Privacy Policy

The Data Controller is Optivo S.r.l., with registered office at Via Michele Lessona 61, 00134 Rome (RM), Italy, VAT IT16678681004, REA Number: RM-1669693, PEC: optivo@pec.it.

For any questions regarding the processing of personal data, you can contact the Data Controller by email at privacy@optivologistics.com.

The website collects personal data in the following ways:

a) Browsing data
The IT systems and hosting services used to operate the website automatically collect certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, browser type, operating system, referring URL, pages visited, date and time of the request). Such data is necessary for the operation of the website and is processed for security and technical purposes.

b) Technical cookies
The website uses technical cookies necessary for its operation and, with user consent, behavioral analytics cookies. For more details, see the Cookie Policy.

c) Traffic statistics
The website uses Cloudflare Web Analytics, a web traffic analysis service provided by Cloudflare, Inc. that operates without cookies and without collecting personally identifiable data, analyzing traffic in a fully aggregated and anonymous form.

d) Behavioral analytics (with consent)
With user consent, the website uses Microsoft Clarity, a behavioral analytics service provided by Microsoft Corporation that allows recording anonymized browsing sessions and generating heatmaps to understand how users interact with the site. Clarity installs its own cookies only after explicit user consent to the Analytics category of the banner. Consent can be withdrawn at any time through the "Review your cookie choices" link in the site footer. — Clarity disclosure

e) Data voluntarily provided through demo booking
The website allows users to book a free demo through the external service zcal (zcal.co). When a user uses this service, the personal data entered in the booking form (name, email, company, phone and any notes) is collected by zcal, Inc. on behalf of the Controller, as a data processor (see Section 4). Optivo uses such data to organize the requested appointment and records it in the Attio CRM (see Section 4). After the demo, the sales team may contact the person again, by individual email or phone call, only to follow up on their request: answering questions, sending what was asked for (for example a quote) and agreeing next steps. Promotions, invitations, news and other unsolicited commercial messages are sent only with consent (Section 3). The form also contains the optional "Codice di riferimento" (reference code) field: the website fills it in by itself only for people who arrived from a Google Ads ad, possibly in an earlier visit within 90 days, and have given Marketing consent, as described below; otherwise it stays empty. The time the booking was made is also used to measure demos booked from Google Ads, as described below.

f) Data voluntarily provided through OEM support request form
On the Fleet Tracking page, a form is available to request support for automotive manufacturers not yet covered. The data provided (optional name, email, optional phone, requested manufacturer, any notes) is delivered to the Optivo team via email through Resend and recorded in the Attio CRM (see Section 4), in order to answer the request.

The Italian page for labour consultants (Consulenti del lavoro) provides a form to contact the team. The data provided (name, email, optional firm name and phone, approximate number of clients followed, any message) is delivered to the Optivo team via email through Resend, in order to answer the request. The request stays in the team's emails, not in the CRM, for the period in Section 5.

g) Data voluntarily provided through the careers application form
The "Careers" section provides a form to submit job applications. Data collected includes: first name, last name, email, role of interest, LinkedIn profile, optional CV (PDF/DOC, max 5 MB), optional resource links (video, portfolio, GitHub, etc.) and optional message. The sole purpose is to evaluate the application for the indicated role or for future hiring needs. Legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR). Data is delivered to the Optivo team via email through the Resend service (see Section 4) and retained for a maximum of 12 months from receipt, unless otherwise requested by the data subject.

h) Data voluntarily provided through resource download or decision tree forms
The website provides forms to download free resources (PDFs, checklists) and to receive by email the personalised roadmap from the smart tachograph decision tree. Data collected includes: first name, last name, email, optional company name, optional fleet size and regulatory adjustment deadline. The purpose is delivery of the requested resource or roadmap and — only with explicit user consent — sending newsletter communications. Legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR) and consent (Art. 6(1)(a)) for the newsletter. Data is transmitted via Resend (email delivery) and stored in a Google Sheets spreadsheet hosted by Google LLC (see Section 4); in the spreadsheet it is retained for a maximum of 24 months from receipt, unless an earlier deletion is requested; in the CRM the periods in Section 5 apply. People who download a resource or receive the roadmap are not contacted by the sales team unless they ask to be. If the user arrived from a Google Ads ad and consented to the Marketing category, the form also sends the ad click identifier, processed as described below under "Measuring demos booked from Google Ads".

