Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”)
Version 2.1 · Effective [DD] September 2026 · Previous versions are available on request
Who we are
HSYCO S.r.l. (“HSYCO”, “we”, “us”) is the controller of the personal data described in this policy. We are a building and industrial automation software company, registered in Italy at Strada 8 – Palazzo N8, 20089 Rozzano (MI). You can reach us about anything in this policy at privacy@hsyco.com.
What this policy covers
This policy explains how we handle personal data when you:
It covers information you give us directly, and information collected automatically when you use our websites — including your IP address and data stored on your device through cookies. Section 3 explains what is collected automatically and who receives it.
What this policy does not cover
Data inside systems built with our software. HSYCO software runs on systems owned and operated by our customers. Where personal data is processed inside a building automation system that a customer or integrator has deployed, that organisation decides how and why the data is used and is the controller of it. We act only on their instructions, as a processor. If your question concerns data held in such a system — for example access records or camera footage from a building you work in or visit — please contact the operator of that building. We cannot access, correct or delete that data on our own initiative.
Other companies’ websites. We link to third-party sites we do not operate. Their privacy practices are their own. See Section 8.
How to read this policy
Each section below covers one topic. Section 7 sets out the rights you have and how to use them. You can save or print this policy at any time.
Where we cite the GDPR we write “Article” in the text and abbreviate to “Art.” inside tables.
1. Why we process personal data, and on what legal basis
We process personal data only where we have a lawful basis for doing so. The table below sets out each purpose, the basis we rely on, and — where relevant — what happens if the data is not provided.
# | Purpose | Legal basis | If not provided |
1.1 | Responding to enquiries, preparing quotations and taking steps before entering a contract | Art. 6(1)(b) — pre-contractual steps | We cannot answer the enquiry or issue a quotation |
1.2 | Supplying and licensing our products, and providing customer care and technical support during the contract | Art. 6(1)(b) — contract | We cannot supply the product or provide support |
1.3 | Invoicing, accounting, and statutory bookkeeping and tax records | Art. 6(1)(c) — legal obligation under Italian and EU law | We cannot complete a transaction; these records are required by law and are kept even after the relationship ends |
1.4 | Administering the business relationship, including business correspondence and account management | Art. 6(1)(f) — our legitimate interest in managing our commercial relationships | Provision is optional; we may not be able to keep you informed about your account |
1.5 | Supporting installed systems after a contract has ended — spare parts, expansions, upgrades and technical assistance for systems still in service | Art. 6(1)(f) — our legitimate interest in supporting our installed base | Without the installation history we may be unable to support or expand the system |
1.6 | Sending product and service information to business contacts at our customers, partners and distributors who have asked to receive it | Art. 6(1)(a) — your consent | Provision is optional; you can withdraw at any time and refusing has no other consequence |
1.7 | Sending our newsletter and promotional communications by email | Art. 6(1)(a) — your consent | Provision is optional; you simply will not receive them, and refusing has no other consequence |
1.8 | Operating our website, keeping it secure, and preventing misuse | Art. 6(1)(f) — our legitimate interest in a functioning, secure website | This data is collected automatically and is necessary to deliver the site |
1.9 | Understanding how our website is used, and measuring the effectiveness of our advertising | Art. 6(1)(a) — your consent, given through our cookie banner, separately for Analytics and for Advertising measurement | Provision is optional; the site works normally without it and you can withdraw at any time |
1.10 | Establishing, exercising or defending legal claims | Art. 6(1)(f) — our legitimate interest in protecting our legal position | Not applicable |
Where we rely on legitimate interest, we have assessed that interest against your rights and freedoms. You can ask us for a summary of that assessment, and you have the right to object — see Section 7.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of anything we did before you withdrew it.
2. Who has access to personal data
Within HSYCO. Access is limited to those who need it for their role — for example our sales, support, finance and engineering teams. They act under our authority and are bound by confidentiality obligations.
Service providers acting on our behalf. We use third parties to provide services that support the purposes in Section 1. They process personal data only on our documented instructions, under a contract meeting the requirements of Article 28 GDPR. They fall into these categories:
Companies in our group. We may share data with our parent, subsidiary and affiliated companies where necessary for the purposes in Section 1.
Professional advisers. Lawyers, insurers and other advisers, where necessary to obtain advice or to establish, exercise or defend legal claims.
Public authorities. Where we are required to disclose data by law, or by a court or regulator with jurisdiction over us. We assess each request and disclose only what is legally required.
In a corporate transaction. If HSYCO is involved in a merger, acquisition or sale of assets, personal data may be disclosed to the other party and its advisers, subject to confidentiality undertakings.
We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
3. Suppliers that receive data through this website
For the website at hsyco.com, these are the suppliers that receive personal data as a result of something you do on the site. Each receives only what is listed, and only when the described event happens. Other suppliers in the categories listed in Section 2 support our business generally but receive nothing through this website.
