This is a courtesy translation. In case of discrepancy, the Italian version of this notice prevails.
Practical note
The site forms (waiting list and Partner programme) send data to an endpoint of the same application, which records it on the group's own support and CRM platform, attributable to the same controller and hosted on cloud infrastructure within the European Union, where a member of staff picks up the application. It is no longer transmitted to a non-EU CRM provider. The public site carries no analytics, advertising pixels, profiling tools or cookies set via JavaScript. The site and the private area are served by the same application: inside the private area, technical session cookies are set after sign-in.
1. Data controller
Meccanica Celeste S.r.l.
Registered office: Via del Lavoro 23/4, 40033 Casalecchio di Reno (BO), Italy
VAT / tax code: 04376621209
Certified email: meccanicaceleste@pec.it
Email for the NumbersNow project: info@numbersnow.it
2. Categories of data processed
Depending on how the site is used, the following categories of data may be processed.
| Area | Data |
|---|---|
| Technical browsing | IP address, date and time of the request, user agent, pages requested, and the technical information normally contained in server or hosting provider logs. |
| NumbersNow waiting list | First name, last name, business email, mobile number, role, company name, industry, optional company website, form origin and submission date. |
| Partner programme | First name, last name, email, practice or company, type of business, optional website and submission date. |
| Email contacts | Data voluntarily included in messages sent to the email addresses published on the site. |
| Consent records | Whether optional consent to promotional communications was given, recorded alongside the application as proof of consent. |
| Application diagnostics | In case of an application error, technical data about the event (page, error type, browser, IP address) collected by the error monitoring service, with no advertising purpose. |
3. Purposes and legal bases
| Purpose | Legal basis | Description |
|---|---|---|
| Operation and security of the site | Legitimate interest, art. 6.1.f GDPR | Serving the page, preventing abuse, diagnosing technical problems and protecting the infrastructure. |
| Managing the waiting list | Pre-contractual measures requested by the data subject, art. 6.1.b GDPR | Receiving the application, assessing beta access, getting back in touch and arranging any introductory calls. |
| Managing the Partner programme | Pre-contractual measures requested by the data subject, art. 6.1.b GDPR | Answering the request, assessing possible collaborations and providing information about the partner channel. |
| Operational communications | Legitimate interest, art. 6.1.f GDPR, or performance of pre-contractual measures | Replying to messages, clarification requests, follow-ups and communications related to the application or request. |
| Legal obligations and defence of rights | Legal obligation, art. 6.1.c GDPR, and legitimate interest | Complying with legal requirements, responding to authorities, preventing fraud or defending a right in or out of court. |
| Promotional communications | Consent, art. 6.1.a GDPR | Only where the optional consent in the form is given: sending updates and promotional messages about NumbersNow. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out beforehand. |
4. Tools present on the site
Since 17 August 2026 the public site and the NumbersNow application are served by the same codebase and the same application domain. This is the status of the tools actually active on the public pages.
| Tool | Status | Privacy notes |
|---|---|---|
| Waiting list form | Present and active | Submitted data goes to an application endpoint that records it on the group's support and CRM platform to handle the application. |
| Partner programme form | Present and active | Submitted data goes to an application endpoint that records it on the group's support and CRM platform to handle the request. |
| Group support and CRM platform | Active server-side | Receives form data to manage applications, communications and, where consent is given, promotional messages. No third-party script is loaded in the browser for this purpose. |
| Form anti-abuse checks | Active | A hidden field and a measurement of how long the form took to fill in are used to tell automated submissions apart. They do not profile the visitor and leave nothing on the device. |
| Application error monitoring | Active, where configured | Collects technical error data for diagnostics and service stability. No advertising purpose, no profiling. |
| Web app service worker | Registered | Technical component of the installable application: handles local caching and offline operation. No tracking. |
| Analytics, advertising pixels, tag managers | Not present | No traffic measurement or advertising tool is loaded on the public pages. |
| Session cookies | Private area only | Signing in to the application sets technical cookies required for authentication and session security. The public pages set none. |
| External fonts, images and assets | Not present | Typography and images are served from the application's own domain. |
5. Recipients and processors
Data may be processed by staff authorised by Meccanica Celeste S.r.l. and, where necessary, by technical providers supporting the site, email, hosting, security or the handling of requests.
