1. Data Controller
The Data Controller of the personal data collected through this site is:
Thrive-O S.r.l.
Via Mameli, 23/25 — 21049 Tradate (VA)
VAT no. IT 04032170120
Contact: privacy request form
[Art 13 par. 1 letter a) – Regulation (EU) 2016/679]
2. Types of data collected
2.1 Browsing data
The computer systems and software procedures that run this site acquire, in the normal course of their operation, some technical data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected in order to be associated with identified users, but which by its nature could, through processing and association with data held by third parties, allow users to be identified.
This category includes:
- IP addresses or domain names of the users’ computers and devices;
- URI/URL addresses of the resources requested;
- time of the request and method used;
- size of the file obtained in response;
- numeric code indicating the status of the server’s response;
- other parameters relating to the user’s operating system and computing environment.
2.2 Cookies and tracking technologies
The site uses technical cookies and, only if you consent in the banner, analytics cookies (Google Analytics 4). The banner does not record your IP address and saves nothing on the server: the choice stays in the thriveo_consent cookie in your browser. For detailed information please see the Cookie Policy.
2.3 Data provided voluntarily — contact form
Sending messages through the contact form involves the collection of the data in the form fields (usually name, email address and the text of the message) and of the proof that you accepted this notice: text shown, date and time, version. The message reaches us by email; the site does not save it in its own database and does not write personal data in its logs.
The data is processed exclusively to reply to the request sent by the user and is not used for marketing or profiling purposes.
2.4 Mailing list subscription
If you subscribe to the mailing list we collect your email address, your name (if the form asks for it), the lists you chose and the proof of consent: text shown, version, date and time of the subscription and of the confirmation, version of this notice. We do not keep your IP address.
The subscription requires a confirmation (double opt-in): you receive an email with a link that is valid, normally, for 48 hours, and you are subscribed only after you click it. The site talks to the mailing service (Listmonk, free software) on a private network on our servers in Italy: the service is not exposed to the Internet. Every email contains the links to unsubscribe and to manage your preferences. The full notice is in the newsletter privacy notice.
2.5 Preferences area
To manage your subscription (choose lists, unsubscribe from everything, download or delete your data) you ask for a one-time link by entering your email address. The link is sent to that address and is valid for 15 minutes. The site keeps only an irreversible code of the link and of the session, for the duration of the session (30 minutes of inactivity, at most 2 hours), and uses the technical cookie thriveo_prefs.
2.6 Protection against spam and abuse
The forms on the site are protected by Cloudflare Turnstile: the browser loads a script from challenges.cloudflare.com and Cloudflare receives your IP address and a verification code to establish whether the person submitting the form is a human. No cookies are used.
To limit repeated attempts the site counts requests for a short time, using irreversible codes of the IP address and of the email: the address itself is never saved.
[Art 7 par. 1 and Art 13 – Regulation (EU) 2016/679; Art 122 – Legislative Decree 196/2003]
3. Purposes and legal bases of the processing
| Data | Purpose | Legal basis |
|---|---|---|
| Browsing data (server logs) | Security and proper functioning of the site | Legitimate interest of the Controller art. 6(1)(f) GDPR |
| Analytics cookies (Google Analytics 4) | Statistical analysis of traffic | Consent of the data subject art. 6(1)(a) GDPR |
| Contact form data (name, email, message) | Reply to the user’s request | Pre-contractual measures at the request of the data subject art. 6(1)(b) GDPR |
| Mailing list subscription (email, name, proof of consent) | Sending the communications requested and proof of consent | Consent of the data subject art. 6(1)(a) GDPR |
| Preferences area (one-time link, session) | Allowing you to withdraw consent, access your data and delete it | Legal obligation art. 6(1)(c) GDPR (arts. 7, 15 and 17) |
| Spam protection (Cloudflare Turnstile, anti-abuse counters) | Security of the forms on the site | Legitimate interest of the Controller art. 6(1)(f) GDPR |
[Art 6 par. 1 letters a), b), c) and f), Art 7 and Art 13 par. 1 letters c) and d) – Regulation (EU) 2016/679]
4. How the data is processed
Personal data is processed with automated tools for the time strictly necessary to achieve the purposes for which it was collected. Adequate security measures are adopted to prevent loss, unlawful or incorrect use and unauthorised access. The data is not disseminated.
[Art 5 par. 1 letters e) and f) and Art 32 – Regulation (EU) 2016/679]
5. Recipients of the data
The site and the mailing service run on servers managed directly by Thrive-O and located in Italy: we do not use a hosting provider. Personal data may be communicated, as Data Processors under art. 28 GDPR, to the following parties:
- Netsons S.r.l. — provider of the sending service for the site’s emails (form replies, subscription confirmations, one-time links, communications). Netsons privacy policy
- Cloudflare, Inc. — Cloudflare Turnstile anti-spam service. It receives the IP address and the verification code when a form is used. Cloudflare privacy policy
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — provider of the Google Analytics 4 service, only if you consent to analytics cookies. Data collected may be transmitted to servers located in the United States of America. Google privacy policy
The data is not transferred to third parties for commercial purposes nor communicated to parties outside the categories indicated.
[Art 13 par. 1 letter e) and Art 28 – Regulation (EU) 2016/679]
6. Transfers to third countries
The use of Google Analytics 4, if you consent, may involve the transfer of data to Google LLC (USA). This transfer is governed by the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR) and by Google LLC’s adherence to the EU-US Data Privacy Framework, recognised as an adequate protection mechanism by the European Commission’s adequacy decision of 10 July 2023.
The use of Cloudflare Turnstile involves sending the IP address to Cloudflare, Inc. (USA). The transfer takes place with the safeguards described by Cloudflare in its privacy policy.
For more information on Google: policies.google.com/privacy
[Art 13 par. 1 letter f), Art 44, Art 45 and Art 46 – Regulation (EU) 2016/679]
7. Retention periods
| Data | Retention period |
|---|---|
| Browsing data (server logs) | No longer than 30 days |
| Choice in the cookie banner | 12 months, in your browser (thriveo_consent cookie) |
| Analytics cookies — event data (GA4) | 2 months |
| Analytics cookies — user data (GA4) | 14 months |
| Contact form data (emails received in the mailbox) | Kept for the time necessary to manage the communication and to allow any future reference, with no predefined term. The data subject can request deletion at any time through the privacy request form. |
| Mailing list subscription (email, name, proof of consent) | Until you ask for your data to be deleted, which you can do at any time from the preferences area. If you only unsubscribe, the record stays marked as unsubscribed, so that you are not contacted again, until you ask for deletion. |
| Confirmation links and one-time preferences links | Validity: normally 48 hours (confirmation) and 15 minutes (preferences); each link can be used once |
| Preferences area session | 30 minutes of inactivity, at most 2 hours |
| Anti-abuse counters | For the length of the checking window, from 10 minutes to 1 hour depending on the form |
[Art 5 par. 1 letter e) and Art 13 par. 2 letter a) – Regulation (EU) 2016/679]
8. Rights of the data subject
You can ask us at any time to exercise your rights. Click a card to read what it means and how to ask.
- Art. 15 GDPRAccess to your data
- Art. 16 GDPRRectification of inaccurate data
- Art. 17 GDPRErasure of data
- Art. 18 GDPRRestriction of processing
- Art. 20 GDPRData portability
- Art. 21 GDPRObjection to processing
- Art. 7 GDPRWithdrawal of consent
- Art. 22 GDPRHuman intervention and challenge
Art. 15 GDPR
Access to your data
You have the right to know whether we process your data and to receive a copy of it.
1. What you can ask us
You can ask us whether we process data about you. If we do, you can receive a copy.
Which data we collect and where it comes from is explained in the privacy notice.
[Art 15 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 16 GDPR
Rectification of inaccurate data
You have the right to have inaccurate or incomplete data about you corrected.
1. What you can ask us
You can ask us to correct inaccurate or incomplete data.
