Privacy & Cookie Policy
Privacy notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (Personal Data Protection Code), as amended by Legislative Decree 101/2018, to the users of www.hytama.com.
01Data controller
EMMEVI S.r.l.
Registered office: Viale Sant'Ignazio di Loyola 280 – 80131 Naples (NA), Italy
VAT no. / Tax code: IT 08661611213
E-mail: info@hytama.com · Phone: +39 081 6129139
HYTAMA TOOLS® is a brand of EMMEVI S.r.l. (the “Controller”). Any request concerning the processing of personal data may be addressed to the e-mail address above. This English version is provided for convenience; in case of discrepancy, the Italian version prevails.
02Categories of data processed
a) Browsing data
During their normal operation, the IT systems and hosting infrastructure of this website acquire certain data whose transmission is implicit in the use of Internet protocols: IP addresses, date and time of the request, pages visited, server response codes, browser type and operating system. This information is necessary to deliver the website and is used in aggregate form for technical, anonymous statistical and security purposes.
b) Data voluntarily provided through the contact forms
The website provides two forms (“Contact” and “Become a retailer”) through which users may submit: first name, surname and e-mail address (required in order to reply), and optionally company, phone number, business sector, subject and message text. The data entered are transmitted by e-mail to the Controller (info@hytama.com) and are not stored in publicly accessible databases. The same applies to communications sent spontaneously to the e-mail addresses or phone numbers published on the website.
c) Virtual assistant (AI-powered chatbot)
The website offers a virtual assistant based on artificial intelligence to answer questions about products, certifications and the retail network. Users are interacting with an automated system, not a human operator. When a message is sent, the text of the conversation and the browsing language are transmitted, through our systems, to the external AI service provider (Anthropic, see section 08) for the sole purpose of generating the reply. For security and abuse-prevention purposes, our systems apply a limit to the number of messages per IP address. Please do not enter personal data, third-party data or confidential information in the chat: the service is intended for general product questions.
03Purposes and legal bases of processing
| Purpose | Legal basis (Art. 6 GDPR) | Data concerned |
|---|---|---|
| Operating the website, ensuring IT security and preventing abuse (including the anti-abuse limit of the virtual assistant) | Legitimate interest of the Controller – Art. 6(1)(f) | Browsing data, IP address |
| Replying to information and contact requests submitted via the forms, e-mail or phone | Pre-contractual measures taken at the data subject's request – Art. 6(1)(b) | Identification and contact data, message content |
| Assessing and managing “Become a retailer” applications and the resulting business relationships | Pre-contractual measures / performance of a contract – Art. 6(1)(b) | Identification, company and contact data |
| Providing automated replies through the virtual assistant | Pre-contractual measures at the data subject's request – Art. 6(1)(b); legitimate interest – (f) | Message text, language, IP address (anti-abuse) |
| Compliance with legal obligations, regulations and orders of the authorities | Legal obligation – Art. 6(1)(c) | Data relevant to the obligation |
| Establishing, exercising or defending legal claims | Legitimate interest – Art. 6(1)(f) | Data relevant to the dispute |
The Controller does not carry out direct marketing through the website, nor does it profile its users. Should such activities be introduced in the future, this notice will be updated and, where required, the data subject's prior consent will be requested.
04Processing methods and security
Processing is carried out using IT and telematic tools, with logic strictly related to the purposes indicated above and with the adoption of appropriate technical and organisational measures pursuant to Art. 32 GDPR (including HTTPS encrypted connections, access controls, data minimisation and anti-abuse limits).
The Controller does not use fully automated decision-making producing legal effects on data subjects within the meaning of Art. 22 GDPR. The virtual assistant generates automated informative replies but takes no decision affecting users' rights.
05Recipients of the data
Personal data may be processed by:
- authorised internal personnel, instructed pursuant to Art. 29 GDPR;
- technical service providers acting as processors pursuant to Art. 28 GDPR or as independent controllers, including: the website hosting provider, e-mail service providers and the AI service provider for the virtual assistant (Anthropic, see section 08);
- public authorities and supervisory bodies, in the cases provided for by law.
Personal data are neither disseminated nor sold to third parties.
06Transfers outside the EU/EEA
Some providers are established outside the European Economic Area. In such cases, transfers take place only where appropriate safeguards exist pursuant to Arts. 44 et seq. GDPR:
- Anthropic PBC (United States) – AI service for the virtual assistant: transfer based on the EU-U.S. adequacy decision (EU-U.S. Data Privacy Framework), where the provider is certified, and/or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR);
- OpenStreetMap Foundation (United Kingdom) – maps in the “Where to buy” section: transfer based on the European Commission's adequacy decision for the United Kingdom;
- font and CDN library providers (USA/Ireland) – see section 08: transfers covered by adequacy decisions and/or Standard Contractual Clauses.
