Privacy Policy
This notice describes how Rayo Consulting di Patriarchi Dylan collects, uses and protects the personal data of users who visit the rayo.consulting website (including the www.rayo.consulting version), in compliance with EU Regulation 2016/679 (GDPR), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and the Italian Data Protection Authority's Order on cookies of 8 January 2022.
Art. 1 · Data Controller
Rayo Consulting di Patriarchi Dylan VAT number: IT 03988190546 Registered office: Vocabolo Marcheggiane 56/C, 06012 Città di Castello (PG), Italy Email: info@rayo.consulting Phone: +39 327 174 6038
For any questions regarding the processing of your personal data, you can contact us at the email address above. No DPO has been appointed as the conditions set out in Art. 37 GDPR do not apply.
Art. 2 · Types of data collected
2.1 Navigation data
IT systems automatically acquire certain technical data necessary for transmitting communications over the computer network: IP addresses, browser type, operating system, request time, referring URL (referrer) and other parameters of the computing environment. Such data are not associated with identifiable users and are used for security purposes and aggregate statistics.
2.2 Data provided voluntarily by the user
We collect the data you provide through:
- Contact form: name, email address and message content.
- Direct communications: any personal data contained in emails, WhatsApp messages or other direct contact channels.
- "Ray" virtual assistant: the content of the messages you write in the site's chat and, if you ask to be contacted, the contact details you give the assistant (name, email and, optionally, phone and company). We do not ask you for any personal data to use the assistant; processing is described in Art. 11.
2.3 Data collected automatically through cookies and analytics tools
With your consent, we collect aggregate analytics data on the use of the site through Google Analytics 4. For details, see Arts. 7 and 8.
Art. 3 · Purposes and legal basis of processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to contact requests and providing quotes | Art. 6(1)(b) · performance of pre-contractual measures |
| Anti-spam and anti-bot protection of the forms (Cloudflare Turnstile) | Art. 6(1)(f) · legitimate interest of the Controller (form security, abuse prevention) |
| Technical operation of the site (security logs, abuse prevention) | Art. 6(1)(f) · legitimate interest of the Controller |
| Compliance with legal, tax and accounting obligations | Art. 6(1)(c) · legal obligation |
| Aggregate statistical analysis of site usage (Google Analytics 4) | Art. 6(1)(a) · explicit consent of the data subject |
| Saving cookie preferences (localStorage) | Art. 6(1)(f) · legitimate interest (technical functionality) |
| Operating the "Ray" virtual assistant: answering questions about our services and guiding the visitor towards commercial contact | Art. 6(1)(f) · legitimate interest of the Controller (visitor assistance) and, where the conversation concerns a quote request, Art. 6(1)(b) · pre-contractual measures |
| Preventing abuse of the virtual assistant (rate limits, anti-bot verification) | Art. 6(1)(f) · legitimate interest of the Controller (service security) |
| Storing the assistant conversation locally (localStorage) | Art. 6(1)(f) · legitimate interest (conversation continuity on the same device) |
| Forwarding by email the contact details you give the assistant in order to be contacted | Art. 6(1)(b) · pre-contractual measures taken at your request (Art. 11.5) |
We do not use your data for automated profiling, behavioural marketing or to make automated decisions with legal effects (Art. 22 GDPR).
Art. 4 · Retention period
| Type of data | Retention period |
|---|---|
| Contact form data | Until the request is handled; if a contractual relationship is established, 10 years for tax purposes (Art. 2220 Italian Civil Code) |
| Data processed for the anti-bot verification of the forms (Cloudflare Turnstile) | For the time necessary to verify the submission and prevent abuse, in accordance with the retention terms applied by Cloudflare |
| Navigation and security logs | No longer than 30 days, unless required to investigate unlawful acts |
| Google Analytics data (with consent) | 14 months (GA4 default setting, per Google policy) |
| Cookie preferences (localStorage) | 12 months from the date it is set |
_ga and _ga_* cookies (with consent) | 2 years from the date they are set |
| Conversation with the "Ray" virtual assistant (your browser's localStorage) | 30 days from the last message, or until you press "New conversation" or clear your browser data |
| Content of messages sent to the virtual assistant | Not retained: messages pass through our servers without being saved to databases or application logs, and the model provider is configured not to retain them (Art. 11) |
Art. 5 · Your rights (Arts. 15–22 GDPR)
As a data subject, you have the right to:
- Access (Art. 15): obtain confirmation as to whether processing of data concerning you is taking place and, if so, obtain a copy.
