Privacy Policy
Last updated: [date of publication]
1. Who we are
This Privacy Policy explains how BoreaTech S.r.l. ("BoreaTech", "we", "us") processes personal data when you visit boreatech.com (the "Website") or contact us through it. BoreaTech is the company behind SupplierForge; the SupplierForge website and platform have their own Privacy Policy at supplierforge.com/privacy.
BoreaTech S.r.l., registered office [address], Bergamo, Italy, VAT [number], REA [number]. Privacy contact: privacy@boreatech.com.
We process personal data in compliance with Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and other applicable data protection laws. For everything described here BoreaTech is the controller.
2. Data we collect
2.1 Website visitors. Technical data collected by our hosting and security provider: IP address, browser type and version, operating system, pages visited, referring page, date and time of access. Cookies: only strictly necessary cookies set by Cloudflare for security and performance (for example __cf_bm, cf_clearance). We use no analytics, advertising or tracking cookies.
2.2 Contact form and e-mail. Name, work email, company, and your message, and anything else you choose to include.
2.3 Security reports. Reports sent to security@boreatech.com or security@supplierforge.com, including the reporter's contact details.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your enquiry | Contact form and e-mail data | Art. 6(1)(b), pre-contractual steps at your request; Art. 6(1)(f) for general enquiries |
| Delivering and securing the Website | Technical data, security cookies | Art. 6(1)(f), legitimate interest in security and performance |
| Handling security reports | Reporter details | Art. 6(1)(f), legitimate interest in the security of our services |
| Compliance with legal obligations and defence of claims | Any of the above as required | Art. 6(1)(c) and Art. 6(1)(f) |
We do not use personal data for automated decision-making with legal or similarly significant effects, we do not send marketing e-mail without your consent, and we do not sell personal data.
4. Who we share it with
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. | Website hosting, DNS, edge security | EU jurisdiction; EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Resend, Inc. | Delivery of contact form messages to us | United States; Standard Contractual Clauses |
We may also disclose personal data where required by law, regulation or legal process, or to establish, exercise or defend legal claims.
5. International transfers
Where a provider processes data outside the EU or EEA, the transfer relies on an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with the provider's technical and organisational safeguards.
6. How long we keep it
| Data | Retention |
|---|---|
| Contact form submissions and e-mail | Up to 24 months after our last exchange, unless you ask for earlier deletion |
| Website technical data (Cloudflare) | Per Cloudflare's retention, typically no longer than [72 hours] |
| Security reports | 24 months after closure of the report |
7. How we protect it
Traffic to the Website is encrypted in transit. Contact form messages are delivered to a mailbox with access limited to BoreaTech staff under confidentiality. The Website runs no server-side application beyond the contact form handler.
8. Your rights
Under the GDPR you may ask us for access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and you may object to processing based on legitimate interests (Art. 21) and withdraw consent at any time (Art. 7(3)). Write to privacy@boreatech.com. We answer within one month; where a request is complex we may extend by up to two further months and will tell you why.
9. Complaints
You may lodge a complaint with a supervisory authority. In Italy: Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it, protocollo@gpdp.it. You may also complain to the authority of your country of residence or work.
10. Children
The Website is for business use and is not directed at anyone under 16. We do not knowingly collect personal data from children.
11. Third-party links
The Website may link to third-party sites, including our product sites. Their privacy practices are their own; please read their policies.
12. Changes to this policy
We may update this policy to reflect changes in our practices or the law. The date at the top shows the latest revision. Material changes are announced on the Website.
13. Contact
BoreaTech S.r.l., [address], Bergamo, Italy. Privacy: privacy@boreatech.com. General: info@boreatech.com. Security reports: security@boreatech.com.