Supplier | What it receives | What for | When |
SiteGround | Your IP address, your browser’s user agent and the pages you request, as recorded in the server logs | Hosting the website, delivering its pages and keeping it secure | Every time you load a page |
Brevo | What you write in the contact and quotation form, including the address you ask to be answered at | Delivering it to us as an email | Only when you submit that form |
Mailchimp | The address and the name you give on the newsletter form | Running the mailing list and sending what you subscribed to | Only when you submit that form |
Google Analytics | Analytics measurement data about the pages you read on this site | Telling us which pages get read and how people arrive here | Only if you have accepted the Analytics category in our banner |
Google Ads | Whether a visit that began from one of our ads led to an enquiry, and the identifiers stored in the _gcl_au and _gcl_aw cookies | Measuring which of our advertising brings enquiries | Only if you have accepted the Advertising measurement category in our banner |
Google Analytics and Google Ads run only with your consent, and our banner lets you accept or refuse them separately, as Analytics and Advertising measurement. If you refuse, close the banner, or never answer the question, no request is made to Google and no measurement data about you exists. You can change either choice at any time from Cookie preferences, at the bottom of every page. What is stored, and for how long, is set out in our Cookie Policy.
Mailchimp and Google belong to groups established in the United States, so using them involves a transfer outside the European Union, under the safeguards described in Section 4.
Brevo is established in France, but some of its sub-processors are located outside the European Economic Area, including in the United States and India; those transfers are covered by the same safeguards.
No supplier receives your data for its own purposes, and none of them is allowed to sell it or to use it to advertise to you on our behalf.
4. Transfers outside the European Economic Area
Where we transfer personal data outside the European Economic Area, we do so only where an adequacy decision of the European Commission applies to the recipient, or where appropriate safeguards under Article 46 GDPR are in place, in particular the European Commission’s Standard Contractual Clauses. Our advertising and analytics providers are contracted through Google Ireland Limited; data may be transferred onward to Google LLC in the United States. You may request a copy of the safeguards we rely on by writing to privacy@hsyco.com.
5. How long we keep personal data
We keep personal data only as long as we need it for the purposes in Section 1, or as long as the law requires. The table below sets out each category, how long we keep it, when the period starts, and why. Where more than one period applies to the same record, the longest governs.
Some of our records are kept for longer than is usual, and we want to explain why. HSYCO systems are installed in buildings and industrial facilities where they typically remain in service for more than ten years, and often considerably longer. Throughout that time our customers need us to provide technical support, expand installations and supply upgrades — none of which we can do without the licence and configuration history of the specific system. We therefore keep those records for as long as the system is in service. We keep the personal details of individual contacts on a shorter cycle, reviewed separately, because a system outlives the people who look after it.
Category | We keep it | Starting from | Why |
Enquiry and quotation data, where no contract follows | 2 months | Last contact | Our sales cycle allows opportunities to reopen; beyond this the data has no purpose |
Contract, order and delivery records | 10 years | End of the year the contract ended | Ordinary limitation period for contractual claims under Italian law |
Invoicing, accounting, VAT and tax records | 10 years + 6 months | End of the financial year the record relates to | Required by Italian civil and tax law; we cannot delete these on request |
Licence and system records — serial numbers, product codes, licence keys, software versions, configuration and upgrade history, and network identifiers where these identify a person | For as long as the system remains in service, plus 10 years | The system being decommissioned (see note below) | HSYCO systems have an operational life commonly exceeding ten years. Customers require support, expansions and upgrades throughout that life, and we cannot provide them without the installation’s history. The additional ten years covers the limitation period for contractual claims |
Technical support and customer care records — faults reported, diagnosis, resolution and configuration changes | For as long as the associated system remains in service, plus 10 years | The system being decommissioned (see note below) | Recurring and intermittent faults often only become diagnosable against a long service history. Retained against the installation, not the individual |
Contact details of individuals at customer, partner and integrator organisations | Reviewed every 3 years; removed when the person is no longer an active contact, and in any event 5 years after our last contact with them | Last contact with that person | We need current contacts to deliver support, but not former ones. Reviewed independently of the technical records above |
Newsletter subscriber data | Until you withdraw consent, or after 36 months without any interaction | Withdrawal, or last interaction | Consent-based; we do not keep contacts who have stopped engaging |
Records of consent and withdrawal | 5 years | End of the consent | We must be able to demonstrate that consent was given, under Art. 7(1) |
Website server logs | 30 days | Collection | Security, troubleshooting and abuse prevention |
Website analytics data | 14 months in Google Analytics; the _ga cookie itself lasts 24 months | Collection | Year-on-year comparison. Set deliberately, not left at the platform default |
Advertising and conversion data | 90 days (the _gcl_au and _gcl_aw cookies) | Collection | Attributing enquiries to advertising |
Cookie consent record | 12 months, then we ask again | Your choice | Remembering your choice so that we do not ask on every page. It is stored only in your browser; we keep no copy of it |
Data relating to suspected unlawful conduct, or to a legal claim | Until the matter concludes and the limitation period expires | The matter concluding | Establishing, exercising or defending legal claims |
When a system is treated as decommissioned. A system is treated as decommissioned when the customer tells us so, or when there has been no licence activity, support contact or commercial contact relating to it for five years, whichever comes first.
