Legal documents
Privacy policy — roundabout.pro website
This policy concerns the roundabout.pro website only. Use of the Roundabout platform is covered by the platform’s own privacy policy.
1. Who processes your data
The data controller is Roundabout S.r.l., Corso Castelfidardo 30/a, 10129 Turin, Italy — VAT no. 12027720015.
For any matter concerning your data, including exercising the rights described in section 8, write to [email protected].
2. The “Notify me” form
On the home page, in the box for agencies, you can leave your email address to be notified when the self-service opens. No data is sent by simply visiting the page: it is sent only if you fill in the field and submit it.
| Data collected | your email address |
| Technical data sent with it | the URL and title of the page you submitted the form from, and an internal label that tells us which list the request belongs to |
| Where it goes | HubSpot, our contact-management system (section 6) |
| When | only at the moment you submit |
The two purposes, and why they are separate
a) Notice that the self-service is open. Legal basis: your consent, Art. 6(1)(a) GDPR, which you give by submitting the form. This is the reason the form exists: we write to you when the service opens, and that message brings the purpose to an end.
b) Roundabout newsletter. Legal basis: a separate, optional consent that you give by ticking the dedicated box. It is not ticked by default and does not condition purpose (a): you can receive the launch notice without subscribing to the newsletter. You can withdraw it at any time via the unsubscribe link at the foot of every email, without affecting the lawfulness of anything sent before.
We do not use your address for purposes other than these two, and we do not share it with third parties.
3. Server logs
The website is hosted on Cloudflare Pages. Like any web server, the infrastructure automatically records certain data with each request: IP address, browser and operating-system type, page requested, date and time.
This data is used to deliver the website and to protect it from abuse, attacks and automated traffic. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR, in keeping the site reachable and secure. We do not use it to profile you, we do not cross-reference it with other data, and we do not build browsing statistics from it.
These technical logs are generated and kept by Cloudflare, as data processor, in accordance with its own retention policy. On the plan currently in use, Roundabout does not itself retain, nor have access to, the raw logs of individual requests.
4. Booking a call, and links to other sites
The “Talk to a specialist” button
That button opens the cal.com calendar, the service we use to manage appointments, in a window over the page. The cal.com script loads only when you press the button, not before. Our site does not receive the data you enter: it only learns that a booking was completed, with no name or email, and counts it like any other button.
If you book, the data you enter in the cal.com form — name, email address, chosen time, and anything you write in the notes — reaches us through that service, which processes it on our behalf. Cal.com also records technical data of its own, including the IP address. Before booking, you can read cal.com’s privacy policy at cal.com/privacy.
We use the booking data to hold the call and to follow up commercially at your request. Legal basis: the performance of pre-contractual measures taken at your request, Art. 6(1)(b) GDPR.
Links to other sites
From the page you will find links to Trustpilot, Instagram, TikTok, LinkedIn, Facebook and the Roundabout platform. They are links, nothing more: no content from those sites is embedded in our pages, no script from those platforms is loaded, and no third-party pixel or cookie is activated. Until you click, those companies do not know you are here. When you click, their policy applies and this one no longer does.
5. Cookies
The site uses four first-party technical cookies and, only if you consent, the Google Analytics 4 and Microsoft Clarity measurement cookies. On your first visit a banner asks you to choose: until you choose, and if you decline, no measurement cookie is set. The Google Analytics script still loads and sends Google cookieless signals without identifiers — that a page was viewed, that a button was pressed — from which Google derives aggregate estimates. These signals contain your IP address, like any request to a server. If you accept, Google Analytics also uses the cookies described below. There are no advertising or profiling cookies.
| Cookie | When it is set | What it does | Duration |
|---|---|---|---|
ro_handoff_intent |
only if, in the field at the top of the home page, you choose “Calculate the quote” and submit a brief | carry the text you wrote through to registration on the platform, so you find it already filled in and don’t have to retype it | 30 minutes, then it deletes itself (or as soon as the platform has read it) |
ro_cookie_consent |
when you choose, in the banner, whether to accept or refuse measurement | remember your choice, so you are not asked again on every page; it is also readable by the platform at app.roundabout.pro, so the choice applies to both | 6 months |
ro_lang |
when you land on the home page with a non-Italian browser, or when you switch language from the bar | remember the language you are reading, so you are not sent back to the version you did not choose | 6 months |
ro_hero |
when you land on the home page, in any of the three languages | remember which of the two versions of the top of the home page we showed you, so you always see the same one while we compare them | 30 days |
_ga, _ga_<ID> |
only after you have accepted measurement | tell a new visitor from a returning one and keep the state of the measurement session | 24 months |
_clck, _clsk |
only after you have accepted measurement | recognise a returning visitor and join the pages of the same visit into a single recording | 12 months (_clck), 1 day (_clsk) |
ro_handoff_intent, ro_cookie_consent, and ro_lang are strictly necessary to do what you asked —
continue your quote on the platform, remember your cookie choice, remember the
language — and for that reason the law (Art. 122 of the Italian Privacy Code)
does not require prior consent. None of the three follows you across sites, none
measures visits, none builds a profile: ro_handoff_intent contains only the
destination and the text you typed, and if you choose “Advanced analysis” or
submit nothing it is not set at all.
ro_hero contains only the name of a version, “classica” or “schede”: no identifier,
nothing that recognizes you or follows you across sites. It shows you the same home page
every time while we compare two of them; we measure that comparison only with the
measurement cookies, that is, only if you consent.
