Last updated: April 2, 2026

Notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") for users who browse and interact with the website www.keideacms.it (hereinafter, the "Site").

This notice describes how the Site is managed with regard to the processing of personal data of users who browse it and/or use the services offered therein. Keidea s.r.l., owner and developer of the proprietary KeideaCMS infrastructure, is committed to protecting users' privacy by applying high security standards, in line with the principles of Privacy by Design and Privacy by Default.

1. Data Controller

The Data Controller for personal data is:

Keidea s.r.l.

Registered Office: Via Fratelli Cervi 42, 75014 Grassano (MT)

Operating Offices: Via Matera 15, 75014 Grassano (MT) | Via Trento 11, 89048 Siderno (RC)

VAT No.: 01414110773

Contact email for privacy matters: info@keideacms.it

Email for Data Breach reports: databreach@keideacms.it

2. Types of Data Processed

While browsing and using the Site, we collect and process the following categories of data:

A. Browsing data

The computer systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category includes:

•IP addresses or domain names of the computers and terminals used by users.

•URI/URL addresses of the requested resources.

•The time of the request and the method used to submit the request to the server.

•The size of the file obtained in response and the numeric code indicating the status of the response given by the server (success, error, etc.).

•Other parameters related to the operating system and the user's computer environment (type of device, browser used).

This data is used solely to obtain anonymous statistical information on the use of the Site, to check that it is working properly, and to ascertain responsibility in the event of hypothetical computer crimes against the Site or our server infrastructure.

B. Data provided voluntarily by the user

The optional, explicit and voluntary sending of messages to the contact addresses indicated on the Site, as well as the completion and submission of the forms available (e.g. the "Contact Us" form or the "Free Audit" form), result in the acquisition of the sender's contact details, necessary to respond, as well as all personal data included in the communications.

Specifically, through the Site's forms we may collect:

•First and Last Name

•Company Name

•Email Address (work or personal)

•Phone Number

•URL of the website to be analyzed (for Audit requests)

•Content of the message or request

All data entered in the forms is natively processed by the KeideaCMS infrastructure, encrypted in the proprietary database, and does not pass in any way through third-party plugins or external systems not controlled by the Controller.

3. Purposes and Legal Basis of Processing

Personal data is processed for the following purposes:

Purpose and Legal Basis

Provision of the requested services: Responding to information requests, providing commercial consultancy, performing the Free Audit of the website indicated by the user.

Performance of a contract or pre-contractual measures (Art. 6, par. 1, letter b, GDPR).

Security and operation of the Site: Monitoring the proper technical functioning of the infrastructure, preventing and blocking cyber attacks (e.g. unauthorized access attempts, brute force, DDoS).

Legitimate interest of the Controller in ensuring the security of its own networks and systems (Art. 6, par. 1, letter f, GDPR).

Fulfillment of legal obligations: Complying with accounting, tax regulations or requests from the Judicial Authority.

Legal obligation to which the Controller is subject (Art. 6, par. 1, letter c, GDPR).

Statistical analysis and Marketing (subject to consent): Analyzing traffic on the Site and proposing relevant advertisements through third-party platforms (e.g. Google Ads, Meta Pixel).

Express consent of the user via the cookie banner (Art. 6, par. 1, letter a, GDPR).

4. Processing Methods and Data Security (The KeideaCMS Approach)

As developers of a proprietary CMS focused on maximum security, Keidea s.r.l. applies rigorous technical and organizational measures, superior to the standards of common Open Source CMS platforms.

Processing is carried out using IT and telematic tools, with logic strictly related to the stated purposes. The main security measures include:

•Hardened Architecture: The Site is built on an optimized LEMP stack, with a clear physical and logical separation between the front-end (public) and back-end (administrative).

•Database Protection: Exclusive use of parameterized queries to eliminate the risk of SQL Injection attacks. Sensitive data collected through forms is stored in encrypted form.

•No Third-Party Plugins: Unlike Open Source systems, KeideaCMS does not use external plugins or extensions for data management, eliminating the risks of vulnerabilities arising from code not directly controlled by our engineers.

•Firewall and Intrusion Prevention: Active traffic monitoring to automatically block malicious IPs and anomalies.

•Backup: Encrypted and redundant backup procedures to ensure data availability and resilience.