When a period ends we delete the data or anonymise it so it can no longer identify anyone. Data held in backups is removed as those backups are cycled, which may take up to 6 months after deletion from our live systems.
We review this table when our processing changes or the law changes.
6. How we protect personal data
We maintain technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. These include encryption of data in transit, access controls limiting personal data to staff who need it for their role, logging and monitoring of access, and regular review of our security measures. Personal data is held on systems within the European Economic Area except where Section 4 states otherwise.
No system can be guaranteed completely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, as required by Article 34 GDPR.
7. Your rights
You have the following rights over your personal data. To use any of them, write to privacy@hsyco.com. We will respond within one month. If your request is complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month if we do. There is no charge.
Before we act, we may need to confirm your identity — we will only ask for what is necessary to do that.
Access. You can ask what personal data we hold about you, why we process it, who we share it with, and how long we keep it, and ask for a copy. We will send it in a secure form we agree with you.
Rectification. If anything we hold is inaccurate you can ask us to correct it, and if it is incomplete you can ask us to complete it.
Erasure. You can ask us to delete your personal data where it is no longer needed for the purpose we collected it for; where you withdraw consent and we have no other basis; where you object and we have no overriding legitimate ground; where it has been processed unlawfully; or where deletion is required by law.
We may not be able to delete data we still need in order to perform a contract with you, to comply with a legal obligation — in particular the accounting and tax records in Section 5, which we are required to keep — or to establish, exercise or defend a legal claim. Where we cannot delete something, we will tell you which of these reasons applies.
Restriction. You can ask us to pause processing while we check something: while we verify accuracy you have challenged, while we assess an objection you have raised, or where processing is unlawful but you would rather we restricted it than deleted it. You can also ask us to keep data we no longer need if you need it for a legal claim.
Portability. Where we process data you gave us, by automated means, on the basis of your consent or a contract, you can ask for a copy in a structured, commonly used, machine-readable format, or ask us to send it directly to another organisation where that is technically feasible.
Objection. You can object at any time to processing we base on legitimate interest — the purposes numbered 1.4, 1.5, 1.8 and 1.10 in Section 1. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data for legal claims.
Objection to direct marketing. You can object to direct marketing at any time, and we will stop — there is no balancing test and no exception. Use the unsubscribe link in any email, or write to privacy@hsyco.com.
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew it.
Automated decisions. We do not make decisions about you solely by automated means that produce legal effects concerning you or similarly significantly affect you. The right in Article 22 GDPR therefore does not arise. The analytics and advertising measurement described in Section 3 does not produce decisions about individuals. If this ever changes, we will update this policy before it takes effect.
If your request concerns a building system
Where personal data is held inside a building automation system operated by one of our customers, that customer is the controller and we act only on their instructions. We cannot access, correct or delete that data ourselves. If you send us a request of this kind, we will forward it to the operator of the system and tell you that we have done so — but you will usually get a faster answer by contacting them directly.
Complaints
If you think we have handled your personal data incorrectly, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority.
Our lead authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy — www.gpdp.it. You may also complain to the authority in the country where you live or work, or where you believe the problem occurred.
8. Links to other websites and embedded content
Links. Our website links to sites we do not operate. When you follow one, the site you arrive at handles your data under its own privacy policy, not this one. We have no control over those sites and take no responsibility for them. We suggest reading their policies.
Embedded content. We do not embed content from third parties. Our fonts are served from our own server, and our pages load no third-party video players, maps, social media buttons or chat widgets. Videos on our site are our own files; our YouTube channel and our social media pages are reached through ordinary links, which load nothing until you follow them. Apart from Google’s measurement tag described in Section 3, which loads only after you have consented, our pages load no third-party resources at all — no external scripts and no embedded frames.
9. Children
Our website and our products are intended for business use. We do not direct them at children and we do not knowingly collect personal data from anyone under 18 through our website.
If you believe a child has provided us with personal data, please contact privacy@hsyco.com. We will delete it promptly unless we are legally required to keep it, in which case we will restrict it and tell you why.
10. Changes to this policy
We update this policy when our processing changes or the law changes. The version number and effective date appear at the top of this page.
If we make a change that materially affects how we use your personal data, we will tell you before it takes effect — by email where we hold your address for that purpose, or by a notice on our website. Where a change requires your consent, we will ask for it.
Previous versions are available on request from privacy@hsyco.com.
11. Contact us
For any question about this policy, or to exercise any of the rights in Section 7:
Email: privacy@hsyco.com
Post: HSYCO S.r.l. — Privacy, Strada 8 – Palazzo N8, 20089 Rozzano (MI), Italy
We aim to respond to all privacy enquiries within one month.
Full company details are set out in our Impressum.
Be the first to know about the latest news and announcements from HSYCO
![hsyco-header-logo-white-home[1]](https://hsyco.com/wp-content/uploads/elementor/thumbs/hsyco-header-logo-white-home1-qqutvznvmb77r0wm2zce5jab23qj6w03qd7awvc7t0.png "hsyco-header-logo-white-home[1]"){kind=logo}