Cookie Policy

Cookie Policy

IndustryUX Platform — Cookies and similar tracking technologies

This Cookie Policy explains which cookies and similar tracking technologies are stored on, or read from, the terminal equipment of visitors and users of the IndustryUX platform operated by the Provider (DevIBrain), for which purposes, for how long, on which legal basis, and how any person may accept, refuse or later change those choices at any time and free of charge. It is issued under Article 13 of Regulation (EU) 2016/679 (GDPR) and Article 122(1) of Legislative Decree no. 196/2003 (the Italian Personal Data Protection Code), which implements Article 5(3) of Directive 2002/58/EC, and it applies the Guidelines on cookies and other tracking tools adopted by the Italian Data Protection Authority (Garante per la protezione dei dati personali) with decision no. 231 of 10 June 2021, published in Gazzetta Ufficiale no. 163 of 9 July 2021 and applicable since 10 January 2022, as further specified by the same Authority in its decision of 27 February 2025 (web doc. no. 10118222).

Art. 1 — Purpose and scope

1.1 Environments covered

This Cookie Policy applies to the web properties operated by the Provider under the industryux.com domain and, in particular, to: the public website and the online shop published at www.industryux.com; the authenticated customer areas of that website, including the account, the subscription pages, the token wallet, the order history and the support pages; the sign-up, checkout and payment flows; and the web interfaces through which the Provider publishes subscription, licence and workspace management functions to its customers.

1.2 Relationship with the Privacy Policy and with the Data Processing Agreement

This document is the section dedicated to cookies of the information provided to data subjects under Articles 13 and 14 GDPR. For everything that does not concern the storing of, or the access to, information in the terminal equipment — categories of personal data, purposes, recipients, retention periods, rights and remedies in their full extent — the IndustryUX Privacy Policy applies, and the two documents are to be read together. Where the Provider processes personal data on behalf of a business customer in the provision of the platform, the relationship is governed by the IndustryUX Data Processing Agreement, and not by this Cookie Policy.

1.3 Customer environments: tenants, workspaces and applications

Workspaces and tenant environments provisioned for a customer on dedicated subdomains, and the industrial applications delivered inside them, use only the strictly necessary technical cookies described in Article 5 for authentication and session continuity. No advertising, profiling or cross-site tracking technology is installed by the Provider in those environments, and no static resource is loaded there from an external content delivery network. In such environments the customer is the controller of the content and of the personal data processed through the applications, and the Provider acts as processor under the Data Processing Agreement; consequently, any information notice or consent required towards the customer's own operators, employees or end users is the responsibility of the customer.

Art. 2 — Data controller and contact points

The controller of the personal data processed through the technologies described in this document is the Provider, DEVIBRAIN S.R.L., with registered office at Via Coghetti 6, 24128 Bergamo (BG), Italy, VAT number IT04507220160, certified electronic mail devibrain@pec.it, electronic mail support@devibrain.com.

Requests concerning cookies, consent choices and the exercise of the rights described in Article 14 are addressed to the electronic mail address indicated above. The Provider has not appointed a Data Protection Officer, the conditions set out in Article 37(1) GDPR not being met by its processing activities; should a Data Protection Officer be appointed, this document will be updated and the relevant contact details published before the appointment takes effect.

Art. 3 — What cookies and similar technologies are

3.1 Cookies

A cookie is a small text file that a website asks the browser to store on the terminal equipment of the visitor and that the browser sends back to the server on subsequent requests. A cookie is described as a first-party cookie when it belongs to the domain the user is visiting, and as a third-party cookie when it belongs to a different domain. A cookie is described as a session cookie when the browser deletes it as soon as it is closed, and as a persistent cookie when it survives until the expiry set by the sender or until the user deletes it.

3.2 Similar technologies

The same legal regime applies to any technique that stores information in, or gains access to information already stored in, the terminal equipment of the user, irrespective of the technology employed. This includes web storage in its persistent and session forms, tracking pixels and web beacons, software development kits embedded in mobile or desktop clients, unique identifiers written in the browser, and device fingerprinting techniques that derive a stable identifier from the configuration of the terminal. Throughout this document the word "cookie" is therefore used as a shorthand for cookies and for all such technologies, and the classification set out in Article 4 depends on the purpose pursued, never on the technical means used to pursue it.