- Rectification (Art. 16): request the correction of inaccurate data or the completion of incomplete data.
- Erasure (Art. 17): request the deletion of your personal data ("right to be forgotten"), unless overriding legitimate grounds or legal obligations apply.
- Restriction of processing (Art. 18): obtain the suspension of processing in certain cases (e.g. contesting the accuracy of the data).
- Portability (Art. 20): receive, in a structured, commonly used and machine-readable format, the data you have provided on the basis of consent or a contract.
- Objection (Art. 21): object to the processing of your data based on the Controller's legitimate interest.
- Withdrawal of consent: at any time, via the "Cookie preferences" link in the site footer or by sending a request to info@rayo.consulting. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- Complaint: lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), located at Piazza Venezia 11, 00187 Rome.
To exercise your rights, send a request to info@rayo.consulting. We will respond without undue delay and in any case within 30 days of receiving the request, as provided by Art. 12 GDPR. In particularly complex cases, the deadline may be extended by a further 60 days, with prior reasoned notice.
Art. 6 · Recipients and data processors
Your personal data are not sold, rented or transferred to third parties for marketing purposes. They may be disclosed to the following categories of parties, acting as Data Processors pursuant to Art. 28 GDPR, bound by specific contractual agreements:
Technical service providers
| Provider | Service | Location | Transfer safeguards |
|---|---|---|---|
| Vercel Inc. | Website hosting and CDN | USA (servers also in Europe) | SCC + Data Processing Addendum (included in the terms of service; for the Hobby plan, written confirmation can be requested at privacy@vercel.com) |
| Cloudflare, Inc. | Anti-spam and anti-bot protection of the forms (Cloudflare Turnstile) | USA | SCC + EU-US Data Privacy Framework (Cloudflare is DPF-certified) |
| Google LLC | Statistical analysis (Google Analytics 4) · only with consent | USA | SCC + Google Ads Data Processing Terms |
| OpenAI Ireland Ltd. (with OpenAI, L.L.C. as sub-processor) | Processing of "Ray" virtual assistant messages through a language model | Ireland (EU), with technical processing also in the USA | OpenAI Data Processing Addendum + SCC; configured with retention disabled (store: false) |
| Google Ireland Ltd. (with Google LLC as sub-processor, USA) | Displaying the interactive map of our office via Google Maps, loaded only after the user clicks ("click-to-load") | Ireland (EU), with transfers to the USA | SCC + EU-US Data Privacy Framework (Google LLC is DPF-certified) |
Public authorities
Data may be disclosed to judicial, police or other Italian or European public authorities when required by law or by orders from the authorities.
6.1 Anti-bot protection of the forms (Cloudflare Turnstile)
The contact form and the "Ray" virtual assistant on the site are protected by Cloudflare Turnstile, an anti-bot verification system (invisible CAPTCHA) provided by Cloudflare, Inc. For the virtual assistant the check runs once, invisibly, when the chat is opened — not on every message.
When the form loads or the chat is opened, the browser requests a script from the challenges.cloudflare.com domain. As part of this verification, Cloudflare may process the IP address, browser and device information and signals relating to the user's interaction with the page.
The sole purpose is to verify that the form submission comes from a genuine user and not from an automated system, thereby preventing spam and abuse. The legal basis is the legitimate interest of the Controller pursuant to Art. 6(1)(f) GDPR in the security of the forms and the prevention of abuse.
Cloudflare acts as a data processor on our behalf. The service is not used for profiling or marketing purposes. For more information on how Cloudflare processes data: https://www.cloudflare.com/privacypolicy/
Art. 7 · Cookies and tracking technologies
The rayo.consulting website uses cookies and similar technologies. Below is the complete classification.