Marketing and retargeting (with consent)
With user consent to the Marketing category of the banner, the website uses the LinkedIn Insight Tag, a service provided by LinkedIn Ireland Unlimited Company that records the visit to the site to measure visits and to show relevant Optivo ads on LinkedIn to people who visited the site (retargeting). The script is loaded only after explicit consent, and consent can be withdrawn at any time through the "Review your cookie choices" link in the site footer. The list of cookies installed and their durations are in the Cookie Policy. — LinkedIn Privacy Policy

With the same consent, the website uses the Google Ads tag, a service provided by Google Ireland Limited that measures how many people who arrive from an Optivo ad on Google open the demo booking, download a resource or sign up for the newsletter (conversion measurement). When one of these people submits a resource or newsletter form, the email address entered is turned in the browser into an unreadable code (SHA-256 hash) and sent to Google together with the conversion: Google matches it against its own accounts to attribute the conversion to the ad even when cookies are not enough (enhanced conversions). Without consent the tag is not loaded and nothing reaches Google. The list of cookies is in the Cookie Policy. — How Google uses information from sites that use its services

Measuring demos booked from Google Ads. In short: with Marketing consent, if the user arrives from a Google Ads ad, the Controller links the click to the demo booked, even when the booking is made in a later visit within 90 days, and Google receives the click identifier, without name or email.

With the same consent, if the user reaches the website from a Google Ads ad, the website reads the ad click identifier (gclid, gbraid or wbraid) from the page address and keeps it in the browser for the duration of the visit. If the visit does not carry one, the website uses the one that the Google Ads tag keeps for 90 days in the _gcl_aw cookie after an arrival from an ad (see the Cookie Policy). The cookie exists only if the user had given Marketing consent during that visit. The website sends the identifier to the Controller in three cases: when the user submits a resource or decision tree form, together with the form data; when they click a demo booking link or interact with the booking calendar, together with the page visited and a reference code; when they withdraw consent, to ask for what is already stored to be deleted.

The reference code is a random sequence of 8 letters and digits, generated in the browser and different for each page visited, which contains no data about the user. The website enters it in the "Codice di riferimento" (reference code) field of the zcal booking form: in booking links when they are clicked, and in the calendar embedded in the contact page as soon as the page opens with Marketing consent, or as soon as consent is given, before any interaction. In the embedded calendar, zcal therefore receives the code even from people who then do not book, whereas the Controller receives and keeps it only if the person interacts with the calendar or clicks a booking link. The field is visible, and the user can delete or change it before booking. With the booking, the code returns to the Controller and allows the booking to be linked to the click more reliably than by timing. If the person books, the code remains among the form answers in zcal and in the calendar event of the demo. In the first two cases it adds the random identifier of the cookie choice, which is used to be able to prove consent, and notes in the browser that the click was sent, so that its deletion can be requested even if consent is withdrawn in a later visit. The Controller keeps on Cloudflare (see Section 4) only the click identifier, the arrival time, the identifier of the cookie choice, the name of the form or page of origin and, for booking links and the booking calendar, the reference code, without IP address or plain-text email. For data received with a form it uses a cryptographic fingerprint (hash) of the email as the key, which is pseudonymous rather than anonymous data. Cloudflare's technical logs remain as described in Section 2(a).

When a demo booking arrives, the Controller tries to link it to a click: first through the hash of the booker's email, then through the reference code, if the booking contains one, and finally through timing, if in the previous half hour only one visitor arriving from an ad clicked a booking link. Linking by timing is an estimate and may attribute the booking to another person's click: for this reason only links made by email or by code are noted in the contact's record in the CRM (Attio), as a note that the booking came from a Google Ads ad. The code itself is not noted in the CRM. In all cases the Controller writes the click identifier, the time the booking was made and a conventional value to a Google Sheets spreadsheet, and Google Ads imports that spreadsheet daily to measure the effectiveness of the ads. Neither the name nor the email of the person booking reaches Google. It receives the click identifier and the booking time, which Google can trace back to its own click. Google Ireland Limited processes the imported data as an independent controller, under its own privacy policy.