Art. 4 — Categories of cookies and legal basis

4.1 Technical cookies

Technical cookies are those used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or strictly necessary to provide a service explicitly requested by the user. They cover navigation and session cookies, functionality cookies that store a preference expressed by the user such as the language or the time zone, and security cookies that protect the session against forgery and hijacking. Under Article 122(1) of the Italian Personal Data Protection Code they may be installed without consent; the underlying processing of personal data rests on Article 6(1)(b) GDPR, where it is necessary to perform the contract or to take steps at the request of the user before entering into it, and on Article 6(1)(f) GDPR for the security of the network and of the service.

4.2 First-party audience measurement assimilated to technical cookies

Audience measurement tools are treated as technical cookies, and therefore installed without consent, only where all of the following conditions are satisfied at the same time: the tool is used exclusively to produce aggregate statistics; it is operated directly by the operator of the website, without a third-party analytics provider; the internet protocol address is minimised before storage by masking at least its fourth and last component; the data collected is not combined with other processing operations and is not transmitted to third parties; and no cross-site tracking of the user is performed. Where any one of these conditions ceases to be satisfied, the tool is reclassified as a profiling tool under Article 4.3, is moved into a consent-gated category and is activated only after prior consent has been collected.

4.3 Profiling and marketing cookies

Profiling cookies are those used to observe the behaviour of the user over time or across websites in order to build a profile, to select advertising, to measure advertising campaigns or to enrich data held by third parties. They require prior, free, specific, informed and unambiguous consent under Article 122(1) of the Italian Personal Data Protection Code and Articles 6(1)(a) and 7 GDPR. The same requirement applies to any third-party component whose loading causes the terminal of the user to contact a server other than the one of the visited domain.

4.4 Quality of consent

Consent is collected before any non-technical technology is installed or read, is granular for each category, is expressed by an unambiguous affirmative action, may be withdrawn at any moment with the same ease with which it was given, and is recorded so that it can be demonstrated under Article 7(1) GDPR. Continued browsing, scrolling the page, closing the banner, remaining inactive, or the presence of pre-ticked boxes are never treated as consent. Refusing must never require more effort, more clicks or more attention than accepting.

4.5 Summary of the categories

Art. 5 — Technical cookies installed on the platform

5.1 Inventory

The following technologies are installed by the Provider as first-party technologies on the domain visited by the user. All of them fall within Article 4.1 and are installed without consent because the service explicitly requested by the user cannot be provided without them.

5.2 How to read the durations

The durations shown are the maximum values configured by the Provider. A cookie may cease to exist earlier because the user deletes it, because the browser applies its own stricter limit to the lifetime of stored information, or because the browser is closed in the case of session technologies. Persistent cookies whose duration is expressed in months are not renewed indefinitely: at expiry they are removed and, where still necessary, set again.

5.3 Effect of removing technical cookies

Technical cookies cannot be deactivated through the preference centre, because their removal would prevent the service from being provided. They may nevertheless be blocked or deleted through the settings of the browser, with the consequences described in Article 11.4.

Art. 6 — Audience measurement

6.1 How the measurement works

The Provider measures the use of its own website and platform with a first-party component that runs on its own infrastructure and records, on the server, the events generated by the navigation: pages viewed, searches performed, steps completed in the sign-up, order, payment and workspace provisioning flows, and technical errors returned by the application. The component does not write any additional identifier in the terminal equipment: it relies on the technical session cookie already present under Article 5. The address of the terminal is minimised by masking its last component before storage, the information collected is not combined with other processing operations, it is not enriched with data obtained from third parties and it is not transmitted to any third party.

6.2 Purposes and retention

The measurement serves to produce aggregate statistics on the use of the service, to detect and diagnose faults, to size the infrastructure and to understand where users abandon a flow. Events are retained for 14 months, after which they are consolidated into aggregate figures that no longer allow a single visit to be reconstructed, and the underlying records are deleted.

6.3 Classification and its limits

Because every condition of Article 4.2 is satisfied, this measurement is assimilated to a technical cookie and is performed without consent. Should the Provider adopt a third-party analytics tool, cease to mask the address of the terminal, combine the measurement with other processing operations or extend it across different websites, the measurement would be reclassified under Article 4.3, this document would be updated and consent would be requested before the new configuration is activated.

