How we process and protect personal data

1. Controller

Mitilsiciliano – sole proprietorship of Mike Giardina, Frankfurter Straße 96, 63303 Dreieich, Germany. Privacy contact: kontakt@mitilsiciliano.com.

2. Data and sources

We may process the contact person’s identity and contact details, company and tax information, product, certification, capacity, market and commercial information, requested appointment details, messages, uploaded documents and metadata, and technical security logs.

For each request, the Keliweb server may record the full IP address, date and time, requested URL or resource, referrer if supplied by the browser, user-agent, browser and operating system, response status, transferred data volume and a country inferred from the IP address. Keliweb/cPanel also processes these logs with AWStats and may display individual entries in the protected administrative area. AWStats sets no cookies, uses no localStorage and places no persistent identifier on the visitor’s device.

For the pseudonymised essential technical counter, we process page path, language, broad device category, traffic source, estimated country where available and a daily non-persistent hash; the statistics archive does not store the full IP address or full user-agent. Separately, after consent, we process pseudonymised pages, categories, producers, products, catalogue searches and the search terms entered, key actions and short navigation sequences to understand commercial interests; for analytics, we do not record form contents or free-text form fields, email addresses or phone numbers.

Data comes from the individual, the company contact person or documents that person is authorised to submit. Do not upload identity documents, credentials, health or criminal data, or unnecessary personal data relating to third parties. Redact signatures and private details that are not needed for the assessment.

3. Purposes and legal bases

We use the data to assess the request, prepare and organise a video call, reply to enquiries and take requested pre-contractual steps (Article 6(1)(b) GDPR). B2B relationship management may also rely on our legitimate interest in handling professional enquiries (Article 6(1)(f)); legal and accounting duties rely on Article 6(1)(c).

Acknowledging this notice is not consent to all processing. Separate consent is requested for aggregated interest analytics and saving a draft in the browser (Article 6(1)(a) GDPR). Refusal does not prevent normal use of the website, submission of a file or a meeting request.

Technical server logs, the pseudonymised essential technical counter and their server-side analysis with AWStats or internal tools are processed independently of this optional choice on the basis of our legitimate interests in securely delivering the website, preventing abuse and attacks, diagnosing errors, planning capacity and understanding overall page use (Article 6(1)(f) GDPR). They are not used for advertising, profiling, automated decisions or linking data from other websites. You may object for reasons relating to your particular situation under Article 21 GDPR; essential security logs may continue where compelling legitimate grounds apply.

4. Required information and documents

Fields marked * are required to handle the request and arrange the meeting. Other fields and uploads are optional. Anyone submitting documents must be authorised to do so and must limit third-party data to what is genuinely necessary.

5. Recipients, storage and email notifications

Data is accessible to Mitilsiciliano and the technical providers required to operate the service, including Keliweb for website hosting, email, access logs, cPanel/AWStats and infrastructure. Where Keliweb processes data on our behalf, it acts as processor under the data processing agreement linked to the service. Server logs are not provided to any other advertising or analytics supplier. Relevant information may be presented to selected buyers, retailers, importers, distributors or partners only within an agreed commercial process.

Uploaded files remain in private storage. The Keliweb notification channel sends the request summary and temporary document links to a technical mailbox reserved exclusively for forms, rather than attaching document copies to the email. The links expire after 14 days; the underlying request follows the retention period below.

Transfers outside the EEA, if any, use an applicable GDPR Chapter V mechanism such as an adequacy decision or standard contractual clauses.

6. Calendar, email and video calls

A time selected in the form is a request and becomes final only after Mitilsiciliano confirms it. If an official Google Calendar/Meet or Microsoft Bookings/Teams page is used, that provider processes the necessary invitation details under its own privacy notice. The website does not automatically load an external calendar or script.

7. Retention

Portal requests and uploads receive a 180-day expiry and are removed during the next cleanup operation, unless a negotiation, contract or legal duty requires a different period. An optional local producer draft remains in the browser for no more than 7 days after the last save. For statistics, individual events and short pseudonymised navigation sequences are retained for no more than 31 days. The “live” panel view does not change that period or mean deletion within ten minutes; no separate 180-day archive of aggregate daily counts is maintained. Privacy preferences are requested again within 180 days or when this notice changes.

