Privacy Policy

Version 1.1 – last updated: 22 October 2026

This policy explains how SINT Srl processes the personal data of people who visit www.xgslab.com or contact us through it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. It does not cover external websites reachable through links on our pages, which have their own policies.

1. Data Controller

SINT Srl, Via Cristoforo Colombo 106, 36061 Bassano del Grappa (VI), Italy – VAT no. IT02324560248.
For any privacy matter: privacy@sint.eu.

SINT has not appointed a Data Protection Officer, as it is not required to do so under Article 37 GDPR.

2. Personal data we process, why, and for how long

2.1 Navigation data and security logs

When you browse the website, our servers automatically record data that is implicit in the use of Internet protocols: IP address, date and time of the request, requested page, request method, response code and size, browser and operating system. We also record blocked requests and suspicious activity detected by our web application firewall, and the actions and log-ins of the website administrators.

Purpose: to deliver the pages, to keep the website working and to protect it against attacks and misuse.
Legal basis: our legitimate interest in the security of our network and information systems (Art. 6(1)(f) and Recital 49 GDPR).
Retention: up to 12 months, then deleted automatically, unless the data is needed to establish, exercise or defend legal claims or is requested by the authorities.

2.2 Document downloads

Documents are downloaded directly from our web server. Software installation files and trial licences sent to customers are delivered through the KeyCDN content delivery network. To deliver the file, your IP address and the technical data of the request are processed; we do not keep a separate record of who downloads what.

Purpose: to deliver the requested file quickly and reliably.
Legal basis: our legitimate interest in providing our documentation and software (Art. 6(1)(f) GDPR).
Retention: only in the technical logs described in section 2.1; KeyCDN anonymises IP addresses in its logs.

2.3 Contact forms and e-mails

When you use one of the contact forms or write to one of the e-mail addresses on the website, we process your name, e-mail address, the subject and the content of your message, and any other data you choose to include.

Purpose: to answer your request and, if you ask for it, to prepare a quotation or provide information on our products and services.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or, for general enquiries, our legitimate interest in answering the people who contact us (Art. 6(1)(f) GDPR).
Retention: 24 months from the last exchange; if the request leads to a contract, the data is then kept as described in our privacy notice for clients and suppliers, available on request at privacy@sint.eu.

We do not use these data to send newsletters or marketing communications.

2.4 Job applications

Applications sent through the “Work with us” page or by e-mail are processed as described in our Candidate Privacy Notice. CVs are kept for 12 months.

2.5 XGSLab Certified Users

The “Certified Users” page lists the name, company, country, certification level and validity dates of people who have obtained the XGSLab certification. These data are published only with the consent of each person (Art. 6(1)(a) GDPR), so that third parties can verify the certification. Consent is optional and can be withdrawn at any time by writing to privacy@sint.eu; the entry is then removed. Entries are also removed when the certification expires.

3. Is providing data mandatory?

Navigation data is needed to display the website. The name, e-mail address and message requested by the contact forms are needed to answer you: without them we cannot handle your request. Any other information is optional.

4. Cookies and embedded content

The website uses only technical cookies that do not require consent. Maps, videos and other content provided by third parties (Google Maps and YouTube) are loaded only if you click on them; until then, no data is sent to those providers. Details are in our Cookie Policy.

5. Who receives the data

The data is processed by SINT staff authorised and instructed for this purpose. It is also processed, on our behalf and under a data processing agreement (Art. 28 GDPR), by:

Aruba S.p.A. (Italy) – website hosting, e-mail and backups;
Amazon Web Services EMEA SARL – delivery of some media files of the website through the CloudFront network;
proinity LLC (KeyCDN, Switzerland) – delivery of software installation files and trial licences.

Data may be disclosed to public authorities when required by law. It is not disseminated.

6. Transfers outside the European Union

Website and e-mail data is stored in the European Union. KeyCDN is based in Switzerland, a country recognised by the European Commission as providing an adequate level of data protection. The CloudFront network may deliver files from servers outside the EU; in that case the transfer is covered by the EU–US Data Privacy Framework adequacy decision and by the Standard Contractual Clauses included in the AWS data processing addendum. If you choose to load content from Google (Maps, YouTube), Google may transfer data to the United States under the EU–US Data Privacy Framework.

7. How we protect the data

We process data electronically and apply technical and organisational security measures, including encrypted connections (HTTPS), restricted and logged access to the website administration, a web application firewall and regular backups. Daily hosting backups are kept for up to 7 days and then overwritten; occasional backups made before maintenance work are kept for up to 30 days.

8. Your rights

You can ask us at any time for access to your personal data, its rectification or erasure, the restriction of processing and data portability, and you can object to processing based on our legitimate interest (Articles 15–22 GDPR). Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of the processing carried out before.

To exercise your rights, write to privacy@sint.eu or to SINT Srl at the address above. We will reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

9. Changes to this policy

We review this policy at least once a year and whenever the way we process data changes. The date at the top of the page shows the current version.

10. Other information notices

Privacy notice for clients and suppliers: available on request at privacy@sint.eu