7.1 Technical / essential cookies
Necessary for the correct functioning of the site. They do not require consent under the Italian Data Protection Authority's Order of 8 January 2022.
| Name | Type | Duration | Purpose |
|---|---|---|---|
rayo_cookie_consent_v2 | localStorage (not an HTTP cookie) | 12 months | Saves the user's cookie preferences so the banner is not shown again |
rayo_chat_v1 | localStorage (not an HTTP cookie) | 30 days from the last message | Keeps the conversation with the "Ray" virtual assistant on your device so you can pick it up if you come back |
rayo_chat_teaser_dismissed | sessionStorage (not an HTTP cookie) | Until the browser tab is closed | Remembers that you dismissed the chat prompt so it is not shown again |
Note: these preferences are saved in the browser's localStorage / sessionStorage, not via HTTP cookies. They are not sent to the server automatically: the conversation stored in rayo_chat_v1 stays on your device and is transmitted only when you send a new message, to give the assistant the context of the ongoing chat. You can delete it at any time with the "New conversation" button in the chat header.
Note on Cloudflare Turnstile: the contact form is protected by Cloudflare Turnstile (Art. 6.1). As part of the anti-bot verification, Cloudflare may set temporary technical identifiers in the browser, needed solely to complete the security check. These are technical and essential technologies, not used for profiling or marketing purposes, and therefore not subject to prior consent. The exact names and durations of such identifiers are determined by Cloudflare and are described in the provider's documentation and privacy policy.
Note on Google Maps: the contact page embeds a Google Maps map in "click-to-load" mode: the map is not loaded automatically, but only after you explicitly click the preview. When it loads, Google (Google Ireland Ltd., with Google LLC in the USA) may set third-party cookies in your browser and receive your IP address and device information, needed to provide the maps service. Until you activate the map, no Google Maps cookie is set. For more information: policies.google.com/privacy.
7.2 Analytics cookies (with consent)
Activated only after your explicit consent via the banner. Used to collect aggregate and anonymous data on the use of the site (pages visited, duration, device, country). Not used for individual profiling.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
_ga | Google Analytics 4 | 2 years | Distinguishes users; contains an anonymous identifier |
_ga_G-FSDE8KC4X4 | Google Analytics 4 | 2 years | Maintains the session state for the specific GA4 property |
_gid | Google Analytics 4 | 24 hours | Distinguishes users over the course of a single day |
7.3 Managing preferences
You can change your cookie preferences at any time via:
- The "Cookie preferences" button in the site footer.
- The floating cookie icon in the bottom left.
- By sending a request to info@rayo.consulting.
You can also disable cookies directly in your browser. For specific instructions, consult the guide for the browser you use. Disabling analytics cookies does not compromise the usability of the site.
Art. 8 · Google Analytics 4 and Consent Mode v2
The site implements Google Analytics 4 (Property: G-FSDE8KC4X4) with Google Consent Mode v2.
How it works
- Before consent: the GA4 script is loaded but with the following signals denied:
analytics_storage: 'denied',ad_storage: 'denied',ad_user_data: 'denied',ad_personalization: 'denied'. In this mode Google does not place tracking cookies and does not collect identifying data. It may collect aggregate, "cookieless" data for statistical modelling (behavioural modelling), in a fully anonymous form. - After consent: if you accept analytics cookies,
analytics_storage: 'granted'is sent, the GA4 cookies are activated and sessions are tracked normally withanonymize_ip: true. Thead_storage,ad_user_dataandad_personalizationsignals remain'denied'as the site does not use behavioural advertising. - Withdrawal of consent: by setting preferences to "reject" or changing preferences,
analytics_storage: 'denied'is sent and the GA4 cookies are blocked.
Processing by Google
The data collected by Google Analytics are processed by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The transfer to the USA is covered by the Standard Contractual Clauses (SCC) approved by the European Commission. For more information: policies.google.com/privacy.
The Controller has configured GA4 with:
- Anonymised IP (
anonymize_ip: true): the IP address is truncated before being processed. - Data retention: 14 months.
- No sharing with Google for advertising purposes.
- No cross-site tracking or integration with Google Ads.
To disable Google Analytics tracking on all sites, you can use the browser add-on: tools.google.com/dlpage/gaoptout.
