Privacy and Cookie Policy

Last updated: 24 October 2026

This policy explains how Roimaxweb Ltd processes the personal data of people who visit roimaxweb.com, who write to us, and who use the internal tools described in section 7. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and under UK law (UK GDPR and the Data Protection Act 2018).

1. Data controller

Roimaxweb Ltd, a company registered in the United Kingdom (Companies House no. 12400005), registered office 981 Great West Road, Brentford, TW8 9DN, United Kingdom.
Email: [email protected]

We have not appointed a Data Protection Officer: please send any privacy request to the address above.

2. What data we process

Browsing data. When you visit the site, the servers that host it and the network that delivers it automatically log some technical data: IP address, date and time of the request, page requested, browser and operating system, referring page. We use it to run the site, protect it from abuse and attacks, and fix technical problems. We do not use it to identify or profile you.

Data you send us. If you email us, we process your address, your name and the content of your message in order to reply and, if you ask, to prepare a quote.

Client and supplier data. If you become a client or supplier, we process the data needed for the contract, invoicing, and accounting and tax obligations.

The site has no contact forms, user accounts, comments, newsletter, analytics or advertising tools.

3. Purposes and legal bases

• Running and protecting the site: our legitimate interests (Art. 6(1)(f) GDPR).
• Replying to enquiries and preparing quotes: steps taken at your request before entering into a contract (Art. 6(1)(b)).
• Performing contracts with clients and suppliers: performance of a contract (Art. 6(1)(b)).
• Meeting accounting, tax and other legal obligations: legal obligation (Art. 6(1)(c)).
• Establishing or defending legal claims: legitimate interests (Art. 6(1)(f)).

We do not send marketing communications without your consent. We do not make decisions based solely on automated processing, including profiling.

4. Third-party services

• Infomaniak Network SA (Geneva, Switzerland) hosts the site on servers in Switzerland and processes browsing data as our processor.
• Cloudflare, Inc. (United States) is the delivery and security network every request to the site passes through; it processes your IP address and request data to deliver pages and block malicious traffic. It also provides the script that hides the email addresses published on the site from spam harvesters.
• Google Fonts (Google Ireland Limited and Google LLC): the site’s typefaces are loaded from Google’s servers, so your browser sends Google your IP address and request data. Google states that it collects only the data needed to serve the fonts.
• Google Workspace (Google Ireland Limited) hosts the @roimaxweb.com mailboxes; messages you send us are stored there.
• Facebook and LinkedIn: the site contains plain links to our pages, with no social buttons, widgets or pixels. If you follow a link, Meta’s and LinkedIn’s privacy policies apply.

5. Data transfers

The controller is based in the United Kingdom, which benefits from a European Commission adequacy decision. Hosting is in Switzerland, which both the EU and the UK recognise as adequate. Cloudflare, Google and Anthropic may process data in the United States: these transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension where the provider is certified, or otherwise on the standard contractual clauses included in the provider’s terms.

6. How long we keep data

• Browsing data: for the short periods set by our providers for technical and security purposes.
• Emails and enquiries that do not lead to a contract: up to 24 months from the last contact.
• Contract, accounting and tax data: for the period required by UK law, normally six years from the end of the financial year they relate to.
• Data needed to establish or defend legal claims: until the claim is resolved.

7. Google account data: the “Claude Gmail Alberto” app

Roimaxweb Ltd has registered an OAuth application on Google Cloud, “Claude Gmail Alberto”, which members of the Roimaxweb team use to connect their own Gmail accounts to an AI assistant (Claude, developed by Anthropic) running on their own computers. The application is not offered to the public: it is used only by Roimaxweb staff, on their own accounts.

• Data accessed. With the explicit permission of the account owner, given on Google’s consent screen, the application accesses the Gmail account’s messages, labels and drafts, limited to the scopes shown on that screen.
• How it is used. Only to do what the account owner asks: search and read messages, summarise them, organise them with labels and prepare drafts. A message is sent only on the owner’s explicit instruction.
• Where it is kept. Access tokens stay on the account owner’s computer. Email content is not copied to Roimaxweb servers. The parts needed to answer a request are sent to Anthropic, which provides the Claude model, solely to process that request; Anthropic does not use them to train its models.
• What we do not do. We do not sell or transfer Google user data to anyone, we do not use it for advertising, and we do not use it to develop, improve or train generalised AI or machine learning models. No one reads it other than the account owner, unless the owner asks, it is needed for security purposes, or the law requires it.
• Limited Use. The use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking access. The account owner can revoke access at any time at https://myaccount.google.com/permissions; from then on, the tokens stored on their computer no longer work and can be deleted.

8. Cookie policy

roimaxweb.com does not set profiling, analytics or third-party cookies and does not use other technologies (pixels, fingerprinting) to track visitors. That is why it shows no consent banner.

The only tools present are strictly necessary and do not require consent:

• if Cloudflare detects suspicious traffic, it may set security cookies (for example __cf_bm or cf_clearance) used only to tell people apart from bots;
• WordPress stores a note about emoji support in your browser’s session storage; it contains no personal data and is deleted when you close the tab;
• people who log in to the site’s admin area receive WordPress login cookies.

You can delete or block cookies at any time in your browser settings.

9. Your rights

You can ask at any time to access, rectify or erase your data, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. Just write to [email protected]: we reply within one month.

If you believe the processing breaches data protection law, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or to the authority in your country; in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

10. Children

The site is aimed at businesses and professionals. We do not knowingly collect data from anyone under 18; if we find we have received such data, we delete it.

11. Changes

We may update this policy. The date of the last change is shown at the top of the page.