LTAPEX

Privacy and cookie notice

Last updated: 11 August 2026

This notice describes how personal data is processed when you visit https://www.ltapex.it (the “Site”) and use its services (contact forms, job applications, measurement and marketing tools), under Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003 as amended, and applicable cookie rules.

The Site is operated under the LTAPEX brand. Please read this notice carefully before submitting personal data or consenting to non-essential cookies.

1. Data controller

The data controller is LTA INVEST SRL (brand LTAPEX), VAT IT11637550960, with operational address at Via Montefeltro, 6, 20156 Milano (MI), Italia.

Email: corporate@ltapex.it — Phone: +39 351 468 1504.

No Data Protection Officer (DPO) has been appointed at this time. For privacy requests, contact the controller at the addresses above.

2. Scope

This notice covers personal data collected through the Site, including:

  • browsing pages and interacting with content;
  • messages sent via contact forms (Contact page and landing pages);
  • applications via «Careers» forms (open roles and spontaneous applications);
  • management of cookie and tracking consent;
  • use, subject to consent, of Google Analytics 4, Google Ads and the Meta Pixel (Facebook/Instagram), including Meta Conversions API on the server side.

It does not cover third-party sites or services reached via external links, which remain under their own controllers.

3. Categories of personal data

Depending on your interaction, we may process:

  • identity and contact data: name, surname, email, phone, company;
  • message content or project / application information;
  • CVs and other attachments (if provided in career forms);
  • technical browsing data: IP address, user agent, URLs visited, date/time, device and browser data;
  • cookie and SDK identifiers (e.g. preference storage, GA4 _ga and related cookies, Meta _fbp/_fbc, Google advertising cookies);
  • cookie consent preferences stored locally on your device;
  • marketing-related data (consent to receive commercial emails).

We do not request special categories of data (GDPR Art. 9). Please do not include unnecessary sensitive information in forms.

4. Purposes and legal bases

Data is processed only for the purposes below and on the legal bases required by the GDPR.

4.1 Site operation and security

To keep the Site available, secure and reliable, prevent abuse and comply with legal obligations.

  • Legal basis: legitimate interest (Art. 6.1.f GDPR) and, where applicable, legal obligation (Art. 6.1.c).

4.2 Contact forms

To handle requests submitted via forms (name, email, phone, company, message and contextual fields), reply and, where needed, arrange an initial commercial or project discussion.

Messages are forwarded by email to company mailboxes (e.g. corporate@ltapex.it / web@ltapex.it) through email delivery services (SMTP or Resend).

  • Legal basis: pre-contractual steps / handling your request (Art. 6.1.b GDPR) and legitimate interest in managing communications (Art. 6.1.f).
  • The privacy acknowledgement checkbox documents that you have read this notice before sending.

4.3 Marketing emails

If you tick the optional marketing box on the form, we may email you about LTAPEX news, initiatives and updates.

  • Legal basis: consent (Art. 6.1.a GDPR).
  • You may withdraw consent at any time by writing to us or using unsubscribe links where available, without affecting prior lawful processing.

4.4 Job applications («Careers»)

To assess applications for open or spontaneous roles: identity, contact details, message and CV / attachments.

  • Legal basis: pre-contractual steps (Art. 6.1.b GDPR) and, where required, consent to retain the CV beyond a specific selection (Art. 6.1.a).

4.5 Analytics — Google Analytics 4 (GA4)

With your consent to the «Analytics» category, we use Google Analytics 4 (Measurement ID G-BZ6GBCTMG1) to understand, in aggregate, how the Site is used (pages, interactions, devices).

The gtag setup uses Google Consent Mode v2: until you consent, analytics_storage remains «denied» and non-essential analytics cookies are not activated.