8.1 · Behavioural events tracked
With your consent, in addition to standard page views, GA4 records the following interaction events:
| Event | When it triggers | Data transmitted |
|---|---|---|
page_view | On each page load | URL, page title, referral source |
cta_call_click | Click on the "Book a free call" button | event_category parameter (e.g. hero, cta_marquee) |
contact_form_submit | Successful submission of the contact form | event_category parameter (contact) |
None of these events contain identifying personal data (email address, name, phone number or IP address). They transmit only anonymous behavioural signals. They are sent to Google only after the user's explicit consent (analytics_storage: 'granted'). Without consent, no event is forwarded to Google in identifiable form.
Art. 9 · Transfers outside the European Economic Area
Some of the providers listed in Art. 6 transfer data outside the EEA, in particular to the United States of America. Such transfers take place exclusively on the basis of adequate safeguards pursuant to Arts. 44-46 GDPR, namely:
- Standard Contractual Clauses (SCC) adopted by European Commission Decision 2021/914/EU.
- EU-US Data Privacy Framework (DPF), where applicable.
In particular, the following providers transfer data to the United States:
- Vercel Inc. (hosting and CDN), on the basis of the SCC and the related Data Processing Addendum.
- Cloudflare, Inc. (anti-bot protection of the forms via Turnstile), on the basis of the SCC and the EU-US Data Privacy Framework, to which Cloudflare adheres.
- Google LLC (Google Analytics 4, only with consent), on the basis of the SCC and the Google Ads Data Processing Terms.
- OpenAI Ireland Ltd. ("Ray" virtual assistant): the contract is entered into with the Irish entity, which is therefore directly subject to the GDPR. Technical processing of messages may however take place on OpenAI, L.L.C. infrastructure in the United States, on the basis of the SCC referenced in OpenAI's Data Processing Addendum.
- Google Ireland Ltd. (Google Maps, "click-to-load" map): the contract is entered into with the Irish entity, which is directly subject to the GDPR; when you activate the map, data may also be processed by Google LLC in the United States, on the basis of the SCC and the EU-US Data Privacy Framework, to which Google LLC adheres.
For details on each provider's transfers, please consult their respective privacy notices and Data Processing Agreements.
Art. 10 · Data security
We adopt technical and organisational measures appropriate to the risks in order to protect personal data from unauthorised access, loss, destruction or accidental disclosure, in compliance with Art. 32 GDPR. In particular:
- The site uses encrypted HTTPS/TLS connections.
- Data transmitted through the forms are encrypted in transit.
- Access to credentials and systems is limited to authorised personnel.
- Service providers are also selected on the basis of their security safeguards.
In the event of a personal data breach that poses risks to the rights and freedoms of data subjects, we will notify the Italian Data Protection Authority within 72 hours pursuant to Art. 33 GDPR.
Art. 11 · "Ray" virtual assistant (artificial intelligence)
The site offers "Ray", a conversational assistant powered by artificial intelligence. This article describes how it works and how we process data, in compliance with the GDPR and the transparency obligations of Regulation (EU) 2024/1689 (AI Act).
11.1 Transparency: you are talking to an AI
In accordance with Art. 50(1) of the AI Act, we inform you clearly that Ray is an artificial intelligence system and not a natural person. This information is given before the first interaction, in the opening message of the conversation, and is repeated permanently below the input field ("AI-generated answers"), so it stays visible for the whole chat. Ray is also instructed to declare that it is an AI whenever asked, and never to present itself as a human consultant or a member of the team.
Ray is a limited-risk AI system under the AI Act: it is an informational assistant and does not fall within the high-risk systems listed in Annex III of the Regulation.
11.2 Limitations of the assistant
Ray's answers are generated automatically by a language model and, by the very nature of this technology, may contain inaccurate or incorrect information. In particular:
- The answers do not constitute a contractual offer, a binding quote, or legal, tax or professional advice.
- Information about pricing, timelines and feasibility is purely indicative: only written communications from the Controller are authoritative.
- We encourage you to verify any relevant information before making decisions, and to contact us directly for anything contractual.
