Privacy policy
We sell systems that have to be compliant: it would be odd if we were not. Here, in full, is what we collect through this site, very little, and what happens to clients' data when we work with them.
- No cookies, no analyticsThe site does not track its visitors.
- The form writes only to usRequests reach info@librajf.com and no one else.
- Clients' data stays theirsIt trains no models and never leaves the agreed perimeter.
Last updated: 10 October 2026 · Given under Article 13 of Regulation (EU) 2016/679 and Legislative Decree 196/2003
1. Controller and contact details
The controller is LibraJF S.R.L., with registered office at Via Lodovico Mancini 6, 20129 Milan (MI), Italy, tax code and VAT number 14393550968, an innovative startup entered in the special section of the Companies Register under Decree-Law 179/2012.
For any matter concerning personal data you can write to info@librajf.com or, for communications with legal value, to the certified email address librajf@namirialpec.it.
We have not appointed a data protection officer (DPO): none of the cases in Article 37 of Regulation (EU) 2016/679 applies, as we do not carry out regular and systematic monitoring on a large scale or process special categories of data on a large scale.
2. What data we process and where it comes from
We collect data directly from you. This notice is given under Article 13 of the Regulation.
Visitors: browsing data
The server hosting the site logs access, like any web server: IP address, date and time, page requested, response code, browser type. These are needed to run and secure the service, are not used to profile anyone and are not combined with other information.
People who write to us: the contact form and email
The form sends your request to the company mailbox info@librajf.com through the server hosting the site. It is not stored in a database and is not added to any mailing list: we treat it like an ordinary email. If sending fails, the form opens a pre-filled message in your email program, and you decide whether to send it.
Name, email address, phone number and type of organisation are required. Company or fund, sector, need, indicative ticket and message are optional or up to you. Please do not enter health data or other special categories of data, or data about other people, in the free-text fields.
If you reach the site from one of our advertising campaigns, the source written in the page address, such as the campaign name, is added to the message. We use no cookies or other identifiers to know this.
To protect the form from automated submissions we use a field invisible to people, a minimum completion time and a limit of five submissions per hour: to apply it, the server keeps a cryptographic fingerprint of the IP address, computed with a secret key, together with the submission times. Fingerprints older than one hour are deleted automatically.
Clients, suppliers and investors
With anyone who starts a relationship with us we process the contact details of the people involved and the necessary administrative and billing data. With anyone who contacts us as an investor we process the data they give us in order to reply and, at their request, send materials and arrange a meeting.
Cookies
The site sets no cookies, uses no other tracking tools and loads no resources from third-party servers. The details are in the cookie policy.
3. Why we process data, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to a request and assessing a possible relationship | Form or email data | Pre-contractual steps at the data subject's request, Art. 6(1)(b) |
| Sending materials to investors who request them and arranging meetings | Contact details, fund or company, indicative ticket | Pre-contractual steps at the data subject's request, Art. 6(1)(b) |
| Performing the contract and providing support | Contact and administrative data | Performance of a contract, Art. 6(1)(b) |
| Meeting accounting, tax and legal obligations | Billing data | Legal obligation, Art. 6(1)(c) |
| Site security and protecting the form from abuse | Access logs, IP fingerprint | Legitimate interest, Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | Data relevant to the case | Legitimate interest, Art. 6(1)(f) |
Legitimate interest covers only the security of the service and the protection of our rights: we have balanced it against your interests, which prevail over any other use. We do not use the data collected here for marketing, do not transfer it and do not use it for automated decisions.
Required or optional
No data is required by law. Without a name, email and phone number, however, we cannot reply; once a relationship has started, administrative data is necessary to perform the contract and meet tax obligations.
4. How we protect data
- Always-encrypted connection (HTTPS with HSTS) between your browser and the site.
- Access to data restricted to authorised and instructed people, under Article 29 of the Regulation and Article 2-quaterdecies of the Italian Privacy Code.
- No decision based solely on automated processing, including profiling, within the meaning of Article 22.
- In the event of a data breach involving a risk, we notify the Italian Data Protection Authority within 72 hours and, where the risk is high, inform the people concerned, as required by Articles 33 and 34.
5. How long we keep data
- Contact requests with no follow-up, including from investors: twenty-four months from the last exchange, then deletion.
- Contractual relationships: for the term of the contract and ten years after it ends, as required by Article 2220 of the Italian Civil Code.
- Site access logs: the technically necessary time, and in any case no longer than twelve months.
- IP address fingerprint for the form submission limit: one hour, then automatic deletion.
- If a dispute is pending, the relevant data until it is resolved.
6. Who else sees the data
The data is accessible to authorised LibraJF staff. It may be processed on our behalf by processors appointed in writing under Article 28: the provider hosting the site and the contact form (Google Ireland Limited, Firebase service; the form runs on servers in Belgium), the email provider (Hostinger, on servers in the European Union), our accounting and tax adviser and, for clients, the technology suppliers named in the contract. Public authorities may receive it where the law requires.
The up-to-date list of processors is available on request. We do not sell personal data, do not pass it to advertising intermediaries and do not use it to build profiles.
7. Transfers outside the European Economic Area
We keep processing within the European Economic Area. The exception is the delivery of the site's pages: to serve them quickly everywhere, Firebase uses a network of servers that includes locations outside the Union, and Google LLC participates in the EU-US Data Privacy Framework. If another supplier ever involved a transfer to a third country, it would take place only on the basis of a European Commission adequacy decision, including the EU-US Data Privacy Framework for participating companies, or the standard contractual clauses of Implementing Decision (EU) 2021/914, with the necessary supplementary measures. You can ask us for a copy of the safeguards adopted.
8. The data we process on behalf of clients
When a company adopts one of our modules, the data the system reads, such as documents, master data or plant readings, remains that company's, which is its controller. LibraJF acts as processor and works only on the client's documented instructions, under the Article 28 agreement attached to every contract. The client's own privacy notice applies to that data.
Each client's data is kept separate from every other client's; modules can be installed in a cloud in the European Union, in a dedicated private cloud or on premises, on the client's servers. When the relationship ends the data is returned in the agreed format and deleted from our systems.
9. Artificial intelligence
- Clients' data does not train models, ours or anyone else's, and does not feed a model shared between different clients.
- A third-party model is used only where provided for and authorised in the contract, where the supplier is named as a sub-processor and its use is limited.
- System decisions are kept in a log the client can consult: every answer can be traced back to the documents that produced it.
- Our modules produce material that a person reviews and approves.
On Regulation (EU) 2024/1689 on artificial intelligence, whose obligations apply in stages: our modules are designed in compliance with the AI Act, with traceability, technical documentation and human oversight as starting requirements.
10. Your rights
At any time you can ask us for access to your data (Article 15), rectification (16), erasure (17), restriction of processing (18) and portability (20). You can object at any time to processing based on legitimate interest (21). If any processing were based on consent, you could withdraw it whenever you wish, without affecting processing already carried out (7(3)).
Just write to info@librajf.com or to the certified address librajf@namirialpec.it: we reply without delay and in any case within one month, extendable by two months for complex requests, as provided by Article 12. Exercising your rights is free of charge.
If you believe the processing breaches the Regulation, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the State where you live or work, or go to court.
11. Minors
The site is aimed at businesses, professionals and investors. We do not knowingly collect data from children under fourteen, the age set by Article 2-quinquies of the Italian Privacy Code; if we receive any by mistake, we delete it.
12. Changes to this notice
If we change the way we process data, we update this page and the date at the top before the change takes effect. Previous versions are available on request.
See also: Cookie policy · Legal notice