Privacy policy
What happens to personal data when you visit invariance.co or work with us, under Art. 13 and 14 GDPR and the Italian Data Protection Code (Codice privacy, D.Lgs. 196/2003). Visits are counted anonymously; anything more is recorded only if you allow it. The site loads nothing from third-party services: pages, fonts, analytics and error reports all come from our own server.
Controller
Invariance — Philipp Gurndin, Italian sole trader (ditta individuale) Via Max Valier 20 int. 012, 39100 Bolzano (BZ), Italy contact@invariance.co PEC gurndin@pec.it +39 350 0404 001 No data protection officer is appointed, because the statutory conditions requiring one are not met.
Hosting and server location
The site and every service named on this page (analytics, error reports, sign-in and email) run on one virtual server that we rent from Contabo GmbH, Munich, Germany, and operate ourselves. The server stands in Contabo's data centre in Lauterbourg, France, inside the EU. Contabo provides the machine and the network and acts as our processor (Art. 28 GDPR).
Server log files
When you open a page, your browser sends data that our server records: IP address, date and time, the page requested, the referring page, browser and operating system. We need this to deliver the site and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in reliable and secure operation). Log data is not combined with other sources.
Analytics
We count visits with our own analytics service at analytics.invariance.co, which runs on the server described above. No third-party analytics product is involved. Without your consent, and until you choose, each page you open is counted anonymously. The last part of your IP address is removed before anything else happens; the shortened address, your browser's identifier and a random value that is deleted at midnight (UTC) form a key that lets us count one visit per day without knowing who you are or recognising you the next day. We keep the page, the referring site, campaign parameters, your approximate location (country, region, city), device type, browser, operating system and time on the page. Apart from your cookie choice, nothing is stored on your device. Legal basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR), within section 7.2 of the Italian data protection authority's 2021 cookie guidelines. With your consent (Art. 6(1)(a) GDPR, Art. 122 Codice privacy) we record your visits in full: a random visitor id and session id kept in your browser, your full IP address and the location derived from it, browser and device details (user agent, screen and window size, languages, time zone, colour scheme, connection), where you came from (landing page, referring page, campaign parameters and ad click ids), and what you do here: pages and their titles, time spent, scroll depth, clicks and their position, form steps (field names only, never what you type) and loading speed. If you then send the request form, your email address is linked to this history, so we know what you read before writing to us. We use this to see which pages and channels work and to prepare for your enquiry. Analytics data stays on that server, is not passed to anyone and is deleted after 25 months. You can withdraw your consent at any time under Cookie settings in the footer, also at the end of this page: turning analytics off deletes what we recorded about you at once and removes the ids from your browser.
The request form
When you send the request form, your entries (name, email address, company and your message) are transmitted to our server and delivered to our mailbox by email so that we can answer you (Art. 6(1)(b) GDPR). If you have allowed analytics, your email address is also stored with your visit history (see Analytics); otherwise your entries are not stored in a database. They are not used for any other purpose. If mail delivery is unavailable, your own email program opens a pre-filled draft instead, and nothing reaches our server until you send it yourself.
Error reports
When an error occurs in your browser, the site sends a technical error report to our own error service (errors.invariance.co, on the same server). It contains the page address, browser identification and the technical stack trace. We use these reports only to find and fix faults in our software (Art. 6(1)(f) GDPR, our legitimate interest in a working and secure service).
Sign-in
Signing in runs on Invariance's own authentication service at authentication.invariance.co. Account data stays with us and is not processed by an outside provider. This applies only if you actively sign in; simply reading the public site does not.
Cookies and browser storage
No advertising or third-party cookies are used. A cookie stores your language choice, and a session cookie is added only if you sign in. Your browser's storage keeps your cookie choice (inv-consent; a refusal is asked again after six months) and, only with analytics consent, a visitor id (inv-v, until you withdraw) and a session id (inv-s, for the open tab). The language cookie, the session cookie and your cookie choice are strictly necessary and need no consent (Art. 122 Codice privacy and the Garante's cookie guidelines of 2021); the analytics ids are set only with your consent.
Clients and enquiries
If you contact us or become a client, we process the contact, project and invoicing data we need to answer you, to prepare and perform the contract and to bill our services (Art. 6(1)(b) GDPR). If you create an account, we process the account data needed to sign you in and give you access (Art. 6(1)(b) GDPR). We keep accounting records as Italian tax and commercial law requires (Art. 6(1)(c) GDPR).
Recipients
We do not sell data and do not use it for advertising. Contabo GmbH provides our server's hardware and network (see Hosting and server location). Brevo SAS, Paris, France, delivers the emails we send, including our replies to your enquiry. Brevo stores data in the EU (France and Belgium) and uses some subprocessors in the USA on the basis of the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Beyond that, we disclose data only where the law requires it, for example to the tax authorities or our tax advisers.
Retention
Analytics data: 25 months, or deleted at once when you withdraw consent. Error reports: until the fault is dealt with, then at most 30 days. Enquiries and correspondence: as long as we need them to answer you and to perform any resulting contract. Accounting records: ten years (Art. 2220 Codice civile). Server log files: only as long as operation and security require.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal. To exercise any of these rights, write to contact@invariance.co.
Right to lodge a complaint
If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority: Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Rome, Italy garanteprivacy.it
Further information
Providing your contact details is voluntary. Without them we cannot answer your enquiry or enter into a contract with you; there is no other disadvantage. We make no automated decisions within the meaning of Art. 22 GDPR. Last updated: 30 October 2026.