Cookie Policy

This page describes the cookies and similar technologies (browser local and session storage, tracking pixels) used on the rivedi.ai website: what data they collect, how long they stay on your device and how you can express, change or withdraw your choice at any time. It supplements the Privacy Policy, to which reference is made for all other processing activities and for your rights.

This English text is provided for convenience only. In case of any discrepancy, the Italian version of this Policy prevails.

Legal references: Art. 5(3) of Directive 2002/58/EC (“ePrivacy”) and Art. 122 of Italian Legislative Decree 196/2003; Articles 6, 7 and 13 of Regulation (EU) 2016/679 (“GDPR”); Guidelines of the Italian Data Protection Authority on cookies and other tracking tools of 10 June 2021.

1. Data Controller

The Data Controller is IVEMIND Società Cooperativa Sociale, with registered office at Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy. Tax code and VAT number: IT03138990217. Certified email (PEC): ivemindscs@pec.it. For any request concerning this page or the exercise of your rights: privacy@ivemind.com.

2. What cookies and similar technologies are

Cookies are small text files that a website saves on your device and reads back on later visits. Alongside cookies we use two technologies which are equivalent in their effects, and are therefore treated the same way on this page: the browser’s local storage and session storage (where we save your cookie choice and, for the session only, advertising origin identifiers) and tracking pixels, that is code fragments that tell a third-party provider that you visited a page or performed an action.

Necessary cookies do not require your consent. No third-partystatistics or marketing cookie (Google, Meta) is written on your device unless you accept it: none is set if you do nothing or close the banner. Two clarifications, developed further below, because “no cookie” does not mean “nothing happens”: Google’s measurement code is loaded before you make a choice and transmits cookieless events (§ 5.1), and the site records in the browser’s session storage the advertising origin identifiers contained in the address you land on (§ 6).

3. How you express, change and withdraw your choice

On your first visit a banner allows you to accept everything, refuse everything or choose category by category. Non-necessary categories are initially set to refusal: until you explicitly enable them, no third-party statistics or marketing cookie is written. That is not the same as saying that nothing happens before your choice: what is transmitted to Google in any case is set out in § 5.1, and what stays in your browser in § 6.

You can change your mind at any time through the “Cookie preferences”link in the site footer: it reopens the same panel with your current choices already set. Withdrawal takes effect immediately, with no need to reload the page: the consent signals sent to Google switch to “denied”, a revocation is sent to the Meta Pixel, and the cookies of the withdrawn category (_ga*, _gcl_*, _fbp, _fbc) are deleted from your browser together with the attribution data kept in session storage. Pursuant to Art. 7.3 GDPR, withdrawal does not affect the lawfulness of processing carried out before it.

Your choice is recorded in the browser’s local storage under the key rivedi-cookie-consent, together with the date and the version of the policy it refers to, and is valid for 365 days; once that period expires, or if the conditions of the processing change significantly (for example if the third parties involved change), the banner will be shown again. Because the choice is stored in the browser, it must be expressed again if you change device or browser, if you browse in private mode or if you clear your browsing data.

4. Necessary cookies

They are indispensable to deliver the site and to respect your rights, and therefore do not require consent (Art. 122(1) of Legislative Decree 196/2003; Art. 6.1.c and 6.1.f GDPR). This category includes the record of your own cookie choice: keeping it is what allows us not to ask you again and to demonstrate, if required, the consent collected.

The contact form is additionally protected by technical anti-abuse checks (a hidden field invisible to visitors and a check on how long the form took to fill in) which do not involve writing cookies or storing information on your device.

5. Statistics cookies — Google Analytics 4

We use Google Analytics 4 (measurement id G-GZSSTJWM49), provided by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how many people visit the site, which pages they read, where they come from and where they run into difficulty, and to improve content and structure accordingly. We do not use Analytics to build individual profiles or to show you advertising.

Besides the pages visited, we record some interactions: scroll depth, time on page, sections viewed, clicks on call-to-action buttons, start and submission of the contact form. Each of them is transmitted as a separate event, with the parameters listed in § 5.1. IP anonymisation is enabled on the site.