07Retention period
- Browsing data and technical logs: for the time strictly necessary for security and operational purposes and, as a rule, no longer than 90 days, except where needed to investigate unlawful activity;
- Contact requests: for the time needed to provide a reply and, as a rule, no longer than 24 months from the last interaction;
- Retailer applications: for the duration of the negotiation and of any business relationship, plus the retention periods required by civil and tax law;
- Virtual assistant: conversations are not permanently stored on the Controller's systems; the chat history resides temporarily in the user's browser for the duration of the session. Anti-abuse technical data (IP) are kept for the time strictly necessary. The AI provider retains data for the limited periods set out in its own policies (see section 08).
08Third-party services
The website uses the following external services, which may involve the transmission of the user's IP address to the provider's servers when the resource is loaded or the service is used:
Anthropic – AI virtual assistant
Messages sent to the virtual assistant are processed through the APIs of Anthropic PBC (USA) for the sole purposes of generating the reply and ensuring the security of the service, under the provider's commercial terms. Provider's notice: anthropic.com/legal/privacy.
OpenStreetMap – retailer map
The interactive map in the “Where to buy” section is built with the Leaflet library and loads map tiles from the servers of the OpenStreetMap Foundation (United Kingdom). Provider's notice: osmfoundation.org/wiki/Privacy_Policy.
Google Fonts – typefaces
To display its typefaces, the website may rely on the Google Fonts service (Google Ireland Ltd. / Google LLC). Loading the fonts involves transmitting the IP address to Google's servers; no cookies are installed. Provider's notice: policies.google.com/privacy.
CDNs for technical libraries
Certain technical libraries (e.g. Leaflet) may be delivered through third-party Content Delivery Networks. The CDN receives the technical request (including the IP address) needed to deliver the file; no profiling is carried out on behalf of the Controller.
10Rights of the data subject
Pursuant to Arts. 15-22 GDPR, data subjects have the right to obtain from the Controller: access to their personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Requests may be sent informally to: info@hytama.com. The Controller will reply within one month of receiving the request (Art. 12 GDPR).
Right to lodge a complaint. Data subjects who consider that the processing infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) – Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it – or with the supervisory authority of their habitual residence or place of work.
11Minors
The website and its services are aimed at an adult and professional audience and are not intended for children under 14 years of age (Art. 2-quinquies of the Italian Privacy Code). The Controller does not knowingly collect personal data from minors; should it become aware of any, such data will be promptly deleted.
12Nature of data provision
Providing the data marked as required in the contact forms is necessary in order to reply to the request: failure to provide them makes it impossible to respond. Providing any further data is optional. Browsing the website does not require any registration.
13Use of artificial intelligence
This website uses artificial intelligence (AI) tools to provide certain services, in line with Regulation (EU) 2024/1689 (AI Act) and Italian Law No. 132 of 23 September 2025.
Virtual assistant (chatbot)
The website provides a virtual assistant based on artificial intelligence systems. At the start of each conversation the user is informed that they are interacting with an AI system and not with a human operator. Requests sent through the assistant are processed solely to provide relevant answers; the processing of any personal data is governed by this privacy notice. We recommend not entering personal or confidential data in the chat.
AI-generated content
Part of the visual content published on the website and on HYTAMA TOOLS channels — in particular images and videos for promotional and illustrative purposes — is generated or edited using artificial intelligence tools and may depict products, settings or scenes reconstructed digitally. Where generated or manipulated with AI, such content is marked as required by Article 50 of Regulation (EU) 2024/1689 (AI Act) and is in any case subject to human review and control before publication. Images are for illustrative purposes and may not exactly match the appearance, colours or dimensions of the actual product.
Human oversight. HYTAMA TOOLS maintains human oversight over processes that use AI systems: relevant decisions are not left exclusively to automated systems.
14Changes to this notice
The Controller reserves the right to amend or update this notice, including as a result of regulatory changes or changes to the services offered. The version published on this page, with its update date, is the one in force. Users are invited to review it periodically.
15Legal notice
Information provided pursuant to Art. 7 of Italian Legislative Decree 70/2003 and Art. 2250 of the Italian Civil Code:
EMMEVI S.r.l.
Registered office: Viale Sant'Ignazio di Loyola 280 – 80131 Naples (NA), Italy
VAT no. / Tax code and registration no. with the Naples Companies Register: 08661611213
REA no.: NA-975023
Share capital: € 10,000.00 fully paid up
Certified e-mail (PEC): emmevisrl@pec.cloud
E-mail: info@hytama.com · Phone: +39 081 6129139
HYTAMA TOOLS® is a registered trademark. All website contents (texts, images, logos, datasheets) are protected by industrial property and copyright laws; unauthorised reproduction is prohibited.