How we process personal data on the Zenit Telematics website.
This information concerns the public site and the contact, demo and estimate request forms. It does not govern the customer platform available on app.zenittelematics.com, which is governed by separate documentation.
- Latest updateAugust 18, 2026
- coveragePublic site, lead form, cookie preferences and optional analytics measurement.
Privacy notice under Articles 13 and 14 GDPR
This notice is organised by processing activity, distinguishing the data, purpose, legal basis, whether provision is required and retention period.
1. Data controller and contact details
The data controller is ORBITA S.R.L., with registered office in Piazza San Pasquale 48, Palazzo Acquaviva, 80121 Naples (NA), VAT number IT10831001218, REA NA-1135234. Zenit Telematics is the brand under which the service is presented.
For privacy questions or to exercise your rights you can send a certified email (PEC) to orbitaholding@pec.it or to the postal address of the registered office, indicating to the attention of the privacy contact person.
2. Sources of personal data
Most of the data is provided directly by the data subject when filling out a form or choosing cookie preferences. The technical navigation data is generated by the devices, the browser and the infrastructure that serves the site. The UTM parameters come from the address of the page visited and are associated with the form only at the time of sending. We do not purchase contact lists and the site does not import data from social networks or OAuth providers.
3. Categories of data processed
- Demo form: first name, last name, company email, telephone, company, fleet size range and main interest; optionally sector, time zone and message.
- Contact form: name and surname, email, company, reason for contact and message; callback request and telephone are optional, but the telephone becomes necessary if a callback is requested.
- Commercial context: source page, date and time, request ID, allowed UTM parameters and, if the path starts from the ROI calculator, number of vehicles, fleet range, interest, estimate interval, version of the calculation model and scenario identifier.
- ROI calculator: number of vehicles and, optionally, fleet type, interest and operational/economic values entered. The calculation takes place in the browser; only the summary above can be associated with a subsequent demo request.
- Technical data: IP address used in HMAC form for the rate limit, user agent and browser signals processed by Turnstile, technical tokens, anti-spam outcome, requested route, minimized application logs, cookies and identifiers described in the Cookie Policy.
- Consent and preferences: choice of cookies, version of the information, date and time, language/market and optional marketing consent.
4. Purposes, legal bases and requirement to provide data
| Purpose | Main data | Legal basis | Requirement to provide data | Retention |
|---|---|---|---|---|
| Serve and protect the site | IP and connection data, routes, technical logs, tokens and anti-spam signals | Legitimate interest in security and preventing abuse, Article 6(1)(f) GDPR; strictly necessary tools under Article 122 of the Italian Privacy Code | Necessary to navigate and, for Turnstile, submit forms | Rate limit 15 minutes; deduplication 10 minutes; technical logs for the time necessary for security, diagnosis and management of any disputes |
| Manage contacts, demos and estimates | Form data, UTM, source page and ROI summary | Pre-contractual measures requested by the data subject, Article 6(1)(b) GDPR | Fields indicated as mandatory necessary to respond; the others are optional | For the time necessary to manage and document the request and any pre-contractual relationship; beyond this deadline only for legal obligations or protection of rights |
| Future business communications | Contact details, company, interests and evidence of consent | Consent, Article 6(1)(a) GDPR | Optional and separate; refusal does not prevent the response to the request | Until you revoke your consent, object or the data is no longer necessary for this purpose |
| Measure site usage and performance with GA4 | Cookie identifiers, pages, events, device and campaign context without form fields | Consent, Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code | Optional; the site remains usable in case of refusal | Cookies up to 400 days; event data according to the duration set in the Analytics property and in any case no longer than the time necessary for measurement |
| Remember consent and language | Choice of cookie, version, date/time, language and market | Legitimate interest in respecting and documenting the choice, Article 6(1)(f) GDPR; technical storage requested by the user | Necessary to not repeat the choice and serve the requested language | Consent 182 days; language preference up to 365 days |
| Establish, exercise or defend rights | Requests, communications and data pertinent to the dispute | Legal obligation, Article 6(1)(c) GDPR, and legitimate interest in protecting legal rights, Article 6(1)(f) GDPR | Necessary within the limits of the case | For the statute of limitations and for the time necessary for the dispute |
5. The consent requested in the forms
The privacy-notice checkbox records that the user has read the notice and asks us to handle the request; the legal basis for responding is Article 6(1)(b) GDPR, not consent. The checkbox for future commercial communications is instead optional consent under Article 6(1)(a) GDPR. It is not pre-selected and consent may be withdrawn at any time without affecting the lawfulness of processing carried out beforehand.