5.1 Behaviour before your choice (Consent Mode v2, advanced mode)

We think it is right to state this explicitly, because it is the least intuitive point of this policy. The site uses the advanced modeof Google’s Consent Mode v2: this means that the Google Analytics code is loaded on every page before you express a choice, with all consent signals set to “denied”. It is essential to understand what “denied” actually governs: it prevents cookies from being written, not data from being transmitted. Measurement events are sent in any case, without cookies. In practice, before your choice:

• your browser still establishes a connection to Google’s servers (googletagmanager.com and google-analytics.com), which receive your IP address, browser and device type (user agent), the full address of the pageyou are visiting — including any advertising origin parameters it contains — and the page you came from;
• every measurement event the site generatesis transmitted, not just page views: the view of each page; the scroll depth reached (at 25, 50, 75 and 100%); time on page once 30, 60, 120 and 300 seconds are passed, staying longer than 30 seconds on the highest-intent pages (contact, pricing, features) and the total time when you leave the page; the sections of the page that scroll past your eyes, by name; clicks on call-to-action buttons, with the button’s name, position and type; clicks on outbound links, with the link’s address and text; the start of filling in the contact form and the outcome of its submission; as well as the very choice you make in the cookie banner;
• if you submit the contact form before expressing a choice, the two submission events (lead_form_submit and generate_lead) carry an individual identifier (the transaction_id parameter): a random code minted for that single request, the same one that accompanies the request to our servers. It is not an identifier of your browser and it does not follow you from one visit to the next, but it makes that event referable to your specific contact request. Your name, your email address and the text of your message are, by contrast, never transmitted to Google from the browser;
• no cookie is written on your device and no persistent identifier is stored there: without the _gacookie, Google is unable to link two separate visits of yours to each other, and uses these signals — so-called cookieless pings— to produce aggregated statistical estimates;
• if you accept the statistics category, the signals switch to “granted”, the _ga and _ga_GZSSTJWM49 cookies are written and measurement becomes referable to your browser, rather than to the single visit alone, until the cookies expire or consent is withdrawn.

Legal basis. For writing cookies and for measurement based on persistent identifiers, the legal basis is your consent(Art. 6.1.a GDPR and Art. 122 of Legislative Decree 196/2003). For the transmission of the cookieless events described above, which precedes your choice — a transmission that involves neither the storing of information on your device nor access to information already stored, and therefore falls outside the scope of Art. 5(3) ePrivacy — the Controller relies on its legitimate interestin measuring the site’s audience (Art. 6.1.f GDPR). With respect to that processing you may exercise your right to objectunder Art. 21 GDPR at any time by writing to privacy@ivemind.com. Since this transmission precedes and is independent of the choice expressed in the banner, the most immediate way to prevent it altogether is to act on your browser: see § 9.

Retention and transfers. Data collected by Analytics are retained by Google for a maximum of 14 months at event level; cookies last for the durations shown in the table. Google Ireland Ltd may transfer data to Google LLC in the United States: the transfer is based on the EU-US Data Privacy Framework adequacy decisionof 10 July 2023, to which Google LLC adheres, and, in the alternative, on Standard Contractual Clauses. Google’s policy: policies.google.com/privacy.

6. Marketing cookies — Meta Pixel and Google Ads

Activation status as of 18 July 2026. The Meta Pixel is not active: the site is prepared to host it, but until the pixel identifier is configured no Meta script is loaded and no request is sent to Meta’s servers, even if you accept the marketing category. The Google Ads conversion tag is not configured yet either; however, the recording of click identifiers described in § 6.2 and the related Consent Mode settings are already operational. We describe the whole processing here so that it only becomes operational after you have been able to read about it: this page will be updated, with a new date and version number, when each tool is actually active.

The marketing category serves to measure the effectiveness of our advertising campaigns — that is, to know whether someone who saw or clicked an ad then visited the site or requested contact — and to show relevant ads to people who have already visited rivedi.ai (retargeting). We do not sell your data to third parties.

One clarification about the last row of the table. The click identifiers contained in the address you arrive with are recorded in the browser’s session storage when the page loads, regardless of the choice you express in the banner: they serve to avoid losing the origin information while you browse, and they remain confined to your browser. They are not transmitted to any third party without consent to the marketing category, and they are deleted if you refuse or withdraw that category.

6.1 Meta Pixel — joint controllership with Meta Platforms Ireland

The Meta Pixel is provided by Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, Ireland). Unlike the other providers, with respect to the event data collected through the pixel (Event Data: pages visited on our site, submission of the contact form, browser identifiers) Ivemind and Meta act as joint controllers under Art. 26 GDPR, as provided by Meta’s Business Tools Terms. The joint controllership is delimited: it covers the collection of such data on our site and their transmissionto Meta; the processing Meta subsequently carries out for its own purposes falls under Meta’s sole controllership and is governed by its own policy.

