Last updated: 11 September 2026

This notice explains how NEXILICA SRL processes the personal data of people who visit its websites and write to it, as required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It covers every site listed in section 2: where a processing activity concerns only some of them, we say so.

1. Data controller

  • NEXILICA SRL
  • Viale Ciro Menotti 83, 41121 Modena (MO), Italy
  • VAT IT04179460367
  • Email: info [at] nexilica [dot] com
  • PEC (certified email): nexilica [at] trustpec [dot] it

NEXILICA SRL has not designated a data protection officer (DPO), because none of the cases in Article 37 GDPR applies. For any question about your data, write to info [at] nexilica [dot] com .

2. Sites covered

Site Content
www.nexilica.com Company site: services, products, blog, contact form
nemo.nexilica.com NeMo, the monitoring platform: guides, calculator, contact form
testhive.nexilica.com TestHive, the test software: early-access waitlist

Every new NEXILICA site is added to this list before it collects any personal data.

3. Data, purposes and retention

3.1 Browsing and security (all sites)

  • Data: IP address, browser and operating system, requested page, date and time, outcome of the request.
  • Purpose: to show you the pages and protect the sites from abuse and attacks.
  • Legal basis: NEXILICA's legitimate interest in running the sites and keeping them secure (Art. 6(1)(f) GDPR).
  • Retention: this data is processed by Cloudflare, which serves the sites; technical logs are kept for no longer than 90 days.

3.2 Contact forms (www.nexilica.com, nemo.nexilica.com)

  • Data: name, email, subject and message (required); phone and company (optional); the page language and the form you write from, for example the NeMo calculator.
  • Purpose: to answer your request and, if you ask, prepare an offer. We also send a confirmation email to the address you give.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • Retention: 24 months from submission. If the request leads to a contract, the data needed follows the duration of the relationship and the periods set by law.

3.3 Emails you send us (all sites)

  • Data: your address and the content of the messages you send to info [at] nexilica [dot] com or security [at] nexilica [dot] com .
  • Purpose: to reply; for vulnerability reports, to handle them under the coordinated disclosure policy published on nemo.nexilica.com and, if you wish, to credit you in the advisory.
  • Legal basis: pre-contractual steps (Art. 6(1)(b) GDPR) or legitimate interest in handling correspondence and product security (Art. 6(1)(f)); for actively exploited vulnerabilities, the reporting obligation of Regulation (EU) 2024/2847 (Art. 6(1)(c)).
  • Retention: 24 months from the last message, unless a contract is ongoing or the law requires otherwise.

3.4 TestHive waitlist (testhive.nexilica.com)

  • Data: email, language, the page you sign up from, date and time; a keyed fingerprint (salted SHA-256 hash) of your IP address and browser, never the raw values.
  • Purpose: to tell you about early access to TestHive and send you product updates and launch pricing. The fingerprint is used only to limit repeated sign-ups from the same connection.
  • Legal basis: your consent (Art. 6(1)(a) GDPR) for the communications; legitimate interest in preventing abuse (Art. 6(1)(f)) for the fingerprint.
  • Retention: until 6 months after TestHive's commercial launch, or until you withdraw consent by writing to info [at] nexilica [dot] com .

3.5 Visit statistics (all sites, only with your consent)

  • Data: a random identifier stored in a cookie, pages viewed and interactions, device and browser type, approximate location (country and city) derived from the IP address. Your IP address still reaches Google which, according to its own documentation, uses it to derive the approximate location and does not log or store it.
  • Purpose: to understand, in aggregate, which pages are read and how to improve them.
  • Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Personal Data Protection Code). Without consent Google Analytics is not loaded and your browser does not contact Google.
  • Retention: up to 14 months in Google Analytics; the cookies last up to 13 months. Google signals and ad personalisation are switched off.

3.6 Your cookie choice (all sites)

  • Data: the choice you make in the banner, the banner version and a random identifier, stored in the technical cookie nxl_consent on your device. On our servers we record the same choice with the identifier, the banner version, the page, the language, the date and the time: no IP address and no other browser data.
  • Purpose: to respect your choice, not ask again on every page, and be able to show how and when you gave or refused consent (Art. 7(1) GDPR).
  • Legal basis: legal obligation (Art. 6(1)(c) GDPR and Art. 122 of the Italian Personal Data Protection Code).
  • Retention: the cookie lasts 12 months, after which the site asks again; the record on our servers is kept for 24 months.

4. Providing your data

In the forms, the required fields are what we need to answer you: without them we cannot handle the request. You can leave the optional ones empty. Joining the waitlist and accepting statistics are entirely optional: if you do not, the sites work just the same. Browsing data is needed to show you the pages.

5. Who receives the data

The data is processed by authorised NEXILICA staff and by the following providers, appointed as processors (Art. 28 GDPR):

  • Cloudflare, Inc. (United States): serving and protecting the sites; the database where we store contact requests, waitlist sign-ups and cookie choices.
  • Plus Five Five, Inc., operating as Resend (United States): sending the notification emails to NEXILICA and the confirmation emails to whoever writes.
  • Microsoft Ireland Operations Limited (Ireland): Microsoft 365, the mailbox where requests and emails arrive.
  • Google Ireland Limited (Ireland): Google Analytics 4, only with your consent.

We do not sell data or pass it to third parties for marketing. We may disclose it to authorities when the law requires.

6. Transfers outside the European Union

Cloudflare, Resend, Microsoft and Google may also process data in the United States. The US companies involved (Cloudflare, Inc., Plus Five Five, Inc., Microsoft Corporation and Google LLC) participate in the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023 (Art. 45 GDPR). Our contracts with these providers also include the standard contractual clauses adopted by the Commission (Art. 46 GDPR).

7. Your rights

You can ask at any time to access your data, correct it, erase it, restrict its processing, receive it in a structured format (portability) and object to processing based on legitimate interest (Articles 15-22 GDPR).

You can withdraw consent whenever you like, without affecting processing already carried out: for statistics with "Manage cookies" at the bottom of every page, for the waitlist by writing to us.

Write to info [at] nexilica [dot] com or to the PEC address nexilica [at] trustpec [dot] it : we reply within one month. If you believe the processing breaches the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority (www.garanteprivacy.it).

8. Automated decisions

We do not take decisions based solely on automated processing, including profiling (Art. 22 GDPR).

9. Cookies

Each site has its own cookie policy, listing exactly what it stores in your browser:

10. Changes

If we change this notice we update the date at the top. If the purposes of the statistics or the providers involved change, the cookie banner asks for your consent again.