Privacy · Celebron and Sinapsi
Privacy notice
How Celebron S.r.l. processes the personal data of people who visit the site, write to us, work with us or use Sinapsi, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree no. 196 of 30 June 2003.
Last updated: 19 October 2026 · Translation for convenience: the Italian text prevails
1Who processes the data
The controller is Celebron S.r.l., Via Roggia Guidana 4, 24126 Bergamo, Italy, tax code and VAT no. 03995290164. For any privacy request write to info@celebron.it or to the certified email celebronsrlbg@legalmail.it, with «Privacy» in the subject.
Celebron has not appointed a data protection officer (DPO), because the conditions of Article 37 GDPR do not currently apply. It will consider an appointment as the Sinapsi service grows and will publish the contact details here.
2Who this notice is for
- people who visit celebron.it;
- people who contact us by email, certified email, telephone, LinkedIn or at events;
- contacts at clients, prospective clients, partners and suppliers;
- authorised users of the Sinapsi dashboard and app;
- people who send documents to sinapsi@celebron.it;
- people who receive our updates.
For personal data contained in the documents that client companies entrust to Sinapsi, Celebron acts on behalf of the company: see section 5.
3What data we process, why and for how long
| Why | What data | Legal basis | How long |
|---|---|---|---|
| Running and protecting the site | technical browsing data: IP address, browser, pages requested, date and time | legitimate interest in security and operation (Art. 6(1)(f)) | up to 6 months, unless needed to investigate abuse or computer crime |
| Replying to people who write to us | name, organisation, role, contact details, content of the request | pre-contractual steps requested by the data subject and legitimate interest in replying (Art. 6(1)(b) and (f)) | 24 months from the last contact, if no engagement follows |
| Managing engagements, contracts and supplies | data of client and supplier contacts, invoicing and payment data; for Sinapsi fee charges, IBAN and SEPA mandate or card type and last digits: full card numbers are held only by the payment service provider | performance of the contract and legal obligations (Art. 6(1)(b) and (c)) | for the duration of the relationship and then 10 years, as the law requires for accounting records (Art. 2220 Italian Civil Code) |
| Giving access to the Sinapsi dashboard and app | name, email, telephone, role, access codes, access and activity logs | performance of the contract and legitimate interest in security (Art. 6(1)(b) and (f)) | for the duration of the contract; access logs 12 months |
| Receiving documents at sinapsi@celebron.it | sender address and name, client code, date, subject, body and attachments | performance of the contract with the client company and legitimate interest in checking that the sender is authorised (Art. 6(1)(b) and (f)) | message data for the duration of the contract; attachments as set out in section 5 |
| Sending updates, invitations and market analyses | email, name, organisation | consent (Art. 6(1)(a)), which may be withdrawn at any time; for clients, legitimate interest for similar services (Art. 130(4) Italian Privacy Code), with the right to object | until withdrawal or objection |
| Meeting anti-money-laundering obligations | identification data and identity documents of the client company’s representatives and beneficial owners, offices held, information on the purpose and nature of the service, outcome of the checks | legal obligation (Art. 6(1)(c)): Italian Legislative Decree no. 231 of 21 November 2007 | 10 years from the end of the relationship (Art. 31 of Legislative Decree 231/2007) |
| Complying with the law and defending our rights | the data needed for the case | legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | for the periods set by law or until the end of any dispute and the limitation periods |
We do not use data for advertising profiling and we do not sell it.
4Whether the data are mandatory
Data needed to reply, to conclude and perform a contract or to comply with the law are essential: without them we cannot follow up the request or provide the service. Consent to updates is optional and refusing it has no consequences.
5Client data processed in Sinapsi
Client companies entrust Sinapsi with financial, tax and corporate information: invoices, bank movements, financial statements, contracts, credit data, payslips, judicial and tax documents. These documents often contain data about people, such as shareholders, directors, guarantors, employees, customers, suppliers and counterparties, and sometimes special categories of data, such as health data appearing in payslips.
For these data the controller is the client company; Celebron processes them as processor under Article 28 GDPR, only to provide the service and in accordance with the Data Processing Agreement, which forms part of the contract. Anyone wishing to exercise their rights over these data should contact the company; if the request reaches Celebron, we forward it to the company without delay.
Criminal proceedings are excluded from Sinapsi: we ask companies not to send us criminal documents and, if we receive them by mistake, we delete them and inform the company.
6Where the data are kept and how we protect them
The management, control and custody of the data are Celebron’s responsibility. We keep them on protected servers of a leading cloud provider, such as Amazon Web Services, managed by the provider itself or by one of its official partners, with data centres in the European Union, ISO/IEC 27001 certification and a data processing agreement under Article 28 of Regulation (EU) 2016/679.
The main measures: encryption of data in transit and at rest; access reserved to authorised staff, with personal credentials, multi-factor authentication and an activity log; each company’s data kept separate from the others; encrypted backups; periodic checks; a procedure for handling and notifying data breaches within the legal deadlines. As the number of clients grows, Celebron scales storage, servers and security measures, keeping these safeguards.
The mailbox sinapsi@celebron.it is only a transit point: documents received are moved into the protected environment and removed from the mailbox within thirty days.
7Artificial intelligence
Sinapsi uses artificial intelligence systems to read documents, link them, make forecasts and propose actions; the Celebron team checks and signs, and decisions remain with the company. We take no decisions based solely on automated processing that produce legal effects on individuals (Article 22 GDPR) and we do not use the data to train third-party artificial intelligence models. Details are on the page How we use artificial intelligence.
8Who the data may be disclosed to
- authorised Celebron staff and collaborators bound by confidentiality;
- providers that process data on our behalf as processors: cloud and storage services, email, website, artificial intelligence models, administrative software; the list of Sinapsi providers is in the Data Processing Agreement;
- the payment service provider that handles Sinapsi fee charges (Stripe), for collections, fraud prevention and the legal obligations that apply to it;
- professionals who work with us or for the client, such as accountants, lawyers and tax advisers, only when needed for the engagement and, for Sinapsi, only on the client company’s instructions;
- public authorities, when required by law, including the Italian Financial Intelligence Unit (UIF) for anti-money-laundering reports.
The data are not published or sold. Outside these cases Celebron does not disclose them to banks, guarantee consortia (confidi), associations or other third parties and does not give them access to the dashboard: if the client company so wishes, it hands over the documents it chooses itself, as sealed PDFs.
9Transfers outside the European Union
The data are stored in the European Union. Some providers, in particular of artificial intelligence models and payment services, may process them outside the European Economic Area: in such cases the transfer takes place only with the safeguards of Articles 44–49 GDPR, such as an adequacy decision (for the United States, the EU-U.S. Data Privacy Framework) or the European Commission’s standard contractual clauses, with supplementary measures where needed. A copy of the safeguards may be requested from info@celebron.it.
10Your rights
At any time you may:
- access your data and obtain a copy;
- rectify them;
- erase them;
- restrict their processing;
- receive them in a structured format and transmit them to another controller (portability);
- object to processing based on legitimate interest and, always, to updates;
- withdraw consent, without affecting earlier processing.
We reply within one month, extendable by two months in complex cases (Article 12 GDPR). You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
For data processed to meet anti-money-laundering obligations, these rights may be restricted where exercising them would prejudice those obligations (Article 2-undecies(1)(a) of Italian Legislative Decree 196/2003).
11Minors
Celebron’s site and services are aimed at businesses and professionals and are not intended for people under 18.
12Changes to this notice
We may update this notice for changes in the law or in our services. The date at the top shows the latest version; we inform clients of significant changes by email.