Privacy Policy

1. Data controller

The controller of personal data processed through this website is Modelbel.

Full legal identity (company name, registered office, VAT/tax ID, certified email): OWNER_CONFIRMATION_REQUIRED.

Privacy contact: OWNER_CONFIRMATION_REQUIRED.

DPO (if appointed): OWNER_CONFIRMATION_REQUIRED — declare if appointed.

Document status: OWNER_REVIEW_REQUIRED — legal/privacy review before definitive publication.

2. Scope

This notice describes processing related to browsing the Modelbel website in its current technical configuration (IT/EN informational site).

The “Start a Project” form, file uploads, transactional email, analytics and marketing tracking are NOT operational in this phase and are not active processing until enabled by the Controller.

3. Categories of data

Browsing/technical data: IP address, user-agent and request metadata according to hosting platform defaults (Cloudflare), needed to deliver the site and for security.

Consent preferences: selected categories, timestamps and CMP/policy versions, stored in first-party localStorage (`mb_consent_v1`), without name, email or other identity data.

Contact / project / CAD file data: not collected until the form is active.

4. Purposes

Providing the website and public content.

Security, abuse prevention and service stability at the edge.

Managing and storing cookie/consent preferences.

Future purposes (inquiry, analytics, email): only after Controller decision and an update to this notice.

5. Legal bases

Definitive legal bases for each processing activity require Controller/counsel confirmation: OWNER_CONFIRMATION_REQUIRED.

In principle, site delivery and technical security measures may rely on legitimate interest or obligations related to providing the online service; non-essential tools (e.g. non-exempt analytics) require consent where applicable.

6. Mandatory or optional nature

Browsing the public site does not require providing identity data.

Refusing non-essential cookies/tools does not block access to informational content.

When the form becomes active, mandatory fields will be marked on page; without them an inquiry may not be processable.

7. Processing methods

Processing is primarily automated via edge/hosting infrastructure.

No automated decision-making producing legal effects on the data subject is implemented on the current site.

8. Security measures

The site applies technical measures appropriate to the project’s state of the art (security headers, CSP, sensitive-log minimisation, closed production gate for risky features).

For information handled in industrial projects, Modelbel distinguishes personal data (covered by this notice) from confidential technical/industrial information (CAD, drawings, prototypes). See also the Security & Confidentiality page.

At a high level (Controller-confirmed): project working archives are local/offline; online space, when active, is only a temporary receiving area; access is limited to authorised people with individual accounts; projects are segregated by client/job; project backups are encrypted, in another location and network-disconnected.

On this site, project/case-study references are subject to a publication gate and publication authorisation; client names, logos or results are not invented.

Sensitive internal infrastructure details (IPs, topology, credentials, firewalls) are not published.

8bis. Project files, CAD and attachments

When collected (active form/upload), files may contain: (a) personal data possibly present in metadata or documents; (b) non-personal confidential technical information (CAD models, specifications, tolerances).

Current state: upload and forms are not operational — no active attachment processing via the site. Do not treat this as current processing. Production Security Gate: CLOSED.

Intended future architecture (not operational): private online receive → malware scan → quarantine/validation → authorised transfer to offline working archive → deletion of the temporary online copy. Selected malware technology: not production-active on the public channel.

Intended future purposes: technical assessment of the project and handling the inquiry. Numeric retention periods, contractual return/deletion and dedicated email provider: LEGAL_REVIEW_REQUIRED / OWNER_CONFIRMATION_REQUIRED before activation.

Confidential industrial information is not handled as “cookies” and does not replace the Controller’s offline organisational measures.

9. Retention

Definitive retention periods and criteria: LEGAL_REVIEW_REQUIRED / OWNER_CONFIRMATION_REQUIRED.

End-of-project principle (organisationally confirmed): the agreement/order must define whether files are returned, retained for a defined period or deleted; at the deadline, applicable working copies and backups are deleted and the action is recorded. The numeric period remains LEGAL_REVIEW_REQUIRED.

Consent preferences: until cleared by the user or the technical storage key is updated.

Platform logs: according to hosting provider settings — OWNER_CONFIRMATION_REQUIRED.

10. Recipients and processors

Hosting/CDN/edge: Cloudflare (role and DPA: OWNER_CONFIRMATION_REQUIRED).

Dedicated project mailbox (architecture): progetti@modelbel.it — final provider Google Workspace or Microsoft 365 not selected (OWNER_CONFIRMATION_REQUIRED). Production email sending is not active.

Analytics, CRM and production malware scanning on the public channel: not active; they are not current processors via the site.

11. Transfers outside the EEA

Any transfers related to Cloudflare’s global edge: OWNER_CONFIRMATION_REQUIRED (assess transfer tool and the provider’s current notices).

No analytics/marketing services implying additional transfers are activated.

12. Data subject rights

Where applicable, data subjects may exercise rights under GDPR Arts. 15–22 (access, rectification, erasure, restriction, objection, portability, withdrawal of consent).

Practical exercise: contact OWNER_CONFIRMATION_REQUIRED (to be confirmed). No self-service portal is available in this phase.

Right to lodge a complaint: Italian Data Protection Authority (https://www.garanteprivacy.it) or other competent authority.

13. Cookies and tracking tools

Details of tools actually used are in the Cookie Policy. No analytics or marketing pixels are installed.

14. Changes

Version 2026-10-01 — updated 2026-10-01.

Material changes will be published on this page with a new version/date.

15. Project technical information (not only privacy)

Industrial technical information (CAD, drawings, prototypes) is not automatically personal data. This Privacy Policy does not replace NDAs, confidentiality agreements, contractual terms or IP agreements.

Commercial confidentiality wording and client declarations: LEGAL_REVIEW_REQUIRED — see the Security & Confidentiality page.

Secure intake architecture (quarantine, scanning, private storage) is prepared but not operational while the Production Security Gate remains CLOSED.