Skip to content

Privacy Policy

This page describes how we handle user personal data. Content being updated.

Data Controller

Arenia
Email: info@arenia.it
Phone: +39 378 416 1966

Data Collection

We collect personal data that you provide when requesting a demo or contacting us, including:

Purpose of Processing

Your data is processed to:

Third-party recipients

We do not sell, rent or publish your personal data. It may be disclosed to the following providers, acting as processors under Art. 28 GDPR:

Both providers declare that transfers outside the EU/EEA are covered by safeguards including the European Commission's Standard Contractual Clauses. We report here what is technically in place; we make no independent assessment of the adequacy of those transfers.

Your Rights

You have the right to access, rectify, delete, or limit the processing of your personal data. To exercise these rights, contact us at info@arenia.it.

Cookies & Analytics

The only analytics/measurement tool installed on www.arenia.it is Google Analytics 4 (measurement ID G-M3GXBX3J1L), loaded directly via gtag.js. No Google Tag Manager container is active on this site. This does not mean GA4 is the only third-party component the pages load: the other components actually present — which do not measure user behaviour but still cause a request to an external server — are described under "Other third-party components" below.

The site uses Google Consent Mode v2 in "basic" mode. At the beginning of every visit all consent signals are set to denied: analytics_storage, ad_storage, ad_user_data, ad_personalization. In this configuration no measurement script is loaded before explicit consent — not even a cookieless ping.

Consent is therefore strictly opt-in: the Google Analytics script is requested only after you enable the analytics category in the cookie banner. The banner offers three options: Accept all, Necessary only, or Customise to enable or disable each category individually.

The advertising signals ad_storage, ad_user_data and ad_personalization remain denied at all times, even with full consent: the site carries no advertising pixel, no remarketing tool and no Meta, LinkedIn or TikTok pixel.

IP addresses. In Google Analytics 4, IP addresses are not logged in the property data and are not available in reports: the IP is received and truncated on Google's servers, and this behaviour is not configurable from the tag installed on the site. The anonymize_ip parameter belonged to the previous Universal Analytics generation and has no effect in GA4, which is why it is not present in our code.

What is sent to Google. The custom events defined by Arenia (form submission, CTA click, email or phone click, video start) carry only parameters from a closed allow-list of technical fields: form name, page path, CTA position and source, lead type, target path, link text, file name and type, video title. Any other parameter is discarded before sending, values are truncated, and the page path we put in these events never contains the URL query string.

That allow-list, however, covers only the additional parameters we define — not the whole payload sent to Google. Every GA4 hit also carries fields collected automatically by Google's library, including a pseudonymous client and session identifier, the page title, the referring site, the browser language, the screen resolution and user-agent / client-hints information.

In particular the page_view event, generated automatically by Google Analytics when the tag is configured, transmits the full URL of the page visited, query string included: this is how campaigns are attributed (utm_*, gclid, ?source= parameters). We never put personal data in the query string of our own internal links; if, however, you reach the site through a link published by a third party that carries extra parameters, those parameters are part of the URL sent to Google. The value of ?source= is additionally used in our custom events only when it is a short alphanumeric label, and is discarded otherwise.

Your choice is stored for 12 months; after that it is deleted automatically and the banner is shown again. The preference is saved in the browser's localStorage (key arenia-consent-v2) and is not a cookie.

The following cookies are set by Google Analytics only after consent to the analytics category. Without consent, the site sets no measurement cookies:

In addition, the site may use technical session cookies required for the pages and the contact form to work.

You can withdraw your consent at any time: reopen cookie preferences. Withdrawal sets analytics_storage to denied, deletes the _ga, _ga_*, _gid and _gat cookies found on the domain, clears the stored preference and shows the banner again. You may also install the Google Analytics opt-out browser add-on, or block and delete cookies from your browser settings.

Other third-party components (not measurement tools)

Besides Google Analytics, the pages load two components served by third parties. They are not measurement tools and they set no cookies on the arenia.it domain, but they do require a connection to the provider's servers and therefore disclose your IP address and the basic details of the request. These two components are not gated by the choice you make in the cookie banner:

The page head also declares a preconnect to fonts.googleapis.com and fonts.gstatic.com (and, on the home page only, to www.youtube-nocookie.com). Its purpose is purely performance-related — opening the network connection in advance — but this contact too makes your IP address known to the provider, without transmitting any content you supplied.

If you would rather avoid these connections altogether, you can block the domains listed above through your browser settings or extensions: the site remains usable, with system fonts and without the YouTube player.

Note: this section describes the technical implementation actually in place on the site at the date of last update (Consent Mode v2 basic, GA4 G-M3GXBX3J1L, no advertising tags, Google Fonts on every page, no-cookie YouTube player on two pages after a click). It was drafted on a technical basis and is still to be validated legally; third-party cookie names and durations may change if the provider changes them.

Data Security

We implement appropriate technical and organizational measures to protect your personal data. The website and the server-side endpoint that receives the contact form are hosted in the EU, and all traffic is served over HTTPS.

This does not mean every piece of data stays within the EU/EEA: as set out under "Third-party recipients", some processing involves providers established in the United States — Google LLC for analytics, fonts and the video player, and Formspree Inc. when the form fallback is triggered. Those transfers rely on the safeguards declared by each provider.

Last updated: July 2026