Home / Legal

Privacy policy

How PCDUE processes the personal data of website visitors and of those who contact us.

Last updated: 31 October 2026

In the event of any discrepancy, the Italian version prevails.

1. Data controller

The data controller is PCDUE S.r.l., with registered office at Viale Sondrio 7, 20124 Milano (MI), Italy, VAT no. 14157570962.

Contact details:

2. What data we collect

Browsing data. Certain information is collected automatically during visits to the site: IP address, browser type, pages visited and access times. It is used for the technical operation of the site and, only with consent, for usage statistics through Google Analytics.

Data provided through the contact form. This is the data that users enter voluntarily: first name, surname, email address, telephone number, company name and the content of the message. It is sent to the administration team on Google Chat and is not stored on the site. PCDUE sends a confirmation email to the person who wrote, through Resend. The data is retained for the periods set out in section 6.

Data collected through MyBot. The content of conversations and any contact details provided while interacting with the virtual assistant. If an appointment is booked from the chat, the data entered for the booking is recorded in PCDUE’s calendar, which is managed with Google Calendar. If the user chooses to continue on WhatsApp, the conversation passes to the service provided by WhatsApp Ireland Limited, and WhatsApp’s terms and privacy policy also apply.

Cookies. Technical cookies necessary for the site to function and, only with consent, Google Analytics cookies for usage statistics. The site does not use profiling cookies. For details and to manage preferences, please refer to the Cookie policy.

3. Purposes and legal bases of processing

PurposeLegal basis
Responding to requests sent through the contact formPre-contractual measures (Art. 6(1)(b) GDPR)
Providing assistance through MyBot and managing appointments booked from the chatPre-contractual measures and legitimate interest (Arts. 6(1)(b) and 6(1)(f) GDPR)
Website usage statistics with Google AnalyticsConsent (Art. 6(1)(a) GDPR), which may be withdrawn at any time
Compliance with legal obligationsLegal obligation (Art. 6(1)(c) GDPR)

Providing data is optional, but it is necessary in order to respond to requests. Consent to Google Analytics is also optional: refusing it does not limit use of the site.

4. Information on the use of artificial intelligence

MyBot is a virtual assistant based on artificial intelligence. Pursuant to Article 50 of Regulation (EU) 2024/1689 (the “AI Act”), we inform you that you are interacting with an artificial intelligence system and not with a human operator, unless otherwise indicated during the conversation.

To generate its responses, MyBot uses artificial intelligence models from several providers, including Google’s Gemini: the text of conversations is transmitted to these providers, which process it on behalf of PCDUE as data processors.

Users are advised not to enter health data or other special categories of personal data, passwords or bank details in the chat.

5. Recipients of the data

Personal data may be disclosed to:

  • authorised PCDUE staff, within the scope of their respective duties
  • Vercel Inc., the website hosting and delivery provider, as data processor
  • Resend, Inc., the service that sends the confirmation email to the person who filled in the form, as data processor
  • Google, for Google Chat (the contact form message), for Google Analytics (only with consent), for the Gemini model used by MyBot and for Google Calendar, as data processor
  • the other providers of the artificial intelligence models used by MyBot, as data processors
  • public authorities, where required by law

We do not sell or disclose personal data to third parties for their own commercial purposes.

Transfers outside the EU. The hosting provider, Vercel Inc., is based in the United States and may also process browsing data outside the European Union, on the basis of the Standard Contractual Clauses adopted by the European Commission. Google services may also involve transfers to the United States: Google LLC participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023. Resend, Inc., which sends the confirmation email to the person who filled in the form, is also based in the United States and participates in the EU-U.S. Data Privacy Framework. If a provider of the artificial intelligence models used by MyBot processes data outside the European Union, the transfer takes place on the basis of an adequacy decision of the European Commission or of the Standard Contractual Clauses.

6. Retention periods

  • Contact form data: retained for as long as necessary to handle the request and in any case for no more than 12 months from the last contact, unless longer periods are required by law.
  • Conversations with MyBot and appointments booked from the chat: up to 12 months.
  • Google Analytics data relating to individual visits: up to 2 months, after which it is automatically deleted and only aggregate statistics remain.

At the end of the retention period, data is permanently deleted or irreversibly anonymised.

7. Rights of the data subject

Data subjects may exercise the following rights at any time:

  • access their personal data (Art. 15 GDPR)
  • request rectification of inaccurate data (Art. 16 GDPR)
  • request erasure in the cases provided for (Art. 17 GDPR)
  • request restriction of processing (Art. 18 GDPR)
  • object to processing based on legitimate interest (Art. 21 GDPR)
  • receive their data in a structured format and transmit it to another controller (Art. 20 GDPR)
  • withdraw consent at any time, where processing is based on consent

Requests should be sent to info@pcdue.com.

Data subjects may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) through its website www.garanteprivacy.it.

8. Security measures

PCDUE adopts appropriate technical and organisational measures to ensure a level of security proportionate to the risks, including encrypted communications, access control, system monitoring and regular backups, in accordance with the privacy by design principles set out in Article 25 of the GDPR.

9. Changes to this policy

This policy may be updated to reflect changes in legislation or in processing activities. Users are advised to consult it periodically.

10. Contact

PCDUE S.r.l., Viale Sondrio 7, 20124 Milano, Italy.