Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (“Privacy Code”).
Last updated: October 26, 2026
This notice describes how Management Excellence Tools MET srl processes the personal data of users who visit the www.met.it website (the “Site”) and of those who contact us through the channels indicated on the Site. This notice applies only to this Site and not to other websites that may be reached through links.
1. Data Controller
Management Excellence Tools MET srl
Via G. Mengoni 4 – 20121 Milano (MI), Italy
Tax Code and VAT No. 10209860153 – REA of Milano 1356319
- Telephone: +39 02 87369 200
- Email: info@met.it
- Certified email (PEC): info@pec.met.it
For any request concerning the processing of personal data, you can write to privacy@met.it.
Contact person for data protection matters: Michele Bollini – privacy@met.it
The Controller is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR.
2. Types of data processed
2.1 Browsing data
During normal operation, the computer systems and software procedures that run the Site acquire certain data whose transmission is implicit in the use of Internet communication protocols: for example IP addresses, browser type and operating system, URLs of the requested resources, time of the request, server response code and other technical parameters.
This data is used only to obtain anonymous statistical information on the use of the Site, to check that it is working correctly and to establish liability in the event of computer crimes against the Site.
2.2 Data provided voluntarily by the user
When the user fills in the form on the Let’s talk page, or writes to us by email or calls us, we collect the data they provide, for example:
- identification and contact data (first name, last name, company, role, email address, telephone number);
- project information (area of interest, solutions already in use, decision timelines, notes), which the user may provide optionally.
We ask you not to include in your messages data belonging to special categories (Article 9 GDPR), such as health data, or data of third parties without being entitled to do so.
2.3 Cookies and tracking tools
The Site does not use cookies or other tracking tools. See section 9. Cookies for more details.
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Responding to requests for information and contact, and organizing in-depth meetings (on MS Teams or at our offices) | Performance of pre-contractual measures taken at the data subject’s request (Article 6.1.b GDPR) |
| Managing any contractual relationship (consulting, solutions, training) and the related obligations | Performance of a contract (Article 6.1.b GDPR) |
| Complying with legal obligations (tax, accounting, requests from authorities) | Legal obligation (Article 6.1.c GDPR) |
| Ensuring the security and correct operation of the Site and preventing abuse and fraud | Legitimate interest of the Controller (Article 6.1.f GDPR) |
| Establishing, exercising or defending a legal claim | Legitimate interest of the Controller (Article 6.1.f GDPR) |
| Sending invitations to events, trade fairs and webinars organized by MET or in which MET takes part, only to those who have given consent through the dedicated optional checkbox on the form | Consent of the data subject (Article 6.1.a GDPR), which can be withdrawn at any time |
Providing the data marked as mandatory on the contact form is necessary to respond to the request; failure to provide it makes it impossible to follow up on the request. Providing optional data is voluntary, as is consent to receive event invitations: if it is not given, the request will still be answered. Consent can be withdrawn at any time by writing to privacy@met.it or through the link in each invitation.
4. Processing methods and security
Data is processed with IT tools and, where necessary, on paper, using logic strictly related to the stated purposes. The Controller adopts appropriate technical and organizational measures to prevent data loss, unlawful or incorrect use and unauthorized access.
Data sent through the contact form travels over an encrypted connection (HTTPS). It is stored temporarily in a protected archive on the server hosting the Site, not accessible from the web, only until it is transferred to the Controller’s management system, after which it is deleted from the server. The management system is a protected database hosted on a dedicated hosting service (fmcloud.fm) with servers in Italy, with access restricted to authorized personnel.
No automated decision-making, including profiling, is carried out within the meaning of Article 22 GDPR.
5. Data recipients
Data may be processed by the Controller’s authorized personnel and disclosed, within the limits necessary, to parties acting as data processors under Article 28 GDPR, including:
- Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, VAT No. 01573850516, provider of the Site’s hosting, limited to browsing data and the temporary storage of data sent through the contact form, until it is transferred to the management system;
- the provider of the cloud platform hosting the Controller’s management system (1-more-thing Group, Avenue Legrand 80, 1050 Brussels, Belgium, VAT No. BE0631700523, fmcloud.fm service);
- Microsoft Ireland Operations Limited, provider of the Microsoft 365 infrastructure, used for email, document storage, collaboration, video conferencing (Microsoft Teams) and the Microsoft 365 Copilot assistant;
- Anthropic Ireland, Limited, Dublin (Ireland), provider of artificial intelligence services (Claude API), used to process email communications and draft meeting summaries and minutes;
- IP Telecom Bulgaria LTD (Zadarma), 16 Vasil Levski Blvd., Office 211, 8000 Burgas, Bulgaria, provider of the VoIP telephone service and virtual switchboard, with data stored in the European Union;
- SMTP2GO, New Zealand, provider of the service for sending event invitation emails, through its European servers;
- tax and accounting consultants.
Data may also be disclosed, as independent controllers, to legal advisors and to the competent authorities when required by law. Personal data is not disseminated or sold to third parties.
The updated list of data processors can be requested from the Controller at the contact details in section 1.
6. Data transfers outside the European Union
The Site is hosted on Aruba servers in Italy. Data sent through the contact form and stored in the Controller’s management system also resides in Italy, on servers hosted in the Aruba data center. This data is not transferred outside the European Union.
Other data, managed through Microsoft 365 (email, documents, Microsoft Teams, Microsoft 365 Copilot), is stored by Microsoft in data centers located in the European Union, the data location configured for all the Microsoft 365 services used by the Controller. However, Microsoft may process some data outside the European Economic Area, for example in the United States, in limited cases such as technical support and security activities.
Data processed through Anthropic’s artificial intelligence services (email communications, meeting summaries and minutes) may be processed outside the European Economic Area, in particular in the United States.
Event invitations are sent through SMTP2GO, a company based in New Zealand, a country for which the European Commission has adopted an adequacy decision (Decision 2013/65/EU).
In all cases of transfer outside the EU, the transfer takes place only to countries covered by an adequacy decision of the European Commission (including, for the United States, the EU-U.S. Data Privacy Framework for certified entities) or on the basis of other appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission (Articles 45-46 GDPR).
7. Retention period
| Type of data | Retention period |
|---|---|
| Browsing data (server logs) | Up to 12 months, unless needed to establish crimes |
| Contact form requests on the Site’s server | Until transfer to the management system, then deleted |
| Contact requests not followed by a contractual relationship | 24 months from the last contact |
| Data relating to contractual relationships | 10 years from the end of the relationship, as required by civil and tax law |
| Data processed to send event invitations (based on consent) | Until consent is withdrawn and in any case no longer than 24 months from the last interaction |
After these periods, data is deleted or anonymized.
8. Rights of the data subject
At any time, the data subject may exercise the rights provided for by Articles 15-22 GDPR against the Controller:
- access to their personal data;
- rectification of inaccurate or incomplete data;
- erasure of data (“right to be forgotten”), in the cases provided for;
- restriction of processing;
- portability of the data provided, in a structured, commonly used format;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests can be sent to privacy@met.it or by certified email (PEC) to info@pec.met.it. The Controller will respond without undue delay and in any case within one month of receiving the request.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it) or with the supervisory authority of the Member State where they reside or work.
9. Cookies
The Site does not use cookies, whether technical, analytical or profiling, and does not use other tracking tools (pixels, local storage, fingerprinting and the like). For this reason, no consent banner is displayed.
The Site contains simple links to MET’s profiles on LinkedIn, GitHub, Facebook, X (Twitter) and YouTube. These links do not install cookies while browsing www.met.it. By clicking them, the user accesses third-party sites, which apply their own privacy and cookie policies, over which the Controller has no control.
10. Changes to this notice
The Controller reserves the right to change or update this notice, including following changes in legislation or in the services offered. Changes will be published on this page with the date of the last update. Users are invited to consult it periodically.