Raw logs and AWStats reports follow the Keliweb/cPanel technical processing cycle and are retained only as long as needed for security, incident handling and monthly statistics. Mitilsiciliano does not create additional raw-log archives; data available in the panel is reviewed and deleted or aggregated when no longer needed. Technical backups may follow the provider’s recovery cycle; the Keliweb DPA provides for recovery retention of up to 120 days after hosting ends. You may request the current technical setting or ask for deletion/objection using the privacy contact.

8. Security

We use proportionate technical and organisational measures including encrypted transmission, file type and size controls, restricted storage and temporary access links. No online system can be guaranteed risk-free, so submit only what is needed.

9. Device storage and cookies

We do not use advertising or profiling. Only after consent, the website activates aggregate interest analytics and/or local producer draft storage. The analytics system uses no statistics cookies and stores neither the full IP address nor the full user-agent. Server logs and AWStats operate independently because they do not write or read information on the device; they may contain the full IP address and remain subject to the GDPR. Details are set out in the cookie notice.

10. Guided form and generated drafts

The portal guide uses predefined browser content and does not send questions to an external AI service. It is not legal, tax or business advice and does not make decisions with legal effect. Any generated document is an unsigned draft that must be checked and signed by the authorised parties.

11. Rights and complaints

Subject to the GDPR, you may request access, rectification, erasure, restriction, objection — particularly to processing based on legitimate interests — and portability by writing to kontakt@mitilsiciliano.com. Requests are normally free; Article 12(5) GDPR remains applicable to manifestly unfounded or excessive requests.

You may complain to the Hessian Commissioner for Data Protection and Freedom of Information, Wilhelmstraße 7, 65185 Wiesbaden, or another competent supervisory authority.

Mike AI: two separate features

“Mike AI” is an AI-generated digital version of Mike Giardina, not a live call with the real person. It follows his commercial method using verified information supplied by Mitilsiciliano. A separate booking option remains available for speaking with Mike in person.

Homepage — immediate consultation. This optional feature starts only after the visitor provides a company name and email address and gives explicit consent. The microphone activates only through a user action, starts closed and closes automatically when speaking ends, when Mike AI starts replying, after the safety limit, or when the window closes. The webcam remains disabled.

Voluntary activation of the voice/AI component relies on consent (Article 6(1)(a) GDPR); handling the enquiry and any commercial follow-up use the legal bases set out in section 3, as applicable. Consent may be withdrawn for the future by closing the session and contacting the privacy address; withdrawal does not affect the lawfulness of prior processing.

At the end of the homepage consultation, the available transcript is retrieved and sent through the OpenAI API to produce a structured summary. The call sets store: false, so OpenAI does not retain the response as API application state; Mitilsiciliano does retain the summary as described below. The summary and available transcript are emailed to the address supplied. An internal copy, hidden from the visitor, is sent to Mike and a technical archiving mailbox; a separate authorised automation may store it in the operational Google Drive for commercial follow-up. The privacy notices of OpenAI and Google also apply.

Catalogues — Mike avatar/chat. In the Italian, German and English catalogues, the avatar starts without this intake form: a company name and email address are not required to open a session. This chat does not automatically produce a summary, send email or create an email or Google Drive archive.

For the OpenAI Realtime voice feature, OpenAI processes audio, transcript and connection metadata required to provide the real-time conversation. Mike’s image is a static file hosted by the website and is not sent to an external video-avatar service. The website limits a voice consultation to no more than 15 minutes. Do not disclose sensitive or unnecessary personal data. See the OpenAI privacy policy.

The ordinary 180-day period applies only to the technical record and JSON/Markdown summary copy stored in the private server area for the homepage consultation, unless a negotiation, contract or legal duty requires different retention. Copies in email mailboxes, any Google Docs and data that may be retained by technical providers follow separate retention rules based on business need and the settings of the respective services; automatic deletion on day 180 is not guaranteed. Erasure may be requested through the privacy contact, subject to applicable rights and legal obligations.

Conversation content is not added to aggregate website analytics. Replies are informational and do not constitute an offer, price, availability, certification or commercial approval.