Privacy Policy

1. Controller and processing roles

DG Technologies di Gentile Davide is the controller for its website, own business enquiries, accounts, contracts and administrative obligations. Its registered office is Via G. Rossini 11, 65015 Montesilvano (PE), Italy; VAT ID 02291600688. Privacy contact: info@dgtechcorp.com. Company details also appear above.

For leads and content handled solely on a customer's instructions, that customer determines the purposes and legal basis and acts as controller. DG Technologies provides technical services on its behalf; this relationship requires arrangements under Article 28 GDPR where applicable. This notice does not replace that agreement or the information the customer must provide to its contacts.

2. Data categories and sources

Enquiries and business relationships: name, email, telephone number, company, role, requested service, budget and information supplied in forms, email or project discussions. Data comes from the individual or an authorised representative of their organisation.

Accounts and projects: identity, organisation, role and permissions, protected credentials, sessions, invitations, email verification, password recovery requests, tasks, comments, issues and user-uploaded attachments, including images, videos and documents.

Subscriptions and affiliations, when used: billing details, offers, due dates, payment status, Stripe transaction identifiers, commissions and transfer status. Identity or account verification information requested directly by Stripe is also processed by Stripe under its own notice.

Technical information: IP address, browser, device, timestamps, system requests and access/security logs. Measurement tools may process pages, referral sources, campaign parameters, interactions and technical identifiers. Section 8 covers non-essential tools.

Lead Generation: data in selected spreadsheets, potentially including names, contact details, lead identifiers, campaigns, forms, dates and answers. It may originate from Meta forms connected to a sheet or other customer-managed sources. The module reads the configured sheet; it does not automatically access the entire Meta account.

Do not include passwords in messages or attachments, or unnecessary health, criminal-record or other particularly sensitive information. Any processing of such data requires separate assessment and appropriate grounds.

3. Purposes and legal bases

Managing quotations, consultations, accounts, services, projects, support and payments: performance of a contract or pre-contractual measures requested by the individual, Article 6(1)(b) GDPR. For representatives of corporate customers, professional communications may rely on the legitimate interest in managing and performing the engagement, Article 6(1)(f), taking their rights into account.

Tax, accounting and legally binding requirements: Article 6(1)(c). System and account protection, abuse prevention and handling disputes: legitimate interests in security and protecting rights, Article 6(1)(f), using proportionate measures.

Integrations are activated at an authorised user's request to provide the agreed service. Technical OAuth authorisation is not general marketing consent and does not replace the legal basis the lead controller must establish for collection and sharing.

Service emails, including invitations, verification, account recovery and operational notifications, are distinct from advertising. No newsletter service is provided. Promotional communications and non-essential tracking require consent where prescribed, Article 6(1)(a), subject to specific statutory exceptions: making an enquiry does not authorise indiscriminate campaigns.

4. Google data access

DG Tech Lead Generation connects Google through OAuth without asking for the account password. It receives the verified email address and Google identifier through openid and email permissions and stores a protected refresh token to maintain authorised access.

The drive.file permission covers files made accessible to the app by the user, for example through Google Picker, not the entire Drive. Although that permission allows broader operations on authorised files, the implemented Lead Generation workflow reads selected spreadsheet metadata and values and does not modify or delete Google files.

To check headers, mappings and new leads, the system reads the configured sheet range. Read access can include columns not selected for notification; only configured fields are composed for delivery. Dedicated sheets containing only relevant information are therefore recommended. Service-account configurations, when used, access sheets shared with that account.

Optional SEO integrations with Google Analytics 4 and Search Console are separate. They use read permissions to obtain reports for authorised properties, such as traffic, events, queries, pages, impressions and clicks. They are not required to connect a spreadsheet to Telegram.

For information obtained from Google, we adopt the obligations of the Google API Services User Data Policy, including applicable Limited Use requirements. Within Lead Generation, such data supports the requested synchronisation, deduplication and notifications: it is not sold, used for personalised advertising or sent to AI models for training. Human access to Google data must be confined to cases permitted by the policy, such as authorised support, security and legal obligations.

5. Telegram delivery and recipients

Once a source is activated, configured fields are forwarded through the configured bot to the Telegram chat or group selected by the administrator. Long notifications may be delivered as a text document. Chat and message identifiers, destination names, delivery status and technical bot information are also processed.

Content is shared with Telegram and made visible to chat recipients or group members under Telegram's settings. A bot conversation is not an end-to-end encrypted secret chat. The person configuring the service must verify recipients, legal grounds and information provided to leads, and minimise the fields transmitted.

Disconnecting Google, pausing a source or removing a configuration does not recall delivered messages or delete data from the original spreadsheet. Deletion within those services requires their respective procedures and cooperation from the relevant controllers.

6. Payments and other providers

Stripe handles payments and, where enabled, affiliate onboarding and transfers. Checkout sends payment-method details directly to Stripe; the application uses transaction identifiers and statuses and does not store full card numbers or security codes. Stripe may act as processor or independent controller depending on the activity.

The website infrastructure is hosted on an OVHcloud VPS. Operational communications use the configured email/SMTP service; Roundcube is the webmail interface and does not itself identify the email transport provider.

Where necessary, authorised personnel, technical collaborators, infrastructure and communications providers, administrative advisers and legally entitled authorities may access data. Privacy roles depend on the service; processors require appropriate agreements. Contact us for providers relevant to a particular processing activity.

