Personal data

Privacy policy

What personal data the strategic.sm website collects, why, for how long, which providers we entrust it to and how you can exercise your rights.

Your rights and how to exercise them Write to us about your data

No profiling: no advertising or tracking cookies
AI assistants that say so: on WhatsApp an AI assistant replies, and tells you it is one
Statistics without cookies: truncated IP address, no external service

Last updated: 13 October 2026

This English version is provided for convenience. If it differs from the Italian version, the Italian version prevails.

1. Who the data controller is

The data controller is Strategic S.r.l., with its registered office at Via Corrado Forti 64, 47894 Chiesanuova, Republic of San Marino, economic operator code (COE) SM31552.

For any question about this policy or about your data, you can use the form on the Contact page and choose ‘Other’.

2. What data we process

When you visit the site

The site is hosted on Cloudflare. To display the pages and protect them from attacks, Cloudflare processes technical connection data: the IP address, the browser type, the pages requested, and the date and time.

The site also keeps two logs that do not identify visitors. The first records the addresses of pages not found, with the page the visitor came from, so that broken links can be fixed. The second counts certain actions (sending the form, clicking on WhatsApp, printing a page, opening the chat), recording only the page and the date.

Visit statistics

To understand which pages are useful and where visitors come from, the site uses its own statistics system, which runs on the same servers as the site. It uses no cookies, stores no data in the browser and relies on no external analytics or advertising service.

When you open a page, your browser sends the address and title of the page, the site you came from (for example a search engine), any campaign parameters in the link, the screen size, the browser language and whether the screen is a touchscreen (used only to tell a tablet from a computer). While you read and when you leave, it sends how long the page stayed in the foreground and how far it was scrolled. From the connection, the site derives the approximate country, region, city and postcode, with an indicative location for the city. These belong to the network provider, not to the visitor’s address. The site also derives the name of the network used to connect (the operator or, for organisations with their own network, the organisation) and, from the browser, the type of device, the browser and the operating system.

The IP address is never stored in full. Only the part that identifies the network is kept. For IPv4 addresses the last number is set to zero (for example 203.0.113.0), and for IPv6 addresses only the first three blocks are kept. To count distinct visitors in a day, the site calculates a code from the IP address, the browser, a secret key that is not stored with the statistics, and a random key that changes every day and is then deleted. This shows that two pages were viewed by the same person on the same day. It does not allow a visitor to be recognised on later days, nor the IP address to be worked out from the code. This data is not combined with other information and is not used to profile anyone.

Detailed data is kept for 13 months and then deleted automatically. Aggregated daily summaries are kept for 25 months. They contain no IP addresses or visitor codes, but they record, day by day, the number of visits by page, by referring site, by country, region and city (with the city’s indicative location) and by network, including the names of organisations that have their own network. Bots, visits from data centres (for example spam filters that open the links in emails) and the people who manage the site are not counted.

When you write through the contact form

We collect your first name and surname, email address, organisation, the area you choose, the timing and size you indicate, the text of your request, the page it was sent from and, if you provide them, your phone number and how you prefer to be contacted. Each request is given a sequential number. The data is saved in the site’s system and sent by email to the people who need to reply.

To block automated submissions and abuse, the site uses an encrypted, non-reversible version of the IP address. The IP address is not stored in readable form.

Please do not enter confidential documents, passwords, health data or other people’s data in the form.

The site chat

In the site chat, answers come from Maxim, an assistant based on artificial intelligence, which is declared as such. It answers questions about Strategic’s work on the basis of the published pages and, if you ask, prepares a request for Strategic’s staff to contact you.

We process the text of the messages, the page from which the chat is opened, the date and time and, if you provide them, your name, organisation, contact details and a description of your request. For the security of the chat and to prevent abuse, we also keep the IP address of the connection, together with the country and the network it comes from. They are used to recognise and block anyone who tries to manipulate the assistant or uses it automatically. These three items are deleted automatically 180 days after the last message. An address blocked for abuse stays on the block list for as long as the block lasts and for 180 days afterwards. The chat works without cookies. Only after you open it does the browser keep, for as long as the tab stays open, a random code that lets you find the conversation again when you change page.

To generate the answers, the text of the conversation is sent to the provider of the artificial intelligence model, OpenAI, which processes it on our behalf under its own commercial terms. Messages that clearly try to get round the assistant’s instructions receive an automatic reply and are not sent to the provider. Conversations are kept for 12 months from the last message and then deleted automatically. When a request is recorded in the chat, it follows the rules of the contact form and reaches Strategic’s staff by email, with an excerpt of the conversation.

Please do not enter confidential documents, passwords, health data or other people’s data in the chat. The assistant’s answers may contain errors. Only the content of the pages and communications from Strategic’s staff are authoritative. The assistant does not take decisions that produce legal effects on people. To ask for a conversation to be deleted, write through the contact form and give the approximate day and time.

When you write on WhatsApp

On Strategic’s WhatsApp number, answers come from an assistant based on artificial intelligence. We process your phone number, your WhatsApp profile name and the content of your messages, in order to generate replies and, where needed, to get back to you. Messages pass through the systems that manage the replies and through the providers of the artificial intelligence models that generate them. WhatsApp is a Meta service, and Meta processes data as an independent controller under its own privacy policy.