  • Legal basis: consent (Art. 6.1.a GDPR; Italian cookie rules for non-technical tracking).
  • Provider: Google Ireland Limited / Google LLC. More info: https://policies.google.com/privacy

4.6 Marketing and campaign measurement — Meta Pixel and Google Ads

With your consent to the «Marketing» category we may enable:

• Meta Pixel (Facebook/Instagram) for PageView, Lead events and Meta campaign measurement/optimisation;

• Meta Conversions API (server-side), with SHA-256 hashing of email and/or phone and, where available, _fbp/_fbc cookies, IP and user agent, to improve event reliability (e.g. form submit) when marketing consent is granted;

• Google Ads (e.g. lead form conversions) and related advertising signals via Consent Mode (ad_storage, ad_user_data, ad_personalization).

  • Legal basis: consent (Art. 6.1.a GDPR; Italian cookie rules).
  • Providers: Meta Platforms Ireland Ltd. / Meta Platforms, Inc. — https://www.facebook.com/privacy/policy ; Google Ireland Limited / Google LLC — https://policies.google.com/privacy
  • Without marketing consent these tools are not loaded or remain in a revoked consent state.

6. Recipients and processors

Data may be disclosed, within the stated purposes, to:

  • authorised staff of LTA INVEST SRL / LTAPEX;
  • hosting and infrastructure providers (e.g. Vercel) and storage (e.g. Vercel Blob, where used);
  • email delivery providers (corporate SMTP or Resend) for form notifications;
  • Google (Analytics 4, Ads, gtag / optionally Google Tag Manager);
  • Meta Platforms (Pixel and Conversions API);
  • advisors bound by confidentiality, where needed;
  • public authorities, where required by law.

Providers processing data on our behalf act, where required, as processors under GDPR Art. 28 under appropriate contracts or clauses.

7. Transfers outside the EEA

Some providers (notably Google and Meta) may also process data in the United States or other countries outside the European Economic Area.

Such transfers rely on adequacy decisions (where applicable, e.g. EU-US Data Privacy Framework for certified entities) and/or Standard Contractual Clauses and supplementary measures described by the providers.

For up-to-date details, see Google’s and Meta’s privacy notices linked above.

8. Retention periods

We keep data only as long as needed for the purposes:

  • contact form requests: normally up to 24 months from the last useful contact, unless defence or legal needs require longer;
  • email marketing consent: until withdrawal or objection;
  • applications / CVs: normally up to 12 months from receipt, unless otherwise agreed or a selection process is ongoing;
  • technical and security logs: limited technical periods (normally no more than 12 months, unless investigating incidents);
  • analytics / ads data: per retention set with Google and Meta and while consent remains valid;
  • cookie preference on your device: until you change or clear it.

After these periods, data is deleted or anonymised, unless further retention is required by law or to establish/defend legal claims.

9. Your rights

Within the limits of the GDPR, you may exercise:

  • access (Art. 15);
  • rectification (Art. 16);
  • erasure (Art. 17);
  • restriction (Art. 18);
  • portability (Art. 20), where applicable;
  • objection (Art. 21), especially for legitimate-interest processing or direct marketing;
  • withdrawal of consent (Art. 7.3), without affecting prior lawful processing;
  • complaint to the Italian Garante (www.garanteprivacy.it) or the supervisory authority of your EU country of residence or work.

To exercise your rights, email corporate@ltapex.it or use the Contact page, providing a useful contact so we can identify you and reply. We will respond within the statutory timeframe (normally 30 days).

10. Children

Site services are not directed at children under 14 (or the minimum age required by applicable law for digital consent). We do not knowingly collect children’s data. If you believe a child has provided data, contact us for deletion.

11. Security

We apply appropriate technical and organisational measures (HTTPS, access control, data minimisation, hashing of data sent via Meta CAPI, consent gating before loading tracking scripts) to protect data against unauthorised access, loss or unlawful use. No system is fully secure: please avoid sending highly sensitive information through web forms when a more private channel is appropriate.

12. Changes to this notice

We may update this notice for organisational, technical or legal reasons. The «Last updated» date at the top shows the current version. For material changes, we may highlight the update on the Site or through other appropriate channels.

To exercise your rights or ask questions about data processing, reach us from the Contact page.