This policy explains what personal data we process when you visit kosmoy.com or deal with us as a business contact, why we process it, for how long, and what you can do about it. It is given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Italian Privacy Code), as amended by Legislative Decree 101/2018.
Who is responsible for your data
The data controller is Libeccio Ventures S.r.l., owner of the Kosmoy® trademark, Piazza Borromeo 14, 20123 Milan, Italy. VAT nr. IT11416660967. PEC: libeccioventures@pec.it. Email: info@kosmoy.com.
We have not appointed a Data Protection Officer: the law does not require one for our activities. Send any privacy question or request to info@kosmoy.com or to our PEC address.
What this policy covers
Visitors to kosmoy.com, people who book a demo or write to us, job applicants, and the staff of our customers and suppliers. It does not cover the data our customers process with the Kosmoy platform: there the customer decides what is processed, and we act as its processor under the Data Processing Addendum. Self-hosted deployments run in the customer's own infrastructure.
What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering the website and keeping it secure | IP address, browser and device type, page requested, date and time, referring page (server logs) | Legitimate interest in running a working, secure website (Art. 6(1)(f) GDPR) | 30 days, longer only while investigating a specific security incident |
| Recording your cookie choice | The categories you allowed or refused and the date of your choice, stored in your browser | Legal obligation to be able to show that consent was given (Art. 6(1)(c) and Art. 7(1) GDPR) | 6 months |
| Measuring how the site is used (Google Analytics) | Pages viewed, clicks on demo and email links, device and browser, approximate location derived from the IP address, an online identifier; for a meeting booked in the embedded calendar, a one-way hash of the Calendly booking reference | Your consent (Art. 6(1)(a) GDPR; Art. 122 Italian Privacy Code) | Up to 14 months in Google Analytics, then deleted automatically |
| Measuring the results of our ads (Google Ads, Microsoft Advertising) | Ad click identifier, whether a demo was booked, an online identifier, IP address; if you also allowed analytics, the same one-way hash of the Calendly booking reference, as the conversion's transaction ID | Your consent (Art. 6(1)(a) GDPR; Art. 122 Italian Privacy Code) | Cookies last up to 13 months (see the Cookie Policy); Google and Microsoft keep conversion reports under their own policies |
| Showing embedded videos, ours and event organisers' (YouTube), and the booking calendars for demos and event meetings (Calendly) | IP address, device and browser data, what you watch or book on those services | Your consent (Art. 6(1)(a) GDPR; Art. 122 Italian Privacy Code) | Set by Google and Calendly under their own privacy policies |
| Answering demo requests and emails | Name, work email, company, company size, role, phone number if you give it, how you heard about us, your message and notes from the call | Steps you asked for before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR) | 24 months after our last contact, unless it becomes a contract |
| Contracts, invoices, customer support and supplier management | Contact details of customer and supplier staff, contract and billing data, support requests | Our legitimate interest in managing the contract and the business relationship with your employer (Art. 6(1)(f) GDPR); performing the contract where you are a party yourself (Art. 6(1)(b) GDPR); tax and accounting obligations (Art. 6(1)(c) GDPR) | 10 years after the contract ends (Art. 2220 Italian Civil Code) |
| Job applications sent to jobs@kosmoy.com | Your CV and anything you choose to send | Steps you asked for before a contract (Art. 6(1)(b) GDPR) | 12 months after the selection closes, unless you agree to a longer period |
If you work for one of our customers or suppliers, we receive your name and business contact details from your employer, or from you when you write to us.
If a dispute arises, we keep the data needed to establish or defend our rights until it is settled and the limitation period has run out (legitimate interest, Art. 6(1)(f) GDPR). When a retention period ends, we delete the data or make it anonymous.
When you have allowed analytics and book a meeting through the embedded calendar, we record a one-way hash of the Calendly booking reference with the analytics event for that booking and, if you also allowed advertising measurement, with the Google Ads conversion as its transaction ID. We use it only to count each booking once and to match it to our booking records.
The “Rather write first?” form on the demo page only prepares an email in your own email app. The site neither sends nor keeps your message; we receive it only if you send that email. If you have allowed analytics, we record that a draft was prepared, without its content.
Giving us your data for a demo or a job application is your choice. Without a name and a work email we cannot schedule a call or reply. We make no decisions about you based solely on automated processing, including profiling.
Cookies
Apart from storage that is strictly necessary, nothing is set or loaded in your browser until you choose in the cookie banner, or until you press a video's play button or “Show available times”, which allows only YouTube or only Calendly. Rejecting is as easy as accepting, and you can change your choice at any time from “Cookie settings” at the bottom of every page. The full list is in the Cookie Policy.
Who receives your data
We share personal data with providers that help us run the website and the business. Hosting, email, CRM and office software providers, and Calendly for the meetings you book with us, process it on our behalf under data processing agreements (Art. 28 GDPR). Through this website, Google, Microsoft and Calendly receive data only with your consent: through the tools you allow in the cookie banner or, for YouTube and Calendly, when you press a video's play button or “Show available times”. For the data their tags and cookies collect, they also act under their own privacy policies.
- Scaleway SAS — Website hosting. Servers in Milan, Italy.
- Google Ireland Ltd / Google LLC — Tag Manager, Analytics, Ads and YouTube (only with your consent). EU and USA.
- Microsoft Ireland Operations Ltd / Microsoft Corp. — Microsoft Advertising (only with your consent). EU and USA.
- Calendly LLC — Booking calendars for demos and event meetings (load only with your consent) and the meetings you book. USA.
- Email, CRM and office software providers — Handling our correspondence and business contacts, under data processing agreements. EU and USA.
We may also share data with our professional advisers (lawyers, accountants, auditors), with public authorities when the law requires it, and with a buyer or successor if the business is sold or merged. We do not sell personal data.
Transfers outside the European Union
Google LLC, Microsoft Corp., Calendly LLC and some of our other software providers are based in the United States. Transfers to them rely on the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for providers certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Arts. 45-46 GDPR).
Members of our team work from New York, Buenos Aires, Belgrade, Dubai and Singapore and may access business contact data. Argentina is covered by an EU adequacy decision; for the other countries we use the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards in place.
Your rights
Under Articles 15 to 22 GDPR you can ask us to:
- tell you whether we process your data and give you a copy;
- correct data that is wrong or incomplete;
- delete your data;
- restrict how we use it;
- give you the data you provided in a machine-readable format;
- stop processing based on our legitimate interest, if you object on grounds relating to your situation.
Where we rely on your consent, you can withdraw it at any time. This does not affect processing that took place before. For cookies, use “Cookie settings” at the bottom of every page.
Write to info@kosmoy.com or libeccioventures@pec.it. We reply within one month, extendable by two further months for complex requests, in which case we tell you why.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live or work.
Changes to this policy
We update this policy when our processing changes. The date at the top shows the current version. If a change affects a choice you made about cookies, the banner asks you again.
Contact
Libeccio Ventures S.r.l. (Kosmoy®)
Piazza Borromeo 14, 20123 Milan, Italy
VAT nr. IT11416660967
PEC: libeccioventures@pec.it
Email: info@kosmoy.com
Sales: sales@kosmoy.com