6. Recipients and external data processors
The data is accessible to authorised staff and collaborators who manage the site, security and commercial requests. It may also be processed by technical service providers selected for the functions strictly required and, where applicable, appointed under Article 28 GDPR.
| Destinatario | Funzione | Data | Condizioni di accesso |
|---|---|---|---|
| Hosting and CDN providers | Hosting, CDN, server functions and logs | Browsing data and data transmitted via forms | Only to provide, protect and maintain the site |
| Cloudflare Turnstile | Spam protection | IP, TLS fingerprint, user agent, sitekey, origin and token | Only on pages with forms, to prevent automatic submissions and abuse |
| Secure email or webhook delivery provider | Delivery of the request to the designated contact persons | Lead content, email delivery, and delivery metadata | Only to forward and make the request available |
| Google Analytics 4 / Google Ireland Limited | Optional measurement | Browsing events, cookies, technical data and campaign | Only after consent to analytics |
| authorised contact persons and commercial systems | Reading and management of the request | Form data, consents and UTM | Only to authorised parties who must respond or follow up on the request |
7. Transfers outside the European Economic Area
Some technical suppliers may process data outside the European Economic Area or allow access to it from third countries. In these cases the transfer takes place in compliance with Chapter V GDPR, on the basis of an adequacy decision, the EU-US Data Privacy Framework when applicable, standard contractual clauses or another safeguard provided by law. You can request information on applicable guarantees by contacting the data controller.
| Servizio | Possible destination | Applicable safeguard | Purpose |
|---|---|---|---|
| Cloudflare Turnstile | Global Network and the United States | Data Privacy Framework and SCC in the Cloudflare DPA | Protection of forms from automatic submissions and abuse |
| Hosting, CDN and request delivery providers | It depends on the location and infrastructure of the provider used | Adequacy decision, EU-US DPF or SCC, as applicable | Provision of the site and forwarding of requests |
| Google Analytics 4 | EEA and possible global access/transfer | Google, DPF and SCC terms where applicable | Optional measurement of navigation, after consent |
8. Retention and erasure
The HMAC fingerprints used to limit sends and recognize duplicates remain in the temporary memory of the single server instance for up to 15 and 10 minutes respectively and may disappear sooner when the instance is terminated. The site does not maintain an independent archive of leads: the request is forwarded to the designated contact persons and kept for the time necessary to manage it, document any pre-contractual relationship and comply with legal obligations or protection needs. Application logs are minimized and remain available only for the time necessary for security, diagnosis and management of any disputes. Specific cookie and storage times are indicated in the Cookie Policy.
9. Special-category data, minors and third-party data
The forms do not require special categories of personal data under Article 9 GDPR, documents, vehicle registration numbers, IMEI numbers, passwords or tax data. Do not include health or biometric data, data concerning criminal convictions, or unnecessary information about drivers and other people in your message. If you disclose data about third parties, you must be authorised to do so and provide them with this notice where required.
The site is intended for business users and is not designed for minors. We do not perform age verification or knowingly collect data from minors. A minor must not use the forms without the involvement of a person exercising parental responsibility.
10. Profiling and automated decisions
The site does not make decisions based solely on automated processing that produces legal or similarly significant effects under Article 22 GDPR. The ROI calculator applies predefined formulas to the values entered and produces an indicative estimate, without approving contracts, prices or access. GA4, if activated with consent, measures navigation and aggregate events; Google Signals, personalised advertising, Google Ads, GTM and Meta Pixel are not active on the site.
11. Rights of the data subject
You can request access, rectification, erasure, restriction, portability when applicable and oppose processing based on legitimate interest. You can revoke your marketing and analytics consents at any time. You also have the right to lodge a complaint with the Italian Data Protection Authority and to take legal action. The concrete procedure, times and a request form are on the GDPR Rights page.
12. Privacy notice updates
We may update this information when processing activities, providers or legislation change. Substantial changes must be communicated in an appropriate manner and, when they affect an already expressed consent, a new choice must be requested. Last updated: August 18, 2026.