PRIVACY POLICY — ARSHADES WEBSITE

Version 1.1.0 — Updated: 22 October 2026 — Effective: from its publication on the new ARShades website

This privacy policy concerns the website presenting the ARShades solutions (the “Site”). The product experiences, including the embedded demos, are described in the Privacy Policy of the ARShades solutions. For cookies and similar technologies, see the Website Cookie Policy.

1. Who processes the data

The data controller is Spaarkly s.r.l., Via della Tecnica n. 18, 85100 Potenza (Italy). For information and to exercise your rights: privacy@spaarkly.com.

2. Data, purposes and legal bases

Browsing and security. We process the IP address, date and time, page requested, response code and browser information for the operation, security and diagnostics of the Site. The legal basis is our legitimate interest in ensuring its proper and secure operation (Art. 6(1)(f) GDPR).

To protect the forms from automated and abusive submissions, we use Google reCAPTCHA Enterprise, which processes the IP address, browser and device information and cookie identifiers to assess the risk of abuse. The legal basis is our legitimate interest in protecting the Site and the requests we receive (Art. 6(1)(f) GDPR).

Optional statistics. We use Google Analytics 4 only with your consent, to measure visits and interactions, through cookie identifiers, device and browser data, pages visited, traffic source and approximate location. Google does not log or store the IP addresses of European traffic, which are used to derive location. We do not use Google Signals, advertising features or remarketing. The legal basis is consent (Art. 6(1)(a) GDPR): you can refuse it with no consequences for your use of the Site, or withdraw it from “Cookie preferences” in the footer.

Cookie choices. We record a random identifier, date and time, version and language of the policy, categories and the choice made, with no IP address or user-agent in the choice log. We do this to demonstrate consent, in compliance with the obligations under Arts. 5(2) and 7(1) GDPR (Art. 6(1)(c)); for other choices, the basis is legitimate interest in respecting and documenting your preferences (Art. 6(1)(f)).

Demo and trial requests. We collect first and last name, company and company type, country, email address, phone number, role, catalogue size, products of interest and a message, to handle the request and get back to you. A business email address is required for demo requests; for trial requests, you can also use a personal email address. We also record the date, time, version and language of your declaration that you have read the privacy policy and the Terms, in order to document it.

We send you a confirmation link valid for 24 hours. Only after confirmation is the request entered in the CRM and handled. Unconfirmed requests are kept exclusively to detect and document abuse, attempted fraud or acts of unfair competition and to protect our rights, including in relation to subsequent requests from the authorities, without any commercial follow-up. If you receive a confirmation message without having submitted a request, you can ignore it and report it to us at privacy@spaarkly.com.

The legal basis is the performance of pre-contractual measures taken at your request if you act on your own behalf (Art. 6(1)(b) GDPR), or legitimate interest in handling the request of the company you represent (Art. 6(1)(f)). To prevent and document abuse, fraud and unfair competition and to document the declarations made, the basis is our legitimate interest in the protection of rights (Art. 6(1)(f)). Mandatory disclosures to the authorities are based on the applicable legal obligation (Art. 6(1)(c)).

Mandatory fields, including the message, are marked in the form: without them we cannot handle the request. Activation of the trial in ARShades Studio is governed by the platform's Terms and privacy policy.

3. How long we keep the data

4. Providers and transfers

The data is accessible to authorised personnel and to the providers that process it on our behalf: Google Ireland Ltd. / Google LLC, for hosting and database (Firebase, Google Cloud), protecting forms from abuse (reCAPTCHA Enterprise) and, with prior consent, Google Analytics 4; Zoho Corporation, for confirmation and service emails (ZeptoMail) and request management (Bigin). It may be disclosed to the competent authorities in the cases provided for by law or to protect our rights. We do not sell the data or disclose it to third parties for marketing purposes.

We use infrastructure in the EU for hosting, database, email and CRM. The providers' services may also involve processing or access outside the European Economic Area. For transfers to Google LLC in the United States, the EU–U.S. Data Privacy Framework applies, within the limits of the certification; in other cases, the European Commission's Standard Contractual Clauses apply, including those provided for access from outside the EEA by the Zoho group. You can request a copy of the safeguards at privacy@spaarkly.com.

5. Your rights

In the cases provided for by the GDPR, you can request access to your data and its rectification, erasure, restriction and portability by writing to privacy@spaarkly.com. You can withdraw your consent at any time, without affecting the lawfulness of earlier processing; for analytics, use “Cookie preferences”.

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, by writing to the same address. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims.

You can also lodge a complaint with the competent supervisory authority; in Italy, this is the Garante per la protezione dei dati personali (the Italian Data Protection Authority).

6. Updates

The updated version is published on this page with its date. In the event of substantial changes, we will give notice of them on the Site.