Where a provider processes personal data on behalf of the controller, it acts as a processor under art. 28 GDPR, on the basis of adequate agreements or contractual terms.
Data collected through the forms is not disclosed to a third-party CRM provider: it is recorded on the group's own support and CRM platform, attributable to the same controller and used to manage applications, operational communications and, where consent is given, promotional communications. Until 17 August 2026 that data passed through a US-based CRM platform: that step has been removed.
The cloud infrastructure providers hosting the application and the group platform (data centres within the European Union), the error monitoring provider and the controller's email providers are also involved. Should further tools be connected, this notice will be updated before or at the time of their activation.
6. Transfers outside the European Economic Area
Form data stays within the European Union: both the application databases and the group's support and CRM platform are hosted in EU data centres. The transfer to the United States entailed by the previous CRM platform ceased on 17 August 2026.
Some infrastructure and technical service providers are companies based in the United States: in that case data is still hosted in European regions, and any access by the provider takes place with the safeguards required by articles 44 et seq. GDPR, in particular the European Commission's Standard Contractual Clauses. Information about the safeguards adopted is available on request at the addresses in section 12.
7. Retention periods
| Data | Indicative period |
|---|---|
| Technical browsing logs | For as long as needed for security, diagnostics and operation of the site, as a rule no longer than 12 months, unless abuse or incidents must be investigated. |
| Waiting list and beta requests | Up to 24 months from the request or until objection or erasure, unless a contractual relationship or legal obligations apply. |
| Partner programme requests | Up to 24 months from the request or until objection or erasure, unless a collaboration starts or legal obligations apply. |
| Email communications | For as long as needed to handle the request and, where useful to document the relationship, up to 24 months, subject to legal obligations or defence of rights. |
| Data required for tax, administrative or legal defence purposes | For the periods set by law or needed to protect the controller's rights. |
9. Nature of the provision of data
Technical browsing is necessary to access the site. The data requested in the forms is necessary to handle the application or the Partner request; fields marked as optional may be left blank.
Without the requested form data it may not be possible to get back in touch or to assess the request.
10. Automated decision-making and profiling
No automated decisions producing legal effects or similarly significantly affecting the data subject under art. 22 GDPR are taken. On the group platform applications enter a work queue and may be organised with labels for operational management and, where consent is given, communication purposes: the assessment remains with a person, without profiling that entails automated decisions about the data subject.
11. Security
Reasonable technical and organisational measures are in place to protect personal data against unauthorised access, loss, disclosure or alteration: encryption in transit, access control, environment separation and logging of relevant events. Measures are updated in line with the tools actually connected to the site and the service.
12. Rights of the data subject
Within the limits set by the GDPR, the following rights may be exercised:
- access to personal data;
- rectification of inaccurate data or completion of incomplete data;
- erasure of data in the cases provided for;
- restriction of processing;
- data portability, where applicable;
- objection to processing based on legitimate interest;
- withdrawal of consent, where processing is based on consent;
- the right not to be subject to decisions based solely on automated processing, where applicable.
Requests can be sent to info@numbersnow.it or to the certified address meccanicaceleste@pec.it. Replies are provided within the deadlines set by the GDPR, as a rule within one month.
13. Complaint to the supervisory authority
Anyone who considers that the processing of their personal data infringes the GDPR may lodge a complaint with the Italian Data Protection Authority or bring the matter before the competent court.
Italian authority: www.garanteprivacy.it
14. Updates
This notice may be updated if the site, the tools used, the purposes of processing or the applicable rules change. The updated version is published on this page.