Consent is optional: without it, the demo can be booked in the same way and no identifier is read or sent. The legal basis is consent. Accessing and storing the identifier in the browser, including reading the _gcl_aw cookie, is governed by Art. 122 of Italian Legislative Decree 196/2003 (Personal Data Protection Code), implementing Art. 5(3) of Directive 2002/58/EC. The subsequent processing is based on Art. 6(1)(a) GDPR: sending to the Controller, entering the reference code in the booking form, storage, linking to the booking and disclosure to Google. For people who book a demo, comparing each new booking (booking time and hashed email) with the stored click identifiers is based on the Controller's legitimate interest in measuring the effectiveness of its ads (Art. 6(1)(f) GDPR), including where the person has not given Marketing consent. You can object at any time by writing to privacy@optivologistics.com.

The Controller keeps identifiers received with a form for up to 90 days, those received from a booking link or the booking calendar, with the reference code, for up to 3 days, and the spreadsheet rows for up to 90 days from the booking. The code entered in the form follows the retention of the booking data (Section 5). The CRM note follows the retention of the contact record (Section 5). Consent can be withdrawn at any time through the "Review your cookie choices" link in the site footer. On withdrawal the website deletes the identifier from the browser and asks the Controller to delete the identifiers already sent from that browser, which are no longer used. Rows already written to the spreadsheet and the CRM note are not deleted automatically: to have them deleted, just write to privacy@optivologistics.com. Data already imported by Google is managed by Google, and ad preferences can be set from My Ad Center.

i) Newsletter subscription
The Newsletter page and the end of blog articles provide a form to subscribe to the Optivo newsletter. Data collected is the email address and, if provided, the first name. The purpose is sending the newsletter, with analysis, industry news and information about Optivo's services. Legal basis: consent (Art. 6(1)(a) GDPR), collected with double opt-in: after submitting the form, the data subject receives an email with a confirmation link, and the subscription becomes active only when that link is clicked. Without confirmation no newsletter is sent. The list and the sends are managed by Astrodon Corporation ("Loops"), acting as data processor (see Sections 4 and 7). Providing the data is optional: without an email address it is not possible to subscribe.

As proof of consent, the Controller keeps a consent log with the date and time of the subscription, the page of the website it came from, the version of this policy and a cryptographic fingerprint (hash) of the email address. The log contains neither the email address in clear text nor the IP address. The confirmation date is kept by Loops.

Newsletter emails contain no tracking pixels: Loops records neither opens nor link clicks. Links to the website may contain parameters that identify the newsletter as the source of the visit, without identifying the individual subscriber.

The processing of personal data is based on the following legal grounds pursuant to Art. 6 of EU Regulation 2016/679 and, for cookies and similar tools, Art. 122 of Legislative Decree 196/2003:

• Legitimate interest of the Controller (Art. 6(1)(f)): for browsing data, necessary to ensure the operation and security of the website, and for comparing each new demo booking (booking time and hashed email) with the stored click identifiers to measure Google Ads advertising (see Section 2)
• Legitimate interest of the Controller (Art. 6(1)(f)): to keep in the CRM the data of people who booked a demo or sent an OEM support request, and to contact them again only to follow up on that request (Section 2(e)). The Controller has an interest in keeping track of the requests received and the answers given and in resuming the conversation if the person asks again, for the periods in Section 5. Data subjects may object at any time (Section 6). Promotional emails and the newsletter are sent only with consent
• Exemption from consent (Art. 5(3), Directive 2002/58/EC): for strictly necessary technical cookies, exempt from prior consent requirements
• Performance of pre-contractual measures (Art. 6(1)(b)): for data provided by the user through demo booking and the request forms (OEM support, labour consultants), as processing is necessary to take steps at the request of the data subject prior to entering into a contract
• User consent (Art. 6(1)(a)): for the installation of Microsoft Clarity behavioral analytics cookies and LinkedIn Insight Tag and Google Ads marketing cookies, including sending the email to Google as a hash for conversion measurement, and for keeping and using the Google Ads click identifier to measure booked demos, with Art. 122 of Legislative Decree 196/2003 for accessing and storing it in the browser, including reading the _gcl_aw cookie, activated exclusively after explicit user consent via the website's cookie banner
• User consent (Art. 6(1)(a)): for sending the newsletter, given through the subscription form and confirmed through the link received by email (double opt-in). Consent can be withdrawn at any time

The website uses the following third-party services that may process personal data as data processors or independent controllers:

• Cloudflare, Inc. (San Francisco, USA) — CDN (Content Delivery Network), DDoS protection and website performance optimization. Cloudflare may process IP addresses and browsing data for security purposes. As a data processor, Cloudflare also hosts the Controller's services that receive the website forms and keep the consent register and the Google Ads click identifiers (Cloudflare Workers and R2). — Privacy Policy
• zcal, Inc. (Houston, USA) — Appointment booking service used for free demos. It collects and stores the data entered in the booking form (name, email, company, phone, any notes and reference code) and acts as a data processor under Art. 28 GDPR, on the basis of the data processing addendum that applies upon acceptance of its terms of use. Data is processed in the United States (see Section 7). For the data it processes for itself (accounts, its website and the cookies of its own pages) zcal remains a controller, under its own privacy policy. — Privacy Policy, data processing addendum, sub-processors
• Cloudflare Web Analytics (Cloudflare, Inc., San Francisco, USA) — Cookieless web traffic statistics service. Does not collect personally identifiable data. — Learn more
• Microsoft Clarity (Microsoft Corporation, Redmond, USA) — Behavioral analytics service (heatmaps and session recording). Activated only with user consent. — Privacy disclosure
• LinkedIn Ireland Unlimited Company (Wilton Place, Dublin, Ireland) — Advertising platform whose Insight Tag, activated only with user consent, measures visits to the site and enables retargeting on LinkedIn. LinkedIn processes the data collected by the tag according to its own privacy policy. — Privacy Policy
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Ads advertising platform, whose tag, activated only with user consent, measures the conversions of Optivo campaigns on Google. For conversion measurement Google acts as an independent controller; for the hashed email (enhanced conversions) it acts as a processor on behalf of the Data Controller, under the Google Ads data processing terms. Google Ads also imports daily, from the Controller's spreadsheet, the ad click identifiers linked to a booked demo. This data includes no email or other user-provided data, and for it Google acts as an independent controller, as for the tag's conversion measurement. — Privacy Policy
• Resend (Resend, Inc., San Francisco, USA) — Transactional email service used to deliver to the Optivo team the applications submitted through the "Careers" form and the requests sent through the OEM support request form and the labour consultants form, to deliver resources requested via download forms, to send personalised smart tachograph decision tree roadmaps to users who request them, and to send the related receipt confirmation emails. Resend acts as a data processor solely for the purpose of email delivery. — Privacy Policy
• Google LLC (Google Workspace: Google Sheets and Google Calendar) (Mountain View, USA) — Cloud-hosted spreadsheet service used to store, in a structured way, the leads generated by the resource download forms and by the smart tachograph decision tree (name, email, company, fleet size, adjustment deadline, scenario), and the rows for demos linked to a Google Ads ad (click identifier, booking time, how the link was made, calendar event identifier and cookie choice identifier). The Controller's Google calendar also keeps the events created by demo bookings, with the booking data and any reference code, which a script of the Controller reads to record the contact in the CRM. Google acts as a data processor solely for the purpose of storing the data the Controller has lawfully collected. — Privacy Policy
• Attio (Attio Limited, United Kingdom): CRM used by the sales team to manage the contacts received from the resource download forms, from the OEM support request form, from the self-assessment tools on the website and from call bookings made through zcal (name, email, company, phone number if provided, fleet size, requested manufacturer and notes, answers given in the tool, landing page and campaign parameters of the visit, an indication that the booking came from a Google Ads ad, call date, newsletter consent). Attio acts as a data processor on behalf of the Controller. Privacy Policy
• Astrodon Corporation ("Loops") (Beaverton, Oregon, USA): email marketing platform used to manage the newsletter subscriber list and to send the newsletter and the subscription confirmation email (email, first name if provided, subscription page, date of confirmation and of any unsubscription). Astrodon Corporation acts as a data processor under Art. 28 GDPR, on the basis of the data processing agreement incorporated into its terms of service. Data is stored in the United States (see Section 7). Privacy Policy, sub-processors

Browsing data is deleted immediately after technical processing, except for potential use in investigating computer crimes against the website.

Demo booking data remains in the Controller's zcal account, which holds it as data processor, and in the Controller's calendar event. The Controller deletes it from the calendar 24 months after the booking (12 months for candidates' interviews) and, at the same time, asks zcal to delete it from its account.

