Legal documents
Privacy policy — roundabout.pro website
This policy concerns the roundabout.pro website only. Use of the Roundabout platform is covered by the platform’s own privacy policy.
1. Who processes your data
The data controller is Roundabout S.r.l., Corso Castelfidardo 30/a, 10129 Turin, Italy — VAT no. 12027720015.
For any matter concerning your data, including exercising the rights described in section 8, write to [email protected].
2. The “Notify me” form
On the home page, in the box for agencies, you can leave your email address to be notified when the self-service opens. No data is sent by simply visiting the page: it is sent only if you fill in the field and submit it.
| Data collected | your email address |
| Technical data sent with it | the URL and title of the page you submitted the form from, and an internal label that tells us which list the request belongs to |
| Where it goes | HubSpot, our contact-management system (section 6) |
| When | only at the moment you submit |
The two purposes, and why they are separate
a) Notice that the self-service is open. Legal basis: your consent, Art. 6(1)(a) GDPR, which you give by submitting the form. This is the reason the form exists: we write to you when the service opens, and that message brings the purpose to an end.
b) Roundabout newsletter. Legal basis: a separate, optional consent that you give by ticking the dedicated box. It is not ticked by default and does not condition purpose (a): you can receive the launch notice without subscribing to the newsletter. You can withdraw it at any time via the unsubscribe link at the foot of every email, without affecting the lawfulness of anything sent before.
We do not use your address for purposes other than these two, and we do not share it with third parties.
3. Server logs
The website is hosted on Cloudflare Pages. Like any web server, the infrastructure automatically records certain data with each request: IP address, browser and operating-system type, page requested, date and time.
This data is used to deliver the website and to protect it from abuse, attacks and automated traffic. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR, in keeping the site reachable and secure. We do not use it to profile you, we do not cross-reference it with other data, and we do not build browsing statistics from it.
These technical logs are generated and kept by Cloudflare, as data processor, in accordance with its own retention policy. On the plan currently in use, Roundabout does not itself retain, nor have access to, the raw logs of individual requests.
4. Booking a call, and links to other sites
The “Talk to a specialist” button
That button takes you off roundabout.pro, to cal.com, the service we use to manage appointments. Our website collects nothing in this step.
If you book, the data you enter in the cal.com form — name, email address, chosen time, and anything you write in the notes — reaches us through that service, which processes it on our behalf. Cal.com also records technical data of its own, including the IP address. Before booking, you can read cal.com’s privacy policy at cal.com/privacy.
We use the booking data to hold the call and to follow up commercially at your request. Legal basis: the performance of pre-contractual measures taken at your request, Art. 6(1)(b) GDPR.
Links to other sites
From the page you will find links to Trustpilot, Instagram, TikTok, LinkedIn, Facebook and the Roundabout platform. They are links, nothing more: no content from those sites is embedded in our pages, no script from those platforms is loaded, and no third-party pixel or cookie is activated. Until you click, those companies do not know you are here. When you click, their policy applies and this one no longer does.
5. Cookies
The site uses three first-party technical cookies and, only if you consent, the Google Analytics 4 measurement cookies. On your first visit a banner asks you to choose: until you choose, no measurement cookie is set and no Google script is loaded. There are no advertising or profiling cookies.
| Cookie | When it is set | What it does | Duration |
|---|---|---|---|
ro_handoff_intent |
only if, in the agencies box, you choose “Quote” and submit a brief | carry the text you wrote through to registration on the platform, so you find it already filled in and don’t have to retype it | 30 minutes, then it deletes itself (or as soon as the platform has read it) |
ro_cookie_consent |
when you choose, in the banner, whether to accept or refuse measurement | remember your choice, so you are not asked again on every page; it is also readable by the platform at app.roundabout.pro, so the choice applies to both | 6 months |
ro_lang |
when you land on the home page with a non-Italian browser, or when you switch language from the bar | remember the language you are reading, so you are not sent back to the version you did not choose | 6 months |
_ga, _ga_<ID> |
only after you have accepted measurement | tell a new visitor from a returning one and keep the state of the measurement session | 24 months |
The three ro_ cookies are strictly necessary to do what you asked —
continue your quote on the platform, remember your cookie choice, remember the
language — and for that reason the law (Art. 122 of the Italian Privacy Code)
does not require prior consent. None of the three follows you across sites, none
measures visits, none builds a profile: ro_handoff_intent contains only the
destination and the text you typed, and if you choose “Profile analysis” or
submit nothing it is not set at all.