Art. 7 — Profiling, advertising and cross-site tracking

7.1 Position at the date of this version

The IndustryUX platform does not install profiling, advertising, retargeting or cross-site measurement cookies. It contains no advertising network, no tag manager, no social network plug-in, no session-replay tool and no device fingerprinting technique; it does not take part in advertising auctions and does not disclose navigation data to data brokers. Commercial communications, where sent, rest on a separate and specific consent collected at the point where the address is provided, and are never built from a profile derived from navigation.

7.2 If such a technology were introduced

The introduction of any profiling or advertising technology would require, before that technology is installed for the first time: the publication of an updated version of this document identifying the tool, its provider, its purpose, its duration and any transfer outside the European Economic Area; the resetting of the preferences already collected, so that consent is requested again; and the collection of prior consent through the banner described in Article 9. No such technology may be activated on the basis of consent expressed for a different purpose.

Art. 8 — Third-party components and embedded content

8.1 Static resources

Fonts, icons, style sheets, scripts, images and media used by the platform are served by the Provider from its own infrastructure, as set out in Article 10. No external content delivery network is contacted by the browser while a page is being displayed.

8.2 Payment environment

Card and digital payments are executed through the payment service provider used by the Provider, established in Italy. When the user is directed to the payment environment, or a payment component of the provider is displayed, that provider acts as an autonomous controller for the execution of the transaction and for the prevention of fraud, and may install its own cookies on its own domain under its own policy. The Provider neither reads nor controls those cookies, and does not receive from them any information about navigation outside the payment flow.

8.3 Embedded media

Where a page exceptionally embeds a media player published on an external platform, that component is not loaded until consent for the category "third-party embedded content" has been given: in its place a placeholder is displayed which explains the origin of the content and offers to enable it. If consent is given, the external platform may install its own cookies, whose duration is determined by that platform and may reach 24 months, and may in that way become aware of the visit. Consent given for a single component may be withdrawn at any time under Article 11, and the withdrawal restores the placeholder.

8.4 No further third-party technology

Apart from the components described in this Article, no third party stores information in, or gains access to information stored in, the terminal equipment of the user through the web properties covered by this document.

Art. 9 — Consent management: the banner and the preference centre

9.1 Prior blocking

No technology belonging to a consent-gated category is installed, executed or read before consent has been expressed. The scripts of those categories are not run and the third-party resources of those categories are not requested, so that no external server becomes aware of the visit before the user has decided. The banner is displayed on the first visit, on top of the content, and does not prevent the content itself from being read.

9.2 First level of the banner: three commands of equal prominence

The first level of the banner contains a concise notice explaining that cookies and similar technologies are used, which categories exist, what they are used for, and a link to this document and to the Privacy Policy. It offers three commands of identical graphic prominence, presented on the same level, with the same size, the same contrast, the same typography and the same number of clicks required to complete the choice:

• Accept all (in the Italian version, Accetta tutti), which activates every category;

• Reject all (in the Italian version, Rifiuta tutto), which keeps every consent-gated category deactivated;

• Manage preferences (in the Italian version, Gestisci le preferenze), which opens the second level described in Article 9.4.

Accepting and refusing are concluded with a single command each. Neither command is hidden behind a further step, presented in a less visible colour, worded so as to discourage its use, or placed outside the visible area of the banner. The banner can be operated with the keyboard alone and is compatible with assistive technologies.

9.3 Closing the banner without choosing

The closing command, displayed as an "X" in the upper right corner of the banner, closes the banner and leaves the situation unchanged, that is with every consent-gated category deactivated. Closing is recorded as a refusal, never as consent, and installs nothing. The banner is not shown again during the same visit; it is shown again on a later visit in accordance with Article 9.6.

9.4 Second level: the preference centre

The preference centre lists each category separately, with its purpose, the technologies it contains, their duration and, where a third party is involved, the identity of that third party and the country in which it is established. Every consent-gated category is presented deactivated by default, and the strictly necessary category is presented as permanently active and not deactivatable, with an explanation of why. The commands Save preferences, Accept all and Reject all are all available at this level too, again with equal prominence.