The _ga cookies belong to Google Analytics 4 and tell us how the site is used:
which pages are read, which buttons are pressed. Only your consent sets them:
refusing is as easy as accepting, and you can change your mind at any time from
the “Cookie preferences” link at the foot of every page. The detail of the
cookies, of the transfer of data to the United States and of retention on the
property is in the cookie policy.
With the same consent, Microsoft Clarity records how people move through the pages — scrolling, clicks, pointer movements — and turns it into heatmaps: it helps us see where a page confuses or loses people. What you type into form fields is not recorded.
Regardless of the banner, we count visits and clicks with PostHog in cookieless mode: it stores nothing in your browser, neither cookies nor any other data, and assigns you no identifier. To tell apart visits on the same day, PostHog’s servers compute a non-reversible code from your IP address, browser and the site, with a key that changes every day: the next day the same person is a new visitor, and the two visits cannot be linked. We only receive totals: pages viewed, buttons pressed, the version of the home page you saw. The IP address is not stored. Legal basis: our legitimate interest in knowing how the site is used, Art. 6(1)(f) GDPR, with minimal processing and no access to your device.
Concretely, even with measurement active, the site does not:
- load advertising pixels or remarketing lists
- link the measurement data to Google’s or Microsoft’s advertising purposes
- load fonts or images from third-party domains — everything, including the typefaces, is served from our own servers; the only third-party scripts are PostHog, which uses no cookies, Google Analytics, which sets cookies only after your consent, and Microsoft Clarity, which starts only after your consent
- profile you or take automated decisions about you
6. Who else sees your data
Within Roundabout, only the people who handle them as part of their work access the contacts collected by the site: the sales team and the staff who administer the systems, each with their own credentials.
Externally, your data is processed on our behalf by four suppliers, appointed as data processors under Art. 28 GDPR. All four are US companies: the transfer takes place on the basis set out in the table.
| Supplier | What it processes | Basis for transfer to the US |
|---|---|---|
| HubSpot, Inc. | the email address from the “Notify me” form and contact management | EU–U.S. Data Privacy Framework; standard contractual clauses as a fallback |
| Cloudflare, Inc. | website hosting and server logs | standard contractual clauses included in the DPA, plus EU–U.S. Data Privacy Framework certification |
| Cal.com, Inc. | the data you enter when booking a call | standard contractual clauses; data is processed in the United States |
| PostHog Inc. | cookieless counting of visits and clicks (data hosted in the European Union, in Frankfurt) | the data stays in the European Union; for access from outside it, the mechanisms in its DPA: EU–U.S. Data Privacy Framework or standard contractual clauses |
A data processing agreement under Art. 28 GDPR is signed with HubSpot, Cloudflare and Cal.com; PostHog processes the data under its own data processing agreement (DPA).
We do not sell your data and we do not disclose it to third parties for their own purposes. We may disclose it to the judicial authority or to the competent authorities where the law requires it.
7. How long we keep your data
| Data | How long it is kept |
|---|---|
| Email from the “Notify me” form, for the launch notice | until the notice is sent, and in any case no longer than 24 months from collection if the self-service does not open within that period |
| Email subscribed to the newsletter | until consent is withdrawn, and in any case no longer than 24 months from the last interaction |
| Record of the consent given | 5 years from withdrawal or erasure, as evidence of compliance |
| Booking data | 24 months from the call, unless a contractual relationship arises: in that case the terms of the contract apply |
| Google Analytics 4 measurement data | 14 months from collection, the setting chosen on the property: after that period Google deletes the event-level data and only the totals remain in the reports |
| Microsoft Clarity recordings and heatmaps | recordings 30 days from collection, except for a small sample and the ones we save, which are kept for up to 13 months; heatmaps 13 months |
| PostHog events, without identifiers | according to the PostHog project plan: 1 year on the free plan, 7 years on paid plans |
| Technical logs on Cloudflare’s infrastructure | per Cloudflare’s retention policy (as processor); Roundabout does not retain them independently on the current plan |
At the end of the period the data is erased. If you unsubscribe from the newsletter, we keep your address on a suppression list for the sole purpose of not writing to you again: if in future you wish to subscribe again, you may do so.
8. Your rights
You can ask us at any time to:
- confirm whether we process data concerning you and obtain a copy of it (Art. 15)
- rectify inaccurate data or complete incomplete data (Art. 16)
- erase your data (Art. 17)
- restrict processing while we verify a dispute you have raised (Art. 18)
- receive the data you provided in a machine-readable format, or have it transferred to another controller (Art. 20)
- object to processing based on our legitimate interest, such as the logs in section 3 (Art. 21)
Where processing is based on consent, you may withdraw it at any time, without this making anything done beforehand unlawful. For the newsletter, the unsubscribe link at the foot of every email is enough.
Write to [email protected]. We reply within one month; if the request is complex we may take up to two further months, in which case we will let you know.
If you believe that the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — garanteprivacy.it — or with the supervisory authority of the EU State where you reside. You may in any case apply to the courts.
9. Changes
If the processing described here changes, we update this page and change its date. Changes affecting purposes based on consent do not apply retroactively: for those we ask you for fresh consent.