The _ga cookies belong to Google Analytics 4 and tell us how the site is used:
which pages are read, which buttons are pressed. Only your consent sets them:
refusing is as easy as accepting, and you can change your mind at any time from
the “Cookie preferences” link at the foot of every page. The detail of the
cookies, of the transfer of data to the United States and of retention on the
property is in the cookie policy.
Concretely, even with measurement active, the site does not:
- load advertising pixels or remarketing lists
- link the measurement data to Google’s advertising purposes
- load fonts or images from third-party domains — everything, including the typefaces, is served from our own servers; the only third-party script is Google Analytics, and it starts only after your consent
- profile you or take automated decisions about you
6. Who else sees your data
Within Roundabout, only the people who handle them as part of their work access the contacts collected by the site: the sales team and the staff who administer the systems, each with their own credentials.
Externally, your data is processed on our behalf by three suppliers, appointed as data processors under Art. 28 GDPR. All three are US companies: the transfer takes place on the basis set out in the table.
| Supplier | What it processes | Basis for transfer to the US |
|---|---|---|
| HubSpot, Inc. | the email address from the “Notify me” form and contact management | EU–U.S. Data Privacy Framework; standard contractual clauses as a fallback |
| Cloudflare, Inc. | website hosting and server logs | standard contractual clauses included in the DPA, plus EU–U.S. Data Privacy Framework certification |
| Cal.com, Inc. | the data you enter when booking a call | standard contractual clauses; data is processed in the United States |
A data processing agreement under Art. 28 GDPR is signed with each of the three suppliers.
We do not sell your data and we do not disclose it to third parties for their own purposes. We may disclose it to the judicial authority or to the competent authorities where the law requires it.
7. How long we keep your data
| Data | How long it is kept |
|---|---|
| Email from the “Notify me” form, for the launch notice | until the notice is sent, and in any case no longer than 24 months from collection if the self-service does not open within that period |
| Email subscribed to the newsletter | until consent is withdrawn, and in any case no longer than 24 months from the last interaction |
| Record of the consent given | 5 years from withdrawal or erasure, as evidence of compliance |
| Booking data | 24 months from the call, unless a contractual relationship arises: in that case the terms of the contract apply |
| Google Analytics 4 measurement data | 14 months from collection, the setting chosen on the property: after that period Google deletes the event-level data and only the totals remain in the reports |
| Technical logs on Cloudflare’s infrastructure | per Cloudflare’s retention policy (as processor); Roundabout does not retain them independently on the current plan |
At the end of the period the data is erased. If you unsubscribe from the newsletter, we keep your address on a suppression list for the sole purpose of not writing to you again: if in future you wish to subscribe again, you may do so.
8. Your rights
You can ask us at any time to:
- confirm whether we process data concerning you and obtain a copy of it (Art. 15)
- rectify inaccurate data or complete incomplete data (Art. 16)
- erase your data (Art. 17)
- restrict processing while we verify a dispute you have raised (Art. 18)
- receive the data you provided in a machine-readable format, or have it transferred to another controller (Art. 20)
- object to processing based on our legitimate interest, such as the logs in section 3 (Art. 21)
Where processing is based on consent, you may withdraw it at any time, without this making anything done beforehand unlawful. For the newsletter, the unsubscribe link at the foot of every email is enough.
Write to [email protected]. We reply within one month; if the request is complex we may take up to two further months, in which case we will let you know.
If you believe that the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — garanteprivacy.it — or with the supervisory authority of the EU State where you reside. You may in any case apply to the courts.
9. Changes
If the processing described here changes, we update this page and change its date. Changes affecting purposes based on consent do not apply retroactively: for those we ask you for fresh consent.