The servers hosting the Site and the related databases are physically located in Italy (and in any case within the European Economic Area - EEA), ensuring full compliance with European data protection regulations.

5. Data Recipients

Personal data will not be disclosed or sold to third parties. It may be made accessible exclusively to:

•Authorized personnel: Employees and collaborators of Keidea s.r.l. (e.g. software engineers, business consultants, IT staff), trained and bound by confidentiality obligations.

•Data Processors: Third parties carrying out outsourced activities on behalf of the Data Controller (e.g. hosting service providers in Italy, legal/tax consultants), appointed as External Data Processors pursuant to Art. 28 GDPR.

6. Transfer of Data Outside the EU

The management and storage of personal data take place on servers located in Italy. However, for specific statistical or marketing purposes (e.g. Google Analytics 4, Google Ads, Meta Pixel), some browsing data and online identifiers may be transferred to servers located in the United States.

This transfer takes place exclusively to providers adhering to the EU-US Data Privacy Framework (DPF) or through the signing of Standard Contractual Clauses (SCC) approved by the European Commission, ensuring an adequate level of protection.

7. Retention Period

Personal data will be retained for the time strictly necessary to achieve the purposes for which it was collected:

•Contact data and requests: Retained for the time necessary to process the request and, subsequently, for a maximum of 24 months, unless a contractual relationship is otherwise established.

•Browsing data and security logs: Retained for a maximum period of 6 months, unless necessary for the investigation of crimes by the Judicial Authority.

•Data collected through cookies: Please refer to the specific "Cookie Policy" section.

8. Data Breach Management

Despite KeideaCMS's hardened architecture, Keidea s.r.l. has put in place a rapid response procedure in the event of a personal data breach.

In the event of an anomalous event, the Data Controller, with the direct support of the IT Manager, will:

1.Immediately assess the extent of the breach and the data involved.

2.Isolate and neutralize the cyber threat.

3.Notify the breach to the Data Protection Authority within 72 hours, if the breach poses a risk to the rights and freedoms of the data subjects.

4.Promptly inform the users involved, if the risk is assessed as high, providing clear information on the measures taken and the relevant contacts.

9. Rights of the Data Subject

Pursuant to Articles 15-22 of the GDPR, the user has the right to:

•Obtain confirmation as to whether or not personal data concerning them exists and to access it.

•Request the updating, rectification or integration of inaccurate or incomplete data.

•Request the erasure of data ("right to be forgotten"), if the reasons provided by law exist.

•Request the restriction of processing.

•Object, in whole or in part, for legitimate reasons, to the processing of their data.

•Receive their data in a structured, commonly used and machine-readable format (data portability).

•Withdraw consent given at any time, without prejudice to the lawfulness of processing based on the consent given before its withdrawal.

To exercise these rights, the user may send a written communication to the email address: info@keideacms.it.

The data subject also has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) if they believe that the processing violates current regulations.

10. Cookie Policy

The Site uses cookies and similar technologies to ensure the proper functioning of the pages, improve the user experience and, subject to consent, analyze traffic and provide personalized ads.

Consent management is natively integrated into the KeideaCMS infrastructure (without the use of vulnerable external plugins), ensuring the preventive blocking of unnecessary cookies until the user's explicit acceptance.

Types of Cookies used:

1. Technical Cookies (Strictly Necessary)

These are essential for the proper functioning of the Site (e.g. maintaining the session, saving privacy preferences). They do not require user consent.

2. Analytics Cookies

Used to collect information, in aggregate form, on the number of users and how they visit the Site.

•Google Analytics 4 (GA4): Configured with IP address masking to reduce identifying power.

3. Profiling and Marketing Cookies

Used to track user browsing and create profiles aimed at sending advertising messages in line with expressed preferences. They are activated only upon explicit consent.

•Google Ads

•Meta Pixel (Facebook)

Managing preferences

Users can change their cookie choices at any time by clicking the "Manage Cookies" button in the Site's footer. It is also possible to configure your browser to reject all cookies or to receive a notification when a cookie is sent.

11. Changes to this Policy

The Data Controller reserves the right to make changes to this Privacy Policy at any time, informing users on this page. Please check this page regularly, referring to the last modified date shown above.