neither profiling nor storage of information on the user's device, the legal basis is the controller's legitimate interest (Art. 6(1)(f) GDPR) in understanding how the Site is used.
No special categories of data (Art. 9 GDPR) and no data of minors are processed. The Site is not addressed to subjects under the age of 16.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Reply to requests sent through the "Contact" form and manage the resulting pre-contractual or commercial relationship. | Art. 6(1)(b) GDPR (pre-contractual measures upon request of the data subject). |
| Activate the 30-day OptiWize Cloud free trial, create the dedicated account, send credentials, manage service communications during and at the end of the trial. | Art. 6(1)(b) GDPR (pre-contractual measures). |
| Send commercial communications, sales follow-up and newsletter with product updates and content. | Art. 6(1)(a) GDPR (explicit consent, revocable at any time). |
| Ensure Site security, prevent fraud, log access to the trial service and comply with legal obligations. | Art. 6(1)(c) and (f) GDPR (legal obligation and legitimate interest of the controller). |
| Retain accounting and tax records following the activation of paid services. | Art. 6(1)(c) GDPR (legal obligation, Italian tax law). |
4. Processing methods
Processing is carried out using IT systems, with access restricted to authorised personnel of the controller and its technical providers. Data is transmitted over encrypted connections (HTTPS/TLS). Appropriate technical and organisational measures are adopted to ensure a security level proportionate to the risk (Art. 32 GDPR), including access control, activity logging, periodic backups and environment segregation.
5. Retention period
- Contact form data — kept in the internal database for up to 24 months from collection; in the CRM system (Pipedrive) for the duration of the commercial relationship or until the data subject requests deletion.
- Trial form data — kept for the duration of the trial (30 days) and for a further 24 months from the end of the trial for sales follow-up purposes, unless revoked. If the user subscribes to a paid plan, data is kept for the duration of the contract and afterwards for the legally required periods (10 years for accounting and tax purposes).
- Newsletter subscription — until consent is withdrawn or the user unsubscribes.
- Technical security logs — no more than 30 days from creation.
After these periods, data is irreversibly deleted or anonymised, subject to legal obligations or the need to establish or defend a legal claim.
6. Disclosure and external Processors
Personal data is not disclosed to undefined recipients. It may be shared, within the limits of the purposes above, with the following entities, appointed as data Processors under Article 28 GDPR:
- Hetzner Online GmbH (Gunzenhausen, Germany) — hosting of application infrastructure.
- Cloudflare, Inc. (San Francisco, USA) — CDN, DNS and attack mitigation.
- Pipedrive OÜ (Tallinn, Estonia) — commercial CRM for the management of requests received via the Contact form.
- SMTP providers used for transactional email delivery (trial confirmations, service communications), based in the EU.
- Consultants, professionals or companies providing outsourced services to the controller (tax, legal, IT advisors), strictly within the purpose for which they are involved.
The up-to-date list of Processors is available upon request to [email protected].
7. Data transfers outside the EU
Cloudflare, Inc. is based in the United States. The transfer complies with Articles 44 et seq. GDPR, on the basis of the EU-US Data Privacy Framework adequacy decision (Decision (EU) 2023/1795 of 10 July 2023), to which the provider has adhered, and of the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914). Supplementary measures of encryption in transit and at rest are adopted.
8. Data subject rights
Under Articles 15-22 GDPR, the data subject has the right to:
- access their personal data and obtain a copy;
- request rectification, update or supplementation;
- obtain erasure (right to be forgotten), in the cases provided by law;
- restrict processing or object to processing based on legitimate interest;
- receive their data in a structured format and port it to another controller;
- withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal;
- lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the competent supervisory authority in the EU member state of habitual residence.
Requests should be sent to [email protected]. The controller will respond within 30 days, extendable by a further 60 days in complex cases (Art. 12(3) GDPR).
9. Automated decision-making
The controller does not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects the data subject (Art. 22 GDPR).
10. Changes to the Privacy Policy
This Privacy Policy may be updated as a result of regulatory, organisational or technical changes. Previous versions are kept by the controller. Users are invited to consult this page periodically; material changes will be communicated on the Site. For the Trial Terms of Service please refer to the Terms of Service page.