Privacy Policy

1. Data Controller

khlumen.com is operated by the data controller for personal data processed via the site:

2. Data we collect

Browsing the site does not require registration. We process the minimum data needed to deliver the site and to handle business contact requests:

• Technical metadata: IP address, user agent, HTTP referrer and request time, logged automatically by the hosting provider for security and routing.
• Preference data: your language choice (EN / IT), kept in a first-party cookie and in your browser's localStorage, and your cookie-banner choice, kept in localStorage.
• Contact data: when you use the contact form, the details you provide (name, email, company if you add it, message), the service page you came from, if any, and the language of the request. If you write to us by email, the content of that email.
• Usage statistics: only if you accept analytics cookies, Google Analytics 4 collects aggregated data about page views and interactions.
• Booking data: if you book a call, the details you enter in the Calendly booking form.
• Advertising measurement: only if you accept marketing cookies, the Meta pixel and our server send Meta the pages you visit, the service pages you view and whether you contact us (form, email or booking link), with your IP address, browser user agent and Meta's _fbp/_fbc identifiers. When you send the contact form, your email address is also sent, hashed (SHA-256), so Meta can match the request to an ad.

We do not collect special-category data (Art. 9 GDPR) or payment data. We use data for advertising only within the measurement described above, and only with your consent.

3. Purposes of processing

• Deliver the website and keep it secure and available.
• Reply to inbound B2B contact requests and assess potential engagements.
• Measure visits in aggregate to improve the site, only with your consent.
• Measure and improve our ads on Facebook and Instagram, only with your consent.
• Comply with legal obligations (e.g. requests from authorities).

4. Legal basis

Processing relies on the following GDPR legal bases:

• Pre-contractual measures (Art. 6.1.b) for handling contact requests and call bookings.
• Legitimate interest (Art. 6.1.f) for technical site operation and security.
• Consent (Art. 6.1.a) for analytics cookies (Google Analytics 4) and marketing cookies (Meta pixel and Conversions API). See the Cookie Policy.
• Legal obligation (Art. 6.1.c) for any requests from competent authorities.

5. Retention

• Hosting-level technical logs: kept for the minimum period needed for security and operational purposes, typically up to 90 days.
• Contact request content (email exchanges, intake forms): kept for up to 12 months from the last interaction, or longer if a commercial relationship is in place or required by law.
• Google Analytics data, if you consented: kept for the retention period set in our Google Analytics property, at most 14 months.
• Meta advertising data, if you consented: we keep none of it on our side; Meta keeps it under its own terms (meta.com/privacy).

6. Recipients and transfers

Some data is processed by service providers acting on our behalf. Some of them may process it outside the EU, under their standard data-protection terms:

• Vercel Inc.: hosting and CDN. Vercel may process data in the EU or, when traffic is routed through its global edge network, in third countries. See vercel.com/legal/privacy-policy.
• Resend: delivers the contact-form notification to us and the acknowledgement email to you, so the content of your request passes through its email infrastructure. See resend.com/legal/privacy-policy.
• Calendly: the booking tool behind "Book 30 minutes". Its script loads only when you click to book; what you enter there is processed by Calendly under its own privacy policy (calendly.com/privacy).
• Google (Google Analytics 4): only if you accept analytics cookies, to measure visits in aggregate. See policies.google.com/privacy.
• Meta Platforms Ireland Ltd. (Meta pixel and Conversions API): only if you accept marketing cookies, to measure our ads on Facebook and Instagram. For the collection and transmission of this data we are joint controllers with Meta (Art. 26 GDPR); what Meta does afterwards falls under its own policy, meta.com/privacy. Meta may transfer data to the United States.
• Our email provider, for messages sent to hello@khlumen.com and for our replies.

No data is sold. Data reaches Meta only with your marketing consent, as described above.

7. Your rights

Under Articles 15–22 GDPR you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (right to be forgotten).
• Restrict processing in specific cases.
• Receive your data in a structured, commonly used format (portability).
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting prior lawful processing. For analytics and marketing cookies, use "Change cookie preferences" on the Cookie Policy page.
• Not be subject to a decision based solely on automated processing (Art. 22).

To exercise any of these rights write to hello@khlumen.com. You also have the right to lodge a complaint with a competent supervisory authority, for example the Agencia Española de Protección de Datos (AEPD, www.aepd.es) or, for users based in Italy, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

8. Cookies

khlumen.com uses the technical cookies and browser storage it needs to run. Google Analytics 4 is loaded only after you accept analytics cookies in the banner, and the Meta pixel only after you accept marketing cookies; you can change that choice at any time from the Cookie Policy, where every cookie is listed.

9. Changes to this policy

We may update this policy to reflect regulatory or operational changes. Updates are published on this page with the last-updated date above. You are encouraged to review it periodically.