The data we process is listed in the privacy notice.
[Art 16 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 17 GDPR
Erasure of data
You have the right to ask us to erase your data when it is no longer needed or when the processing is unlawful.
1. What you can ask us
You can ask us to erase the data when it is no longer needed or when the processing is unlawful.
At the end of the retention periods we delete the data or make it anonymous, unless required by law. The periods are in the table of the privacy notice.
[Art 17 and Art 5 par. 1 letter e) – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 18 GDPR
Restriction of processing
You have the right to ask us to restrict the processing of your data in the cases provided for by law.
1. What you can ask us
You can ask us to restrict the processing of your data in the cases provided for.
The purposes for which we process the data are in the privacy notice.
[Art 18 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 20 GDPR
Data portability
You have the right to receive the data you have given us and to transfer it to another controller.
1. What you can ask us
You can ask us to receive the data you have given us in a structured format and to transmit it to another controller.
It applies if the processing is based on contract or consent and is automated. The legal basis of each purpose is in the table of the privacy notice.
[Art 20 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 21 GDPR
Objection to processing
You have the right to object to the processing of your data based on legitimate interest.
1. What you can ask us
You can object to processing based on legitimate interest, on grounds relating to your situation.
The purposes based on legitimate interest are indicated in the table of the privacy notice. You can also object to the use of artificial intelligence on your data: it is explained in the artificial intelligence notice.
[Art 21 – Regulation (EU) 2016/679; Art 4 – Law 132/2025]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 7 GDPR
Withdrawal of consent
You can withdraw your consent at any time.
1. What you can ask us
Withdrawal does not affect processing that has already taken place.
We ask for consent for audio and video recordings, when we record for purposes other than the consulting. You can also ask not to be recorded or for the recording to be stopped: we carry on without recording your part.
[Art 7 par. 3 and Art 21 – Regulation (EU) 2016/679]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Art. 22 GDPR
Human intervention and challenge
You have the right to ask for a person to intervene, to express your view and to challenge an evaluation.
1. What you can ask us
We do not take decisions based solely on automated processing.
Participant evaluations start from a draft written by us, are processed with artificial intelligence tools and are then fully verified by Fabio Cocchi. On particularly sensitive topics, a second person at Thrive-O also steps in.
How we use artificial intelligence is explained in the artificial intelligence notice.
[Art 22 par. 3 – Regulation (EU) 2016/679; Art 4 – Law 132/2025]
How to ask
Send the request with the form. We reply within one month, extendable by two months in complex cases, and we will let you know. The reply is free of charge.
If we have doubts about your identity, we may ask you to confirm it. If you work for a client, you can contact us directly.
[Art 12 – Regulation (EU) 2016/679]
2. If you disagree with the reply
If you believe the processing breaches the rules, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or go to the courts.
[Art 77 – Regulation (EU) 2016/679; Art 141 – Legislative Decree 196/2003]
Privacy request
Fill in the form and choose the subject. The request goes directly to the person in charge, Fabio Cocchi.
Withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.
Exercising your rights
If you are subscribed to the mailing list you can unsubscribe with the link in every email and, from the preferences area, download your data or delete it. In all other cases use the privacy request form.
The Controller will reply within 30 days of receiving the request, as provided by art. 12 GDPR.
The request goes directly to the person in charge, Fabio Cocchi.
[Art 12, Art 15, Art 16, Art 17, Art 18, Art 20, Art 21, Art 7 par. 3, Art 22 par. 3 – Regulation (EU) 2016/679]
9. Right to lodge a complaint
The data subject has the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) if they believe that the processing of their personal data infringes Regulation (EU) 2016/679.
Italian Data Protection Authority (Garante Privacy) — www.garanteprivacy.it
[Art 13 par. 2 letter d) and Art 77 – Regulation (EU) 2016/679; Art 2-bis and Art 141 – Legislative Decree 196/2003]
10. Changes to this notice
The Controller reserves the right to change this notice at any time, informing users by publication on this page with the date of update. You are therefore invited to consult this page periodically.