The contact data of people who do not become customers stays in the CRM and in the team's emails for 24 months from the last contact. The last contact is the last time the person replied to Optivo, took part in a demo or a call, or sent a new request: messages from Optivo that get no reply do not extend the period. After that period, Optivo deletes from the record name, email, phone number, notes and any other data about the person, and keeps only the company name, the source of the contact and the dates, for internal statistics. If the business is a sole proprietorship, a professional practice or has a name that matches a person's name, it deletes the whole record. Anyone who asks not to be contacted again is not contacted again: Optivo deletes their data and keeps only the email address on an exclusion list, to honour the request. Customer data is kept for the duration of the relationship, and accounting records for the period required by law. This is how the Controller applies the principles of data minimization and storage limitation (Art. 5(1)(c) and (e) GDPR).

Data collected through the careers application form (including any CV and resource links provided by the applicant) is retained for a maximum of 12 months from receipt, in order to evaluate the application for the indicated role and for any future hiring needs. After that period, data is deleted unless the data subject requests otherwise. Applicants may request early deletion at any time by writing to privacy@optivologistics.com.

Newsletter subscriber data is retained until consent is withdrawn. After unsubscribing, Loops keeps the email address flagged as unsubscribed, solely to avoid sending further emails and to document the withdrawal; the Controller's consent log is retained for as long as necessary to demonstrate consent and its withdrawal. Unconfirmed subscription requests receive no newsletter and are deleted within 6 months.

Google Ads click identifiers are kept by the Controller for up to 90 days when received with a form and up to 3 days when received from a booking link or the booking calendar. The rows of the booked demos spreadsheet are kept for up to 90 days from the booking (see Section 2).

Pursuant to Articles 15-22 of EU Regulation 2016/679, data subjects have the right to:

• Access their personal data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Obtain erasure of data (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Object to processing (Art. 21 GDPR)
• Receive their data in a structured, machine-readable format — portability (Art. 20 GDPR)
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal
• Lodge a complaint with the Italian Data Protection Authority — www.garanteprivacy.it

Right to object. Data subjects may object at any time to processing based on legitimate interest, in particular to keeping their data in the CRM and being contacted again after a request, and to the comparison of bookings with ad clicks (Section 2), by writing to privacy@optivologistics.com or by replying to any email from Optivo. If someone objects to being contacted again, Optivo does not contact them again.

Consent to the newsletter can be withdrawn with one click through the unsubscribe link at the bottom of every email, or by writing to the address below.

To exercise your rights, write to: privacy@optivologistics.com.

Cloudflare and Microsoft Clarity, headquartered in the United States, and LinkedIn and Google, which may transfer data from Ireland to LinkedIn Corporation and Google LLC respectively in the United States, may involve the transfer of data to countries outside the European Economic Area. Such transfers are carried out on the basis of adequate safeguards pursuant to Articles 46-49 of the GDPR, including the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework (European Commission Adequacy Decision of July 10, 2023).

Newsletter subscriber data is stored in the United States by Astrodon Corporation ("Loops") and its sub-processors, also based in the United States. The transfer relies on the European Commission's adequacy decision of July 10, 2023 on the EU-US Data Privacy Framework, under which Astrodon Corporation is certified.

Demo booking data is processed by zcal, Inc., as a data processor, and by its sub-processors in the United States and possibly in other third countries. The transfer relies on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914, Module 2), incorporated into zcal's data processing addendum.

Measuring booked demos also involves processing outside the EEA. Cloudflare, Inc. (Cloudflare Workers and R2, which keep the click identifiers and the consent register) participates in the EU-US Data Privacy Framework, and otherwise the Standard Contractual Clauses of its data processing agreement apply. Google LLC (Google Workspace, which hosts the booked demos spreadsheet and the script that reads the calendar) is covered on the same terms, where applicable. Attio Limited is based in the United Kingdom, to which data flows on the basis of the European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025, and may use sub-processors in third countries with the safeguards of its own data processing agreement. Google Ireland Limited, which receives the click identifiers as an independent controller, is established in the EEA. A copy of the safeguards adopted can be requested at privacy@optivologistics.com.

The Data Controller reserves the right to amend this privacy policy at any time, publishing the updated version on this page. Please check this page periodically. If you do not accept the changes made, you may request the deletion of your personal data by contacting the Data Controller.