9.5 Practices that are excluded

The Provider does not use, and undertakes not to use, any of the following: consent inferred from scrolling the page, from continued navigation or from inactivity; pre-ticked boxes or sliders already set to "active"; a cookie wall, that is, making access to the website, to the shop, to the customer portal or to the platform conditional upon consent to tracking; an asymmetric use of colour, contrast, size or wording designed to steer the choice; the repeated presentation of the banner to a user who has already refused, outside the cases listed in Article 9.6. The authentication gate that protects the areas of the platform not yet open to the public is an access control measure unrelated to tracking, and is in no case conditioned upon consent to cookies.

9.6 Duration of the preferences and when the banner reappears

A choice expressed through the banner or through the preference centre is retained for 6 months from the moment it is expressed; on expiry, the banner is presented again so that the choice may be confirmed or changed. Before expiry, the banner is presented again only where: the user asks for it through the link described in Article 11.1; the conditions of the processing change significantly, in particular where a new purpose, a new category or a new third party is introduced; the cookie or the storage entry recording the choice has been deleted or cannot be read, for instance because the browser has been cleaned, because a different browser or device is being used or because navigation takes place in a private window; or the content of this document changes in a way that affects the scope of the consent already given.

Art. 10 — Self-hosted consent tool and absence of external content delivery networks

10.1 A consent tool served from the same domain

The consent management tool of IndustryUX is a component written in standard JavaScript, developed by the Provider and served from the same domain as the page that displays it. No commercial consent management platform loaded from the content delivery network of a vendor is used.

10.2 Why this choice is mandatory and not merely preferable

Loading any resource from an external content delivery network causes the browser to send the address of the terminal, together with the request headers, to the operator of that network before any choice has been expressed. A consent tool loaded in that way would itself create, at the very first millisecond of the visit, exactly the transfer of data that it is supposed to govern. This is the defect that the Landgericht München I found unlawful, in relation to remotely loaded web fonts, in its judgment of 20 January 2022 in case 3 O 17493/20. Self-hosting removes the defect at the root.

10.3 The same rule applies to every static resource

Fonts, icons, style sheets, scripts, images and media are served from the infrastructure of the Provider. This rule is aligned with the design constraint applied to the industrial applications of the suite, which are intended to operate in segregated networks and are therefore forbidden from calling any external address at runtime.

10.4 Practical consequences

The banner works even where the terminal has no access to the public internet; no third party becomes aware of a visit before consent; and the inventory in Article 5 remains verifiable, because it is not exposed to the unilateral introduction of new identifiers by an external vendor.

Art. 11 — How to change or withdraw the choices expressed

11.1 The permanent link to the preference centre

A link named Cookie preferences (in the Italian version, Preferenze cookie) is present in the footer of every page. It reopens the preference centre at any moment, in a single click, without the need to sign in and without any further step. Withdrawing consent is therefore as simple as giving it.

11.2 Effect of a change or of a withdrawal

From the moment a new choice is recorded, the categories concerned are deactivated, the technologies belonging to them are no longer executed, read or renewed, and those set by the Provider on its own domain are deleted. Cookies already set on their own domain by a third party whose component had been enabled must, where they persist, be removed through the settings of the browser as described in Article 11.3. The withdrawal takes effect for the future and does not affect the lawfulness of the processing carried out on the basis of the consent given before it.

11.3 Settings of the browser

Every browser allows cookies and web storage to be inspected, blocked and deleted, in general and for a single site. The relevant settings are found, in the most widespread browsers, under Settings, Privacy and security, Cookies and other site data in Chrome and in Edge, under Settings, Privacy and security, Cookies and site data in Firefox, and under Preferences, Privacy in Safari, with equivalent paths in their mobile versions. Deleting the cookies of the industryux.com domain also deletes the record of the choice expressed, so that the banner will be presented again on the next visit, as provided in Article 9.6.

11.4 Consequences of refusing or deleting

Refusing the consent-gated categories does not limit access to any content or to any functionality operated by the Provider: the website, the shop, the customer portal and the platform remain fully usable. The only visible effect concerns the third-party embedded content described in Article 8.3, which is replaced by a placeholder. Deleting or blocking the technical cookies of Article 5 has a different and heavier effect: the session ends and the user is signed out, the shopping cart is emptied, the language and the time zone return to their default values, and the sign-up, checkout and payment flows may fail.

