Privacy notice

Data controller and contact details

The data controller for the processing described in this privacy notice is KLYNK SRL, with registered office at Via Torquato Taramelli 60, 20124 Milano, partita IVA 14461420961.

To exercise your rights or ask any questions about this privacy notice, you can write to privacy@klynk.it.

KLYNK SRL has not appointed a Data Protection Officer (DPO), as the legal requirements for doing so do not apply.

Who this privacy notice applies to

This privacy notice concerns the data of people who register for KLYNK Page and use the service to create and publish their own page.

It does not concern data that a person provides by completing the contact form on a page published by a KLYNK Page user. For that processing, the data controller is the professional who owns the page, and the applicable privacy notice is the one indicated on that page.

Purposes of processing

Data is processed to provide the service: to create and manage the account, enable the user to compose and publish the page, deliver contact requests received through the page, and respond to support requests.

When the user connects one of their social media profiles, the connection data is processed to read the profile’s public content and display it on the page.

If the user has requested it by selecting the relevant checkbox, their email address is also used to send communications about KLYNK Page and other KLYNK products: news, usage tips, and offers. This purpose is optional: users who do not choose it will still receive service communications, meaning those necessary to use the product — security, billing, and changes to this privacy notice.

Data is not used for profiling, disclosed to third parties for marketing purposes, or sold. Contact requests collected through published pages are never used by KLYNK for its own commercial purposes: they belong to the user who received them.

Roles: when KLYNK is the controller and when it is the processor

For the user’s account data — email address, credentials, page content, and social media connections — KLYNK SRL is the data controller because it determines the purposes and means of processing.

For the data of people who complete the contact form on a published page, KLYNK SRL acts as a data processor pursuant to Article 28 GDPR, on behalf of the user who published the page. The user decides to collect that data and use it to contact the data subjects; KLYNK only stores the data and delivers it to the user.

The relationship between KLYNK and the user for this processing is governed by a data processing agreement (DPA), which the user accepts together with the terms of service.

Legal basis

The processing of account data is based on the performance of a contract to which the data subject is party (Article 6(1)(b) GDPR): without that data, the service cannot be provided.

Processing necessary to comply with legal obligations, for example in tax and accounting matters, is based on Article 6(1)(c) GDPR.

Commercial communications are sent exclusively on the basis of the data subject’s consent (Article 6(1)(a) GDPR), collected through a separate, unticked checkbox in the account settings: nothing is requested during registration and no commercial communication is sent until the data subject enables it. Consent is optional and can be withdrawn at any time by using the link at the bottom of each communication or by writing to privacy@klynk.it. Withdrawal does not affect the lawfulness of processing carried out before it and has no effect on the service.

Categories of data collected

Registration and account data: email address and login credentials, managed through the authentication provider, and the preferred interface language.

Page content: everything the user enters in the editor, including personal information they choose to make public on their page. A published page can be found by search engines, which may show its content in their results; the user can exclude it at any time from the page settings, and it then remains reachable only through its address.

Images uploaded by the user: photographs and images uploaded for the page are stored in the service's media archive, in a folder reserved to the user's account. The archive is public by technical necessity, because images must be visible to anyone opening the page without signing in: whoever knows a file's exact address can therefore view it, even before the page is published. If an image portrays a person, it is the user who decides to publish it and the user who must be entitled to do so.

Social media connections: if the user connects a profile, KLYNK stores the username, the account identifier on the platform, and the access token needed to read public content, together with the content read and the number of followers.

Link previews: when the user pastes a website address into the editor, it is KLYNK's server — not the device of whoever will visit the page — that reads that page to extract its title and logo. The logo is downloaded, converted and stored in the service's media archive together with the other images of the page. As a result, visitors to the published page do not contact the third-party site to see its logo, and that site receives no data about the visitor.

Page usage data: navigation and interaction events such as opening the page, clicking a button, starting a form and submitting it. These events do not contain the IP address or device identifiers and are not linked to an identified person. After a form creates a contact request, the operational lead_created and notification_triggered events include the request's internal lead identifier so that KLYNK can verify that the request was stored and its notification was processed.

Evidence of consent to commercial communications, if given: the choice expressed, the date and time, and the version of the text accepted.

Retention and deletion

Account data is retained for the duration of the relationship and deleted within 30 days after the account is closed, except where it must be retained for longer to comply with legal obligations, particularly tax and accounting obligations.

Contact requests received through published pages are retained for 24 months from collection, unless otherwise instructed by the user who is the controller for that processing.

Page usage data is retained for 12 months.

Social media profile connection tokens are deleted when the user disconnects the profile or closes the account.

Evidence of consent to commercial communications is stored in the account record. When the account is closed, the account record and the evidence of consent stored with it are deleted.

Data subject rights

The data subject may at any time request access to their data, its rectification or erasure, restriction of processing, and data portability, and may object to processing in the cases provided for by law. They may also withdraw consent to commercial communications at any time, without giving a reason and without any consequences for the service.

Requests should be sent to privacy@klynk.it and will receive a response within one month of receipt, a period that may be extended in the cases provided for by Article 12 GDPR.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority.

Anyone who has completed a form on a page published by a KLYNK Page user may submit their request to the professional who is the controller for that page, or write to privacy@klynk.it: in the latter case, KLYNK will forward the request to the controller and assist them in responding to it.

Cookies and tracking

KLYNK Page uses only technical cookies necessary for the operation of the service, particularly to maintain the session of users who have logged in. Consent is not required for these cookies.

The service does not use profiling cookies and does not integrate third-party analytics or tracking tools.

Page usage is measured through events recorded by KLYNK’s systems. Navigation and interaction events do not collect the IP address or browser string and are not linked to an identified person. Operational events recorded after a contact request is created may contain its internal lead identifier; this link is used to verify storage and notification delivery, not to identify or profile general page visitors.

Security

Communications with the service take place over an encrypted channel (HTTPS). Access to data is allowed only to authorised application systems: the browser never accesses the database directly.

The database applies row-level isolation rules so that one user’s data cannot be accessed by another user. System credentials are stored in a secrets manager and not in configuration files.

Development and test environments use databases separate from the production database.

No security measure can guarantee absolute protection; KLYNK adopts measures appropriate to the risk and reviews them over time.

Recipients and providers

Data is processed by providers acting as data processors on behalf of KLYNK: the database and authentication provider, the server providers hosting the service, and the provider of the notification email delivery service.

Contact requests are delivered to the user who owns the page by email: the content of the request therefore passes through the email delivery service provider and is delivered to the user’s inbox.

When the user requests a link preview, KLYNK's server sends a request to the indicated website: that site receives the IP address of KLYNK's server, not the user's.

Data is not disclosed to other parties unless necessary to comply with a legal obligation or a request from an authority.

An up-to-date list of providers that process data on behalf of KLYNK can be requested by writing to privacy@klynk.it.

Place of processing and transfers outside the European Union

The database and the servers hosting the service are located in Germany, within the European Union.

The service used to send notification emails is provided by a company based in the United States, which processes data mainly in that country. The transfer is based on the standard contractual clauses adopted by the European Commission, and the provider participates in the EU-U.S. Data Privacy Framework.

Apart from what is described above, no transfers of personal data to third countries are carried out.

Minors

The service is intended for professionals and businesses and is not intended for anyone under eighteen. KLYNK does not knowingly collect data from minors: if a parent or guardian believes that this has occurred, they can write to privacy@klynk.it and the data will be deleted.

Changes to this privacy notice

This privacy notice may be updated to reflect changes to the service or the regulatory framework. The date of the latest revision is shown at the bottom of the page.

Material changes are communicated to registered users by email before they take effect.