Privacy notice

Information you provide and browsing data

When you contact us, we process your name, contact details, company and enquiry information, such as equipment model, location, condition and requested services. We collect information needed to understand and handle the enquiry.

Forms send completed fields and page context to the website’s submission service. Required fields are identified and other fields are optional. There are no attachments or automatic email replies.

Hosting also processes technical information such as IP address, date and time, requested resource, connection outcome and browser information for service delivery and security. Do not send health data, medical reports, patient details, passwords or credentials. The website has no user accounts or application database and does not access the company management system.

Responding and managing professional relationships

We handle information, purchase, sale, rental, support and parts-quotation enquiries. Steps requested by an individual in relation to their own prospective contract are based on GDPR Article 6(1)(b).

For organisation representatives and professional contacts, processing is based on the legitimate interest in managing commercial and technical relationships and responding to enquiries (Article 6(1)(f)). When the same person contacts us again, we consult relevant earlier exchanges to understand the context and consistency of the new enquiry.

Website security and abuse prevention support the legitimate interest in protecting services and contact channels. Applicable legal obligations are based on Article 6(1)(c); protecting legal claims is based on legitimate interests within applicable limits.

Contacting us is voluntary; without sufficient contact and enquiry details we may be unable to respond. Acknowledging this notice is not marketing consent. An enquiry does not subscribe you to a newsletter or promotional campaigns. We do not carry out profiling or automated decisions with legal or similarly significant effects.

Authorised people and service providers

Authorised Spinergy Medical personnel handle enquiries. The general contact address is info@spinergymedical.com, on Microsoft 365. Aruba provides website hosting; the form service submits messages through an authenticated Microsoft 365 connection, from the dedicated sender sito@spinergymedical.com to the general contact address.

Technical providers process data in the roles established by contracts and applicable law, including data-processing agreements where required. Relevant information may be shared with advisers or authorities for legal obligations or claims; it is not published.

Provider services may involve processing or access outside the European Economic Area. Where applicable, transfers are governed by GDPR mechanisms such as adequacy decisions or standard contractual clauses and associated measures. We do not guarantee processing exclusively in Italy or Europe. You may request information on safeguards relevant to your processing.

Periods linked to the enquiry and applicable obligations

For informational enquiries not subject to separate retention obligations only, the adopted criterion is up to five years from the last exchange relevant to that enquiry. This is a maximum, not a minimum. A new contact does not automatically extend retention of the entire correspondence history.

Quotations and business correspondence, contractual, tax and accounting records follow their respective applicable retention obligations. Disputes may require relevant information to be retained until resolved. The absence of an order alone does not determine a document’s classification.

The website does not read mailbox contents or automatically delete emails, quotations or backups. Managing retention in company records is separate from operating the website.

The form service keeps pseudonymous technical identifiers for abuse prevention and a minimal log with time, request reference and outcome, without message text or plain-text contact details. Cleanup thresholds are one hour of inactivity for sessions, 48 hours for abuse counters and 30 days for daily logs. Cleanup runs during service activity, at most once an hour: without traffic, expired files remain until the next cleanup run. These thresholds do not apply to provider-managed logs or backups.

Hosting technical-data criteria concern service delivery and security, incident handling and obligations applicable to the provider. Service backups and logs do not automatically follow correspondence retention periods; contact us for information about the specific category.

Exercising your rights

Contact info@spinergymedical.com or our certified email address to exercise applicable rights of access, rectification, erasure, restriction, portability and objection. You may object to legitimate-interest processing on grounds relating to your particular situation.

We normally respond within one month, subject to reasoned extensions permitted by the GDPR. We may request proportionate information to verify identity. You may complain to the competent supervisory authority; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Reading the privacy or cookie notice sends no notification to the company mailbox. Material changes to purposes or tools will be reflected in an updated notice.

Google Analytics only with your consent

If you choose “Accept statistics” or enable the corresponding preference, we use Google Analytics 4 to understand page visits and the number of online enquiries accepted by the submission service. The legal basis is consent (GDPR Article 6(1)(a)). Rejecting does not restrict access to the website or forms. The Google tag is not loaded before acceptance.

Statistical data includes pseudonymous browser identifiers, technical device information, visited pages, event times and predefined categories of successful submissions. We do not send names, contact details, messages, request identifiers or patient data to Analytics. Page addresses are public canonical URLs, without query parameters or fragments; for referring sites we use only the origin, not the full path. We do not use automatic form measurement, Google Signals, user-provided data or advertising features.

The service is provided by Google Ireland Limited and involves Google group companies under the applicable terms. Processing outside the European Economic Area may occur, subject to safeguards in the processing terms and applicable transfer mechanisms. These statistics are pseudonymous: we do not describe them as data with no possibility of identification.

Analytics user-level and event-level data retention is set to two months, without resetting the period on new activity. This limit does not apply to all aggregated reports. Analytics cookies are configured for 60 days without refreshing expiry on every visit; cookie lifetime is distinct from retention of information already received by Google.

Withdraw consent through “Cookie preferences” at the bottom of each page, by disabling statistics and saving or selecting “Reject optional”. We block new events from this integration and attempt to delete its cookies. A transmission already started cannot be recalled; withdrawal does not affect the lawfulness of earlier processing or automatically erase information already collected. Contact us to exercise your rights. Your choice does not generate an email to the company.