Privacy Policy
pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR")
Last updated: 9 November 2026
1. Data controller
NEXTINDUSTRY SRL
Via Baratto 17 – 36015 Schio (VI), Italy
VAT / Tax code: 04116530249 – REA: VI-380346
Email: info@nextindustry.com – Certified email (PEC): nextindustry@pec-legal.it
We have not appointed a Data Protection Officer (DPO), as this is not required.
2. What data we process, why and for how long
2.1 Contact form
- Data: full name, email, phone number (optional), message.
- Purpose: to reply to your request.
- Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps taken at your request) and, for general enquiries, Art. 6(1)(f) (our legitimate interest in replying).
- Retention: 12 months from the last contact, then deleted. If a contractual relationship follows, your data is processed under our customer privacy notice.
- Provision of data: fields marked * are required; without them we cannot reply.
2.2 Chatbot (Nextassistant)
The website offers an automated virtual assistant: you are not talking to a person, and replies are generated by an artificial intelligence system.
- Data: message content, date and time, technical conversation identifier. Please do not enter sensitive or unnecessary personal data in the chat.
- Purpose: to answer questions about our services, keep the service secure and prevent abuse.
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in offering an information service and protecting it from misuse).
- How it works: the chatbot and its data store run on our own servers. To generate replies, messages are sent to OpenAI's API services, which match them against a knowledge base made up only of public content from this website. OpenAI does not use this data to train its models and may retain it for up to 30 days solely to prevent abuse.
- Retention: conversations are kept on our servers for 35 days and then deleted automatically. On your device, the chat history is stored for 24 hours after the last message, or until you start a new conversation.
- Provision of data: using the chatbot is optional.
- Automated decisions: the chatbot does not make decisions that produce legal or similarly significant effects on you (Art. 22 GDPR).
2.3 Usage statistics
We use an analytics system installed on our own servers.
- Data: pages visited, referring site, device type, browser and country. Your IP address is used only momentarily to derive the country and a pseudonymous session identifier; it is not stored. The system uses no cookies and does not track you across other websites.
- Purpose: to understand, in aggregate form only, how the website is used so we can improve it.
- Legal basis: Art. 6(1)(f) GDPR. Since no cookies or other tools that store or read data on your device are used, consent is not required.
- Retention: 24 months, then deleted.
2.4 Spam protection
The contact form and the chatbot are protected by a verification system installed on our own servers, based on a calculation performed by your browser (proof-of-work). It uses no cookies, does not track you and sends no data to third parties.
- Purpose and legal basis: to protect the website from automated submissions and abuse (Art. 6(1)(f) GDPR).
- Retention: no personal data is kept beyond the verification.
2.5 Browsing data and server logs
The servers hosting the website automatically record some technical data: IP address, date and time, pages requested, browser.
- Purpose and legal basis: operating the website, security and preventing unauthorised access (Art. 6(1)(f) GDPR).
- Retention: up to 30 days, unless needed to investigate offences.
We do not carry out any profiling.
3. Cookies and local storage
The website does not use profiling cookies, third-party cookies or analytics tools that require consent. It only uses the following technical tools, which are strictly necessary for the website to work and therefore exempt from consent (Art. 122 of the Italian Privacy Code). For this reason there is no cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
site-locale |
Technical cookie | Remembers your language | Session |
chatbot_user_id |
Local storage | Identifies the current chatbot conversation | Renewed after 24 hours of inactivity or via "New conversation" |
chatbot_history |
Local storage | Shows the chat history on your device | 24 hours from the last message |
chatbot_open |
Local storage | Remembers whether the chat window is open | Until cleared from the browser |
chatbot_privacy_accepted |
Local storage | Remembers that you have read the chat notice | Until cleared from the browser |
chatbot_verified_until, chatbot_blocked_until |
Local storage | Spam check and message rate limit | A few minutes |
You can delete this data at any time from your browser settings.
4. Recipients
Your data may be processed on our behalf by the following data processors (Art. 28 GDPR):
- the hosting provider of the servers running the website, the chatbot and the analytics;
- the provider of the website's content delivery network (CDN);
- the email service provider, where contact requests are received and stored;
- OpenAI Ireland Ltd, to process chatbot messages (see 2.2);
- IT consultants and suppliers supporting our systems, bound by confidentiality.
Your data is not published or sold. It may be disclosed to public authorities where required by law.
5. Transfers outside the EU
Chatbot messages are processed by OpenAI Ireland Ltd (Ireland), which may use its group company OpenAI, L.L.C. in the United States. The transfer is based on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), included in the Data Processing Addendum signed with OpenAI. You can request a copy of these safeguards by writing to info@nextindustry.com. All other data is processed within the European Economic Area or in countries recognised as adequate by the European Commission.
6. Your rights
You may exercise your rights under Articles 15-22 GDPR at any time: access, rectification, erasure, restriction of processing and data portability.
Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR).
To exercise your rights, write to info@nextindustry.com or to our PEC nextindustry@pec-legal.it. We reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
7. Children
The website is not intended for children under 14, and we do not knowingly collect their data. If you believe a child has given us their data, contact us and we will delete it.
8. Changes
We may update this privacy policy. The date at the top shows the version currently in force.