11.3 What data is processed
| Data | Source | Notes |
|---|---|---|
| Content of the messages you write | Provided by you | No personal data is required to use the assistant |
| History of the ongoing conversation | Stored in your browser (rayo_chat_v1) | Sent along with the new message to give the answer context |
| IP address | Automatic | Used solely for rate limiting and abuse prevention, not linked to message content |
| Technical session identifier | Generated by the server | A signed random string containing no identifying data, valid for 2 hours |
| Page language | Automatic | Determines the language of the reply |
Ray never asks you for personal data and is instructed not to solicit your name, email, phone number or company details: to be contacted, it directs you to the contact form. We nevertheless recommend that you do not enter personal, confidential or sensitive data into the chat (health data, credentials, third-party data, confidential business information). If you do so voluntarily, such data is processed as described in this article.
11.4 Where data is processed and for how long
Messages are transmitted over an encrypted connection to our server and from there to the language model provider, OpenAI Ireland Ltd., which acts as a data processor pursuant to Art. 28 GDPR.
- We do not retain conversations. Messages pass through our servers for the time technically required to generate the reply and are not saved to databases or application logs.
- The call to the provider is configured with retention disabled (
store: false): OpenAI does not archive conversations in its system beyond what is necessary for processing. - Data sent through the OpenAI API is not used to train the models, as provided by the provider's terms for business customers.
- The only persistent copy of the conversation is the one stored in your browser, on your device, for a maximum of 30 days from the last message. You can delete it immediately with the "New conversation" button in the chat header, or by clearing the site's data in your browser.
For information on processing by the provider: openai.com/policies/privacy-policy and openai.com/policies/data-processing-addendum.
11.5 Requesting a callback through the assistant
If you would rather not fill in the contact form, you can ask Ray to have someone get back to you. In that case:
- Ray collects only what you volunteer: name and email (required), plus phone and company if you choose to give them.
- Before sending anything, Ray shows you a summary of what it is about to transmit and asks for explicit confirmation, referring you to this notice. The send happens only after you consent; this is not left to the assistant alone but is also enforced server-side, which refuses the transmission without confirmation.
- The details are emailed to info@rayo.consulting, the same inbox the contact form feeds. They are not saved to a database or used for any other purpose.
- Along with the details, a short summary written by Ray of what emerged in the conversation (sector, need, urgency) is sent. The full chat transcript and your IP address are not transmitted.
- Legal basis: Art. 6(1)(b) GDPR — pre-contractual measures taken at your request.
- Retention: the same as for contact form data (Art. 4).
- Ray never asks for these details on its own initiative: the request has to come from you. You can use the contact form instead of the assistant at any time.
11.6 No automated decision-making
Ray does not make automated decisions producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR. It does not carry out profiling, does not assign individual scores, and does not determine access to services or commercial terms. Every assessment of a commercial request is carried out by a person.
Conversations are not used to build individual profiles or for behavioural marketing purposes.
11.7 Security of the assistant
To prevent abuse of the service we apply: Cloudflare Turnstile anti-bot verification when the chat is opened (Art. 6.1), rate limits per IP address and per session, message length limits, and cryptographically signed sessions with an expiry. These controls process the IP address on the basis of the legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
11.8 Your rights
Since we do not retain conversations server-side, the most immediate way to exercise the right to erasure of chat content is to delete the conversation from your browser using the "New conversation" button. All the rights described in Art. 5 remain unaffected and can be exercised by writing to info@rayo.consulting.
Art. 12 · Protection of minors
The site and the "Ray" virtual assistant are aimed at an adult B2B audience (businesses, professionals and freelancers) and are not intended for children under 14, the threshold set for consent to the processing of data in information society services by Art. 2-quinquies of Italian Legislative Decree 196/2003 (Privacy Code).
We do not knowingly collect personal data of children under 14 and we do not carry out any marketing activity aimed at minors. If a minor provides us with personal data (for example through the contact form or the chat) without the consent of the holder of parental responsibility, the Controller will delete it without undue delay as soon as it becomes aware of it. Anyone who believes that a minor has sent us personal data can report it by writing to info@rayo.consulting and we will proceed with the deletion.
Art. 13 · Changes to this notice
We reserve the right to update this notice at any time to reflect regulatory, technical or operational changes. The updated version will be published on this page with the new revision date and the updated version number.
In the event of substantial changes affecting the processing of data provided by you (e.g. new purposes, new recipients), we will inform you by email if you have provided your address in the context of a contract.
We invite you to consult this page periodically. The last revision is indicated at the top of the document.