7. Retention and deletion

Business enquiries and project information are retained in relation to enquiry handling, negotiations and delivery. Continued retention after closure must be assessed against legal obligations, disputes and protecting rights; there is no single period applicable to every document.

Contractual, tax, accounting and transaction information is retained for applicable statutory periods. Account closure does not erase documents that must be retained for those reasons. Logs and security events support technical investigations and abuse prevention; deletion requests are assessed against these needs too.

Within Lead Generation, queued notification text is encrypted. After confirmed delivery, it is removed from the operational delivery record. If still queued or in error, the synchronisation process removes the content when it detects that more than 30 days have elapsed since creation. This is not instantaneous deletion at a fixed time and depends on the process running.

Pseudonymised lead identifiers used to prevent duplicates, source/destination references, dates, outcomes and message identifiers remain in delivery history; the module currently has no automatic expiry for them. They are not necessarily anonymous. Continued need and deletion are assessed on request or service termination, considering the controller's instructions and applicable obligations.

The Google refresh token and connection email are removed from the active configuration when Disconnect Google is used. Bot tokens remain in the Telegram configuration while it is retained. Revoking access only through Google may invalidate a token without erasing the local copy; users can also disconnect in the backoffice or request removal.

Backups, logs and provider systems have separate retention cycles. Operational database deletion does not imply simultaneous removal from every copy. Deletion requests also require assessment of those archives and safeguards against reusing deleted data after restoration.

8. Cookies, measurement and preferences

Cookie preferences in the footer allows you to accept, reject or change optional categories. Your choice is saved in this browser for 180 days; withdrawing an active category reloads the page to stop scripts already loaded. Internal statistics, commercial tools and external widgets are separate. The GTM container, which includes analytics and commercial tags, loads only if both categories are allowed.

Sortlist Radar can also associate visits with organisations using network information to identify companies interested in services. This has a commercial purpose distinct from technical website operation and requires appropriate legal grounds and tracking consent where prescribed.

The website uses technical tools for sessions, security, language and interface preferences. It includes visit/conversion measurement, campaign attribution, Google Analytics and Google Tag Manager, which can load tags according to its container configuration. Sortlist Radar processes visit information and device identifiers for traffic analysis; Clutch review widgets send requests to that provider. Cloudflare services are also present for security and technical measurement. These providers receive at least the technical information needed for requests, according to their respective functions.

Non-essential cookies, persistent identifiers and measurement or marketing technologies must be managed with prior consent where required by law. This notice does not constitute consent or replace a choice mechanism. Browser preferences and the Cookie Policy provide further information; disabling non-essential technologies must not prevent service enquiries.

9. International transfers

Using Google, Telegram, Stripe or other international providers may involve processing or access outside the European Economic Area. Having a VPS does not imply that all information and providers remain exclusively in Europe.

Where applicable, transfers must rely on adequacy decisions valid for the recipient and processing, standard contractual clauses or other GDPR-permitted mechanisms, with necessary assessments and supplementary safeguards. We do not assume that one mechanism indiscriminately covers every service.

For information on recipients, countries and safeguards relevant to your service, or to request a copy of available safeguards, contact info@dgtechcorp.com. The provider notices linked below also describe their independent operations.

10. Security and access

HTTPS connections, role-based access controls and measures protecting credentials and sessions are used. Google and Telegram secrets within Lead Generation and queued notification content are encrypted by the application. This does not mean that every database field or delivered message is encrypted in the same way.

Users should protect their credentials, grant access only to authorised recipients and report suspected incidents or unauthorised access. No system can guarantee the complete absence of risk.

11. Providing data and revoking integrations

Information needed to answer an enquiry, create an account, deliver a service or meet legal obligations is requested for those purposes; without it we may be unable to perform the operation. Optional data and consent for additional purposes are not conditions for services that do not require them.

Connecting Google is optional but necessary for the associated synchronisation. Users can pause sources, select Disconnect Google in the backoffice or revoke authorisation in their Google account connections. These actions stop subsequent access without undoing completed operations or automatically erasing every archive.

12. Rights and requests

Subject to the GDPR, you may request access, correction, erasure, restriction and portability and object to legitimate-interest processing. You may always object to direct marketing. Consent can be withdrawn without affecting the lawfulness of earlier processing.

Write to info@dgtechcorp.com identifying the service or relationship and your request, without sending passwords, tokens or unnecessary documents. Proportionate information may be requested to verify identity. Responses are normally provided within one month; any GDPR-permitted extension and its reasons will be communicated.

For information processed on a customer's behalf, that controller must be involved; DG Technologies assists within its role. You may complain to the Italian Garante per la protezione dei dati personali, www.garanteprivacy.it, or the competent authority in your country of habitual residence, work or the alleged infringement.

13. Automation, children and updates

Lead synchronisation and notification delivery are automated, but do not themselves constitute decisions with legal or similarly significant effects on individuals. Custom AI features or additional assessments require project-specific information; this page does not authorise new uses of data.

Services primarily target businesses, professionals and authorised users, not children. Contact us if irrelevant information or children's data has been supplied without appropriate grounds, so that it can be assessed and addressed.

The date above identifies this notice's version. New processing or material changes require appropriate information and, where necessary, renewed authorisation before data is used for a different purpose.