Privacy Policy

1. Who is responsible for your data

The data controller is Dualistic, VAT number 01394290322, based in Trieste, Italy.

Our address is via Crispi 56, 34126 Trieste, Italy. For any question about this policy, or to exercise the rights in section 7, write to info@dualistic.it. Our certified email address (PEC) is dualistic@pec.it.

We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale monitoring or process special categories of data, so none of the conditions in Article 37(1) GDPR apply.

2. What we collect, and why

Nothing, unless you write to us or open the twin

Browsing the site sends us no information about you. Every page except the interactive twin is a static file with no input of any kind.

The form in front of the interactive twin

The twin at /twin sits behind a short form asking for your work email address, company name and role. We ask so that we know who is evaluating DCIMate and can follow up where it is useful. Nothing else about you is requested, and the answers are not combined with any other source.

The legal basis is your consent under Article 6(1)(a) GDPR: you choose whether to submit the form, and declining costs you nothing that matters, since the same material is available as a narrated video on the DCIMate page. You can withdraw consent at any time by writing to us, and we will delete what you sent.

Two things we would rather state plainly than leave you to discover. First, the form is hosted by Tally and your answers go to Tally, not through this site: we read them in Tally's dashboard, and section 3 covers that. Second, the twin is not really protected by the form. It is a static page whose 3D model files sit at public web addresses, so anyone who wants to skip the form can. It is there to introduce us, not to keep you out.

The form is not loaded until you press the button that asks for it. Until that moment your browser makes no request to Tally at all, so simply arriving at /twin and leaving again discloses nothing to them.

If you choose to email or call us, we hold what you send - typically your name, your email address or phone number, and whatever you tell us - for one purpose: to read your enquiry and reply to it. We do not use it for marketing, we do not profile you, and we do not share it with anyone.

The legal basis is Article 6(1)(b) GDPR where your message concerns a possible contract with us, and otherwise our legitimate interest under Article 6(1)(f) in answering people who contact us. Your mail reaches our inbox directly from your own mail client: there is no contact form anywhere on the site, and the form described below is not involved in it.

Server logs

The site is served as static files by GitHub Pages (GitHub, Inc.), which records standard access logs including IP address, timestamp and user agent for security and operational purposes. We do not control those logs and cannot read them. Their handling is governed by the GitHub General Privacy Statement . GitHub is based in the United States and relies on Standard Contractual Clauses for transfers of personal data out of the EEA.

3. Who else processes it

One company, for one form. The form in front of the twin is operated by Tally BV, August Van Lokerenstraat 71, 9050 Ghent, Belgium (enterprise number 0776.979.007), acting as our data processor. What you type into it is transmitted to Tally and hosted in the European Union, and they process it only on our instructions under their data processing agreement . Their own handling is described in the Tally privacy policy .

Tally is an EU company hosting in the EU, so in the ordinary course your data stays inside the EEA. Their agreement does allow transfers outside it by exception, and covers those by incorporating the European Commission's Standard Contractual Clauses (Decision 2021/914). They engage their own sub-processors for hosting, payments and communications; the current list is available from them on request.

Loading that form necessarily discloses your IP address and browser details to Tally, as any embedded content does. This is why the form is not loaded until you ask for it: see section 2.

Beyond Tally we use no other processor for personal data: no analytics provider, no advertising network, no customer-tracking or CRM platform. The only other third party involved is our host, described in section 2, which sees the access logs of the web server and never sees the contents of your correspondence.

4. Cookies and local storage

This site sets no cookies. It runs no analytics or measurement scripts, no tag manager, and no advertising or social tracking pixels.

It writes one entry to your browser's local storage, and only once you have submitted the form in front of the twin. The key is twin-gate-v1 and its value is the date you submitted. Its only job is to remember that you already filled the form so you are not asked again on every visit. It is not an identifier, it is never read by anyone but the page itself, and it is never transmitted anywhere. Clearing your browser storage removes it, at the cost of being asked once more.

No consent banner is shown because none is required: that entry is strictly necessary to provide a feature you explicitly asked for, which is the exemption in Article 5(3) of the ePrivacy Directive, and nothing else is stored on your device.

The embedded form itself runs in Tally's own frame and may set storage of its own within that frame, governed by Tally's policy linked in section 3. That happens only after you press the button that loads it.

Typefaces are served from our own domain rather than a font CDN, so loading a page sends no request to any third-party font service.

5. Third-party content on blog posts

Two blog posts embed material hosted elsewhere. When you open one of those posts, your browser requests that material directly, which necessarily discloses your IP address and browser details to the host. Unlike the form described in section 3, these load as soon as the post opens:

• a video player embedded from peertube.uno, on the Coral platform post;
• a header image loaded from images.unsplash.com, on the digital twin post.

Links to our X and LinkedIn profiles are ordinary links: they transmit nothing until you click them, at which point the destination's own privacy policy applies.

6. How long we keep it

We keep enquiry correspondence for 24 months from our last exchange with you, after which it is deleted. If your enquiry leads to a commercial relationship, the resulting data is retained under the separate obligations that govern it, including Italian accounting and tax law.

Submissions from the form in front of the twin are kept for 24 months from the date you sent them, then deleted from Tally. If we are already talking by then, the exchange is held as correspondence under the paragraph above rather than kept twice.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict or object to processing (Art. 18 and 21);
• receive your data in a portable format (Art. 20);
• withdraw consent at any time, where we relied on it (Art. 7(3)), without affecting what was lawful before you withdrew it.

Which of these bites depends on how the data reached us. For the form in front of the twin we rely on your consent, so withdrawing it under Article 7(3) is the direct route: say so and we delete what you submitted. For correspondence you send us we rely on legitimate interest, so the right to object under Article 21 is the relevant one: tell us to stop and we will, and we will delete the correspondence unless we are legally required to keep it.

To exercise any of these, write to info@dualistic.it. We will respond within one month.

If you believe your data has been handled unlawfully, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali .

8. Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Material changes affecting data already collected will be communicated directly where we hold a means of contacting you.