Emails

The site’s emails, such as request notifications, are sent through smtp.com, which processes the address and the content only to deliver them. Email for strategic.sm is managed by an email service provider, which processes messages on our behalf. We do not use data for newsletters or promotional communications without specific consent.

Job applications

If you apply through the contact form by choosing ‘Other’, you send us your name, contact details, the role you are interested in and any information you choose to share. A CV is sent only if we ask for it. Do not include health data or other special categories of personal data. Applications are read only by the Strategic staff who handle them.

Clients and suppliers

For contact persons at clients and suppliers, we process contact details and the data needed to manage contracts, projects and invoicing.

The Client area page

The page contains only links to external tools (Strategic Remote, DIREKTA, Kristina Reply), each with its own privacy policy. No credentials are entered on the site.

3. Why and for how long

We process data only for the purposes stated and only for as long as necessary. Where the law sets a period, that period applies.

Purpose	Legal basis	How long
Replying to requests sent through the contact form	Steps taken at the data subject’s request before entering into a contract. Consent given in the form.	Up to 24 months from the last exchange if no relationship follows. Otherwise, for the duration of the relationship.
Preventing automated submissions and abuse of the form	Legitimate interest in the security of the site	Together with the request they relate to. Temporary counters are deleted when they expire.
Replying in the chat with the AI assistant and, on request, preparing a call-back	Steps taken at the data subject’s request before entering into a contract. Legitimate interest in the security of the site, for the counters.	12 months from the last message. Recorded requests are kept like those from the contact form.
Chat security and abuse prevention (IP address, country and network of the connection; blocking addresses that attack the assistant)	Legitimate interest in the security of the site and in preventing abuse	180 days from the last message. Blocked addresses for as long as the block lasts and for 180 days afterwards.
Replying on WhatsApp with the AI assistant	Steps taken at the data subject’s request before entering into a contract	12 months from the last message
Assessing job applications	Steps taken at the data subject’s request before entering into a contract	12 months from submission
Managing contracts, projects and invoicing	Performance of a contract. Compliance with legal obligations.	The duration of the relationship and the periods set by tax and accounting rules
Displaying the site and protecting it	Legitimate interest in the operation and security of the site	The provider’s technical retention periods
Visit statistics without cookies, with a truncated IP address	Legitimate interest in understanding how the site is used and improving it	Detailed data for 13 months. Aggregated daily summaries (including by network and city) for 25 months.

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Who we entrust your data to

Data is processed by authorised Strategic staff who are bound by confidentiality. For some services we rely on providers that process data on our behalf as processors:

Cloudflare, for hosting the site, storing data (including visit statistics) and protection
smtp.com, for sending the site’s emails
the provider of email services for strategic.sm
the providers of the artificial intelligence models and of the servers used by the systems that reply on WhatsApp
OpenAI, for the artificial intelligence model of the site chat
tax, legal and technical advisers, where needed to meet legal obligations or to protect Strategic’s rights

WhatsApp (Meta) processes conversation data as an independent controller. Data may be disclosed to the authorities where the law requires it. We do not sell or transfer personal data to third parties for commercial purposes.

5. Transfers outside the European Union

Strategic is based in the Republic of San Marino. Some providers, including Cloudflare, smtp.com, OpenAI and Meta, belong to groups based in the United States and may also process data outside the European Union. In these cases the transfer takes place with the safeguards provided for by law. These are the European Commission’s adequacy decision for companies that participate in the EU-US Data Privacy Framework, or the standard contractual clauses approved by the Commission.

7. Assistants based on artificial intelligence

On WhatsApp and in the site chat, answers come from an assistant based on artificial intelligence, which is declared as such. Please note the following.

Answers are generated automatically and may contain inaccuracies. For important decisions, only what a person at Strategic has written counts.
The assistant does not take decisions that produce legal effects on people.
Do not send passwords, payment details, health data or confidential information about your systems.
You can ask to speak to a person at any time by writing through the contact form.

How Strategic uses artificial intelligence in its own work is explained on a dedicated page.

8. How we protect data

Pages travel only over encrypted connections. The site’s management area is restricted to authorised people, with protected access. We collect only the data we need. For example, the site does not load advertising scripts and the IP address is not stored in readable form, except in the chat, for 180 days and only to prevent abuse. The site’s security measures are described on the Cybersecurity page.

9. Your rights and how to exercise them

At any time you can ask:

to know whether we process data about you, and to receive a copy of it
to have it corrected or completed
to have it erased, where no legal obligation requires us to keep it
to restrict its processing
to receive it in a commonly used format, so that you can pass it on to another controller
to object to processing based on legitimate interest
to withdraw any consent you have given

To exercise your rights, write through the contact form and choose ‘Other’. We reply within one month, a period that can be extended only in the cases provided for by law. To protect your data, we may ask you to confirm your identity.

10. Applicable law and complaints

Strategic processes data in accordance with Law No. 171 of 21 December 2018 of the Republic of San Marino (Legge 21 dicembre 2018, n. 171) on the protection of natural persons with regard to the processing of personal data. For people in the European Union, Regulation (EU) 2016/679 (GDPR) also applies.

If you believe that the processing of your data breaches the law, you can lodge a complaint with the San Marino Data Protection Authority. Alternatively, if you are in the European Union, you can lodge it with the supervisory authority of the country where you live or work. In Italy, this is the Italian Data Protection Authority (Garante).

11. Changes to this policy

This policy is updated when the site’s services, its providers or the law change. The date of the last update is at the top of the page.