Under the arrangement, Ivemind is responsible for collecting consent and for this policy, while Meta is responsible for handling data subjects’ rights over the transmitted data; in any case the contact point for exercising your rights remains privacy@ivemind.com. The essence of the joint controllership arrangement is available at facebook.com/legal/controller_addendum; Meta’s privacy policy is at facebook.com/privacy/policy and ad preferences at facebook.com/adpreferences. Meta may transfer data to the United States on the basis of the EU-US Data Privacy Framework adequacy decision and of Standard Contractual Clauses.

Technical behaviour. Unlike Google Analytics, the Meta Pixel code is loaded only afteryou have accepted the marketing category: before that moment your browser does not contact Meta’s servers in any way. If you withdraw consent, a revocation is sent to the pixel which immediately stops it from sending events, and the _fbp and _fbc cookies are deleted.

6.2 Google Ads — click identifiers in page addresses

If you reach the site from a Google ad, the address you land on contains a click identifier (gclid, wbraid or gbraid). We keep it for the duration of the browser session, so that a contact request sent after browsing several pages can be attributed to the originating campaign.

Two Consent Mode settings deserve an explicit mention, because they produce visible effects even in the absence of your advertising consent:

• URL passthrough (url_passthrough): when marketing consent is denied, click identifiers may be copied into the addresses of the internal pages you visit, for measurement continuity only and without being associated with any cookie. As a result, those identifiers may appear in your browser history, in the technical logs of our content delivery provider and in the referrer addresses sent to the destination sites of outbound links.
• Ads data redaction (ads_data_redaction): again in the absence of consent, click identifiers are removed from the requests sent to Google’s advertising servers and those requests are routed to a cookieless domain. It is the most protective setting and we keep it enabled in all cases.

7. Server-side conversion measurement

When you submit the contact form, in addition to the events detected by the browser our servers may transmit to Google, through the Google Analytics 4 Measurement Protocol, an event recording the conversion linked to your request. The event contains a random identifier generated for the individual request, the Google Analytics client identifier and, if present, the Google Ads click identifiers; it does not contain the content of your message. Transmission takes place only in line with the choice you expressed: the state of your consent travels with the request and, if the corresponding category is denied, the event is not sent. Legal basis: your consent (Art. 6.1.a GDPR).

8. List of third parties and non-EU transfers

The third parties that may receive data through this site are, as at the date shown at the top of this page:

• Google Ireland Ltd— Google Analytics 4 and Google Ads; acting as processor for measurement, with transfer to Google LLC (USA) on the basis of the EU-US Data Privacy Framework.
• Meta Platforms Ireland Ltd — Meta Pixel (not yet active); joint controller under Art. 26 GDPR limited to the collection and transmission of Event Data, with transfer to the United States on the basis of the EU-US Data Privacy Framework.
• Amazon Web Services EMEA SARL— infrastructure for site delivery and for receiving the contact form; processor under Art. 28 GDPR, with data hosted in the eu-central-1 region (Frankfurt, Germany). It does not set tracking cookies.

The list is kept up to date and is reviewed whenever the tools in use change. The full named version is available on request by writing to privacy@ivemind.com.

9. Managing cookies from your browser

Regardless of the choices expressed on this site, you can block or delete cookies from your browser settings (“Privacy” or “Site data” section). Blocking all cookies does not prevent you from reading rivedi.ai, but it means your cookie choice cannot be stored and the banner will be shown again on every visit. In addition, you can install Google’s browser add-on to opt out of Google Analytics.

10. Rights of the data subject

You may exercise at any time the rights under Articles 15-22 GDPR (access, rectification, erasure, restriction, portability, objection) by writing to privacy@ivemind.com; you will receive a reply within 30 days. The right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) remains unaffected. For the complete picture of processing activities, legal bases and retention periods, please refer to the Privacy Policy.

11. Updates to this page

This Cookie Policy is updated whenever the tracking tools in use or the third parties involved change. The date and version number at the top of the page indicate the latest revision; when the change concerns purposes or third parties, the consent banner is shown again to collect a fresh choice.

12. Contact

privacy@ivemind.com · PEC: ivemindscs@pec.it · IVEMIND Società Cooperativa Sociale, Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy.