Legal notice
Privacy Policy
Last updated:
This notice explains how New Energy S.r.l. processes the personal data of visitors to www.newenergyitaly.com (the “Website”) and of anyone who contacts the company through the channels listed here, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”), as amended by Legislative Decree 101/2018.
1. Data controller
The data controller is New Energy S.r.l., with registered office at Via dei Cignoli 9, 20151 Milano, Italy — VAT no. IT02358790695, Companies Register (REA) MI-2668838, certified e-mail (PEC) newenergyitaly@servercertificato.it.
For any request concerning your personal data you can write to info@newenergyitaly.com or send a letter to the registered office. Toll-free number (Italy): 800 168632.
2. What data we process
- Browsing data. The systems that run the Website collect, during normal operation, some data whose transmission is implicit in the use of Internet protocols: IP address, browser and device type, pages requested, time of the request, response code. They are used only to operate the Website, to produce anonymous statistics and to check its security; they are kept for the time strictly necessary, unless they are needed to establish liability in the event of unlawful acts.
- Data you provide voluntarily. By filling in the Website forms (consultation or contact request: first name, last name, e-mail, phone, city, message; spontaneous application: first name, last name, e-mail, phone, city, professional profile, CV and anything you write in the message; technical support request: first name, last name, e-mail, phone, preferred time for a call back, address, municipality and province of the system, the system owner if different, customer type, whether the system was installed by New Energy, system type and installation year, brand, model and serial number of the device, problem type, display code, description of the problem, what you have already tried and up to 3 photos) or by writing to us, calling the toll-free number or contacting us on WhatsApp at the published numbers. Please do not include in forms or CVs special categories of data (art. 9 GDPR, e.g. health data) that are not needed for your request.
- Page of origin and campaign parameters. Together with the form data we receive the address of the page you send it from. If you reach the Website from an ad or a campaign link, that address contains the parameters added by the advertising platform: source, campaign, ad group, keyword and device type (e.g.
utm_source,utm_campaign,utm_term) and the identifier of the ad click (e.g.gclid). These parameters are attached to your contact request; on the pages dedicated to campaigns the region and the topic of the page are attached as well. We do not use cookies or other browser storage to attach them: we read them from the page address when the form is sent. - Conversations with the Energico virtual assistant. The text of the messages you write in the chat, a random conversation identifier, the language and the page you write from (section 5). The chat does not ask for personal data and we ask you not to enter any: to be contacted, use the contact form or the support form.
- Aptitude tests (trial phase). If you take part in the trial phase of the online aptitude tests (available in Italian only), your data and answers are processed as described in the specific notice (in Italian): during this phase the test is not an assessment and has no consequences for the person taking it.
- Cookies and tracking tools. Described in the Cookie Policy.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering requests for information, free energy consultations and quotes; managing the pre-contractual phase and any resulting contract | Pre-contractual measures taken at your request and performance of the contract (art. 6(1)(b) GDPR) | 24 months from the last relevant contact; if a contract is signed, for its duration and for the statutory periods (10 years for tax and accounting records) |
| Assessing spontaneous applications and possibly contacting you for future vacancies | Pre-contractual measures taken at your request (art. 6(1)(b) GDPR); art. 111-bis of the Privacy Code for unsolicited CVs | 12 months from receipt, then deletion |
| Handling technical support requests about systems (diagnosis, intervention, reply) | Performance of the contract for New Energy customers; for other systems, pre-contractual measures taken at your request (art. 6(1)(b) GDPR) | 24 months from the last relevant contact; for customers, for the duration of the relationship and for the statutory periods |
| Answering your questions with the Energico virtual assistant and directing you to the contact or support form | Pre-contractual measures and a service you requested (art. 6(1)(b) GDPR) | 30 days from the last message, then automatic deletion; in your browser until you delete it. If you open a support request from the chat, the conversation is attached to the request and follows its retention |
| Checking and improving the quality and accuracy of Energico’s answers by reviewing conversations | Legitimate interest (art. 6(1)(f) GDPR) | Within the same 30 days |
| Complying with legal obligations (accounting, tax, replies to public authorities) | Legal obligation (art. 6(1)(c) GDPR) | Periods set by the applicable law |
| Keeping the Website secure, preventing abuse and protecting the controller’s rights, including in court | Legitimate interest (art. 6(1)(f) GDPR) | Time strictly necessary for the purpose |
| Measuring Website traffic with aggregated statistics (Google Analytics 4) | Consent given in the cookie banner (art. 6(1)(a) GDPR) | 14 months (Google Analytics retention setting); cookies up to 2 years |
| Measuring the effectiveness of advertising campaigns and showing relevant ads on Meta platforms (Meta Pixel and, for requests sent through the contact forms, Conversions API) | Consent given in the cookie banner (art. 6(1)(a) GDPR) | Cookies up to 3 months; data collected by Meta is kept according to its own policy |
| Measuring how many contact requests come from our ads on Google, linking the request to the ad click also through the e-mail and phone number entered in the form, sent to Google in encrypted form, and showing relevant ads on Google services (Google Ads tag with enhanced conversions) | Consent given in the cookie banner (art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie preferences” | First-party cookies up to 3 months; data collected by Google is kept according to its own policy |
| Knowing which campaign, ad and keyword a contact request comes from, through the parameters found in the page address and attached to the request, to assess which campaigns generate requests | Legitimate interest (art. 6(1)(f) GDPR) in measuring the results of our advertising spend | Together with the contact request, for the same periods |
We do not use data collected through the Website to send unsolicited commercial communications, nor for automated decision-making producing legal effects on you. Energico’s answers are for information only: every support request is handled by a person.
4. Provision of data
Providing the data marked as mandatory in the forms is necessary to handle your request: without it we cannot reply. Providing any other data is optional. Consent to analytics and marketing cookies is optional and can be withdrawn at any time without affecting your browsing.
5. How we process data
Data is processed with IT tools and, where necessary, on paper, applying appropriate technical and organisational measures (art. 32 GDPR) to ensure its integrity, confidentiality and availability. Only staff authorised and instructed by the controller can access it.
Data entered in the Website forms travels over an encrypted connection to an automation hosted on a virtual private server, which forwards it to New Energy’s mailboxes and records it in the company CRM platform, where the request, application or support request is handled. The content of each submission, photos included, is not stored on that server: technical records are kept only if delivery fails, for as long as it takes to fix the problem and in any case no longer than 7 days, solely to make sure no request is lost. The sender’s IP address is used, for a few minutes, to limit automated submissions and is not stored.
Energico virtual assistant. Energico is an artificial intelligence system: its answers are generated automatically from New Energy’s documentation, may contain errors and do not replace a technician’s check. Each message travels over an encrypted connection to the same automation, which sends it to Google’s Gemini language model (Gemini API) together with the relevant documentation and the latest messages of the conversation, and returns the answer to you. We use Google’s paid service: under its terms, Google does not use the messages to train or improve its models and may keep them for a limited period solely to detect abuse. The conversation text, the random identifier, the language and the page are recorded in a database on the same server and deleted automatically 30 days after the last message. If you open a support request from the chat, the conversation is attached to the request in the CRM platform, so the technician does not need to ask you the same questions again. The IP address is used for one minute to limit automated messages and is not stored. Your browser keeps the identifier and the chat history (see the Cookie Policy), which you can delete at any time with “Clear conversation”.
Only if you have consented to marketing cookies, when you submit a contact form the automation reports the request to Meta through the Conversions API: e-mail, phone, first and last name encrypted with a hash function (SHA-256), IP address, browser type, the identifiers of the _fbp and _fbc cookies and the page of submission. This is used to measure which campaigns generate requests and to attribute them correctly. The message and the CV are never disclosed, and job applications are excluded. Without consent no data is sent to Meta.
Only if you have consented to marketing cookies, the Website also loads the Google Ads tag. The tag stores in a cookie the identifier of the click on the ad you came from and reports to Google the Website pages you visit and the main actions you take on them (for example a click on the toll-free number), with IP address and browser type. When you submit a contact form, the tag tells Google that the request took place (the “conversion”), with a random identifier of the submission used to avoid counting it twice. Together with the conversion the tag sends Google the e-mail and phone number you entered in the form, in encrypted form using a hash function (SHA-256) applied in your browser before sending: Google uses them to link the request to the ad click (“enhanced conversions”). The message, your first and last name and your city are not disclosed to Google. Job applications and support requests are excluded. Without consent the tag is not loaded and no data is sent to Google Ads; you can withdraw your consent at any time via the “Cookie preferences” link in the footer.
6. Recipients
Data may be processed on behalf of the controller by parties appointed as processors under art. 28 GDPR:
- the Website hosting and CDN provider (Vercel Inc.);
- Hostinger International Ltd., which hosts the virtual private server running the self-hosted automation (n8n) that receives the Website forms and forwards them by e-mail to our mailboxes, and that keeps the conversations with Energico for 30 days;
- the provider of the domain e-mail service, which delivers the messages generated by the Website forms;
- the provider of the company CRM platform used to handle requests and support requests;
- Google Ireland Limited, for Google Analytics 4 (only with your consent to analytics cookies) and for Google Ads (only with your consent to marketing cookies);
- Google, for the Gemini language model that generates Energico’s answers (Gemini API);
- Meta Platforms Ireland Limited, for Meta Pixel and Conversions API (only with your consent) and for WhatsApp Business;
- external consultants and professionals (legal, tax, technical) bound by confidentiality.
Data may also be disclosed to public authorities where required by law. Data is never disseminated. The up-to-date list of processors is available on request at the contacts in section 1.
7. Transfers outside the EU
Some providers (Google, including the Gemini API service, Meta, Vercel and the provider of the company CRM platform) are based or operate servers in the United States. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework for certified companies and, alternatively, on the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR), supplemented by the necessary additional measures. You can request a copy from the controller.
8. Phone, WhatsApp, social media and external portals
- Toll-free number. Data given over the phone is used exclusively to answer your request, for the same purposes and periods set out in section 3.
- WhatsApp Business. Messages exchanged with the number published on the Website pass through the systems of Meta Platforms Ireland Limited, which processes your account data and conversation metadata under its own policy. Please do not send documents containing special categories of data via WhatsApp.
- Social pages. The Website links to New Energy’s official pages on Instagram, Facebook, LinkedIn and YouTube. Browsing on those platforms is governed by their own policies. For the aggregated statistics of the Facebook and Instagram pages (“Page Insights”), New Energy and Meta are joint controllers under the terms defined by Meta.
- Client area and consultants area. The portals linked from the Website are separate services: a dedicated notice is provided when you register or log in.
9. Minors
The Website and its services are not intended for children under 14 and the controller does not knowingly collect their personal data.
10. Your rights
As a data subject you may at any time exercise the rights under arts. 15-22 GDPR: access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
Requests should be sent to info@newenergyitaly.com or by post to the registered office: we will reply within one month of receipt (art. 12 GDPR). If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it) — or bring proceedings before the courts.
11. Updates
This notice may be amended to reflect regulatory changes or changes to the Website services. The version in force is the one published on this page, with the last-updated date shown at the top.