Privacy notice
Draft notice requiring legal review before final publication.
contact-v4
Controller and contact
NOVA-TREX S.R.L., Via Fornaci 28, 25040 Artogne (BS), Italia.info@novatrex.it.
Contact requests
The site offers phone/email and, when enabled on the German and French landings, a contact form also available without JavaScript. The form requires full name, company, email, phone and acknowledgement of this notice to handle your request and contact you. Locale, CTA placement, optional service, notice version and a technical request reference/date accompany the submission. There is no free-text message, attachment or marketing subscription. Without the required fields and acknowledgement, the form cannot be submitted; you can still use phone or email. The required checkbox acknowledges this notice for the request; it is not consent to marketing or optional tracking. The legal basis and suitability of the required checkbox remain subject to legal approval.
Delivery, hosting and recipients
Cloudflare hosts the site and Function and supports security and abuse prevention; it processes necessary network data, including IP addresses. Resend delivers the form data by email to the business inbox info@novatrex.it, using the visitor’s validated email as Reply-To. Success means Resend accepted the email, not that the inbox received it. Provider and mailbox processing is separate from D1 counters. Direct phone/email enquiries use the channel you choose.
Google Sheets enquiry register
When enabled, the integration sends contact details, locale, CTA placement, service, notice acknowledgement/version, technical reference and enquiry source from the server to Google Apps Script for recording in Google Sheets and handling enquiries. The sheet also stores a JSON copy of the data, a recording timestamp and a hash to recognise identical submissions. Form success then requires both email acceptance and webhook confirmation; an error can occur after the first acceptance. This enquiry handling is separate from Analytics/Ads and does not depend on optional cookies. Staff/appointed-party access, roles, Google agreements, retention, copies/exports, version history and transfers require approval; the sheet must not be publicly accessible.
Campaign attribution for enquiries
With a current advertising grant and measurement enabled, at submission we read only adg_ky, adg_ntw, adg_cmp and gclid from the landing query and associate them with contact data in the Google Sheets register. The gclid is a click identifier: this association is not anonymous. Missing, ambiguous or invalid fields stay empty. The source URL is limited to the canonical landing, without query or fragment. This feature does not store these values in cookies/localStorage, forward them to GTM/Analytics/Ads or add them to the email; they remain in memory for retry. Refusing advertising consent or using the form without JavaScript does not prevent contact, but excludes these advertising parameters. Withdrawal does not undo data already sent. Preference version 2 asks for a new choice rather than automatically reusing earlier grants.
D1 abuse counters
Limits are five attempts per IP per fixed ten-minute window and eighty globally per UTC day; retries and provider failures consume attempts. D1 stores counters, expiries and window-specific pseudonymous HMACs, not raw IPs, names, companies, emails, phone numbers or form contents. Expiry is logical: expired records are deleted on the next validated request, not by an automatic timed purge. On an idle site they may remain stored. Platform backups and logs are managed separately. The application does not log submitted fields; this does not rule out platform or provider logs. Retry data stays in page memory, with no persistent browser storage implemented.
Optional measurement and choices
Analytics and advertising measurement are separate opt-ins. On form landings, approved tags may be managed through Google Tag Manager (GTM); elsewhere direct Google integration remains. GTM manages tags, not blanket consent to every tag. Usage, contact clicks or provider-accepted requests may be measured only after the relevant choice. The success event contains only locale, CTA placement, optional enumerated service and consent states, never lead or form data. No enhanced conversions or collection for that purpose is implemented; ad personalisation stays denied. Requests remain available when all optional tracking is refused. No-JavaScript submissions do not generate this event. Versioned local preferences and withdrawal are described in the cookie notice.
Retention, transfers and rights — approval pending
Contact the controller to exercise applicable rights or request information. Before launch, confirm legal bases, field necessity, mailbox/provider/log/backup retention, contractual entities, processing agreements, subprocessors, regions and transfers with applicable safeguards. An EU sending region does not establish exclusively EU processing. This technical draft does not certify legal approval or signed agreements.