Legal documents
Privacy policy — roundabout.pro website
This policy concerns the roundabout.pro website only. Use of the Roundabout platform is covered by the platform’s own privacy policy.
1. Who processes your data
The data controller is Roundabout S.r.l., Corso Castelfidardo 30/a, 10129 Turin, Italy — VAT no. 12027720015.
For any matter concerning your data, including exercising the rights described in section 8, write to [email protected].
2. The “Notify me” form
On the home page, in the box for agencies, you can leave your email address to be notified when the self-service opens. No data is sent by simply visiting the page: it is sent only if you fill in the field and submit it.
| Data collected | your email address |
| Technical data sent with it | the URL and title of the page you submitted the form from, and an internal label that tells us which list the request belongs to |
| Where it goes | HubSpot, our contact-management system (section 6) |
| When | only at the moment you submit |
The two purposes, and why they are separate
a) Notice that the self-service is open. Legal basis: your consent, Art. 6(1)(a) GDPR, which you give by submitting the form. This is the reason the form exists: we write to you when the service opens, and that message brings the purpose to an end.
b) Roundabout newsletter. Legal basis: a separate, optional consent that you give by ticking the dedicated box. It is not ticked by default and does not condition purpose (a): you can receive the launch notice without subscribing to the newsletter. You can withdraw it at any time via the unsubscribe link at the foot of every email, without affecting the lawfulness of anything sent before.
We do not use your address for purposes other than these two, and we do not share it with third parties.
3. Server logs
The website is hosted on Cloudflare Pages. Like any web server, the infrastructure automatically records certain data with each request: IP address, browser and operating-system type, page requested, date and time.
This data is used to deliver the website and to protect it from abuse, attacks and automated traffic. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR, in keeping the site reachable and secure. We do not use it to profile you, we do not cross-reference it with other data, and we do not build browsing statistics from it.
These technical logs are generated and kept by Cloudflare, as data processor, in accordance with its own retention policy. On the plan currently in use, Roundabout does not itself retain, nor have access to, the raw logs of individual requests.
4. Booking a call, and links to other sites
The “Talk to a specialist” button
That button takes you off roundabout.pro, to cal.com, the service we use to manage appointments. Our website collects nothing in this step.
If you book, the data you enter in the cal.com form — name, email address, chosen time, and anything you write in the notes — reaches us through that service, which processes it on our behalf. Cal.com also records technical data of its own, including the IP address. Before booking, you can read cal.com’s privacy policy at cal.com/privacy.
We use the booking data to hold the call and to follow up commercially at your request. Legal basis: the performance of pre-contractual measures taken at your request, Art. 6(1)(b) GDPR.
Links to other sites
From the page you will find links to Trustpilot, Instagram, TikTok, LinkedIn, Facebook and the Roundabout platform. They are links, nothing more: no content from those sites is embedded in our pages, no script from those platforms is loaded, and no third-party pixel or cookie is activated. Until you click, those companies do not know you are here. When you click, their policy applies and this one no longer does.
5. Cookies
The site uses a single cookie, technical and first-party, and only if you activate it yourself. There are no analytics, advertising or profiling cookies, and there is no banner because nothing requires your prior consent.
| Cookie | When it is set | What it does | Duration |
|---|---|---|---|
ro_handoff_intent |
only if, in the agencies box, you choose “Quote” and submit a brief | carry the text you wrote through to registration on the platform, so you find it already filled in and don’t have to retype it | 30 minutes, then it deletes itself (or as soon as the platform has read it) |
This cookie is strictly necessary to complete an action you requested — continuing your quote on the platform — and for that reason the law (Art. 122 of the Italian Privacy Code) does not require prior consent. It contains only the destination and the text you typed; it does not follow you across sites, is not used to measure visits, and builds no profile. If you choose “Profile analysis”, or if you submit nothing, the cookie is not set.
Concretely, today the site does not:
- measure visits with analytics tools
- load advertising pixels or remarketing lists
- load fonts, scripts or images from third-party domains — everything, including the typefaces, is served from our own servers
- profile you or take automated decisions about you
If this changes, you will know first. When we introduce a tool to measure visits, we will publish a cookie policy and a banner that asks for your consent before anything is written to your device, with refusing as easy as accepting and the choice always revocable.
6. Who else sees your data
Within Roundabout, only the people who handle them as part of their work access the contacts collected by the site: the sales team and the staff who administer the systems, each with their own credentials.
Externally, your data is processed on our behalf by three suppliers, appointed as data processors under Art. 28 GDPR. All three are US companies: the transfer takes place on the basis set out in the table.
| Supplier | What it processes | Basis for transfer to the US |
|---|---|---|
| HubSpot, Inc. | the email address from the “Notify me” form and contact management | EU–U.S. Data Privacy Framework; standard contractual clauses as a fallback |
| Cloudflare, Inc. | website hosting and server logs | standard contractual clauses included in the DPA, plus EU–U.S. Data Privacy Framework certification |
| Cal.com, Inc. | the data you enter when booking a call | standard contractual clauses; data is processed in the United States |
A data processing agreement under Art. 28 GDPR is signed with each of the three suppliers.
We do not sell your data and we do not disclose it to third parties for their own purposes. We may disclose it to the judicial authority or to the competent authorities where the law requires it.
7. How long we keep your data
| Data | How long it is kept |
|---|---|
| Email from the “Notify me” form, for the launch notice | until the notice is sent, and in any case no longer than 24 months from collection if the self-service does not open within that period |
| Email subscribed to the newsletter | until consent is withdrawn, and in any case no longer than 24 months from the last interaction |
| Record of the consent given | 5 years from withdrawal or erasure, as evidence of compliance |
| Booking data | 24 months from the call, unless a contractual relationship arises: in that case the terms of the contract apply |
| Technical logs on Cloudflare’s infrastructure | per Cloudflare’s retention policy (as processor); Roundabout does not retain them independently on the current plan |
At the end of the period the data is erased. If you unsubscribe from the newsletter, we keep your address on a suppression list for the sole purpose of not writing to you again: if in future you wish to subscribe again, you may do so.
8. Your rights
You can ask us at any time to:
- confirm whether we process data concerning you and obtain a copy of it (Art. 15)
- rectify inaccurate data or complete incomplete data (Art. 16)
- erase your data (Art. 17)
- restrict processing while we verify a dispute you have raised (Art. 18)
- receive the data you provided in a machine-readable format, or have it transferred to another controller (Art. 20)
- object to processing based on our legitimate interest, such as the logs in section 3 (Art. 21)
Where processing is based on consent, you may withdraw it at any time, without this making anything done beforehand unlawful. For the newsletter, the unsubscribe link at the foot of every email is enough.
Write to [email protected]. We reply within one month; if the request is complex we may take up to two further months, in which case we will let you know.
If you believe that the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — garanteprivacy.it — or with the supervisory authority of the EU State where you reside. You may in any case apply to the courts.
9. Changes
If the processing described here changes, we update this page and change its date. Changes affecting purposes based on consent do not apply retroactively: for those we ask you for fresh consent.