11.5 Automatic signals sent by the browser

Automatic signals such as the "Do Not Track" header or equivalent preference signals are not recognised by Italian law as an autonomous and valid expression of consent or of refusal, and they cannot replace the mechanism described in Article 9. Where a browser is configured to block third-party cookies in general, the platform continues to work in full, because it does not rely on third-party cookies for any of its functions.

Art. 12 — Transfers outside the European Economic Area

12.1 Technologies described in Articles 5 and 6

The servers that set and read the technical cookies listed in Article 5, and the infrastructure that stores the audience measurement described in Article 6, are located within the European Economic Area, in Italy. No transfer of personal data to a third country takes place through those technologies.

12.2 Consent-gated third-party components

Where the user enables a third-party embedded component under Article 8.3 and the provider of that component is established outside the European Economic Area, a transfer of personal data to a third country occurs. In that case the Provider relies on the Standard Contractual Clauses adopted by the European Commission with Implementing Decision (EU) 2021/914, in the module appropriate to the relationship, accompanied by a transfer impact assessment carried out according to the six-step methodology of the European Data Protection Board Recommendations 01/2020 and by the supplementary technical and organisational measures identified in that assessment.

12.3 Position on the adequacy decision concerning the United States

For transfers to importers established in the United States, the Provider does not rely exclusively on the adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework. In view of the challenge pending before the Court of Justice of the European Union and of the weakening of the supervisory and redress mechanisms on which that decision rests, the Standard Contractual Clauses together with the transfer impact assessment are maintained as the primary transfer instrument, so that the lawfulness of any transfer does not depend on the survival of that decision.

12.4 Processors and sub-processors

The processors and sub-processors used to operate the platform, with their location and the service they provide, are listed in the document made available to customers together with the Data Processing Agreement and kept up to date. Any change is notified with at least 30 days' notice before the new processor becomes operational, under the conditions set out in that agreement.

Art. 13 — Records of consent and retention

13.1 What is recorded

When a choice is expressed through the banner or the preference centre, the Provider records: a random consent identifier; the date and time of the choice; the version of this document displayed at that moment together with its hash; the choice expressed for each category; the language of the interface; the command used, that is acceptance of all categories, refusal of all categories, saving of a granular selection or closing of the banner; the address of the terminal masked as described in Article 6.1; and the browser user agent. Where the user is signed in, the record is associated with the account.

13.2 Retention of the records

The record is retained for the 6 months during which the choice is valid and, thereafter, for a further 24 months as evidence of compliance with Articles 5(2) and 7(1) GDPR. At the end of that period it is deleted or irreversibly anonymised. The retention of the record is a separate matter from the lifetime of the cookies themselves, which is the one indicated in Article 5.

13.3 Access to one's own record

Any person may ask the Provider for a copy of the consent records relating to that person. Where the record cannot be linked to the requesting person without collecting additional identifying information, the Provider informs the requesting person accordingly, in accordance with Article 11(2) GDPR, and does not acquire further data for the sole purpose of the identification.

Art. 14 — Rights of data subjects and remedies

Every data subject has the right to obtain from the Provider access to the personal data concerning him or her and the rectification or erasure of that data, the restriction of the processing and, where applicable, the portability of the data, as well as the right to object to processing based on legitimate interest, under Articles 15 to 22 GDPR. Consent given for cookies may be withdrawn at any moment under Article 7(3) GDPR through the preference centre, without affecting the lawfulness of the processing carried out before the withdrawal.

Requests are addressed to the contacts indicated in Article 2 and are answered free of charge within one month of receipt; that period may be extended by two further months where the request is complex or where several requests are pending, in which case the data subject is informed of the extension and of its reasons within the first month, in accordance with Article 12(3) GDPR.

Any data subject who considers that the processing infringes the applicable law has the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, electronic mail garante@gpdp.it, certified electronic mail protocollo@pec.gpdp.it, under Article 77 GDPR, and to seek a judicial remedy under Article 79 GDPR. A data subject residing in another Member State of the European Union may equally lodge the complaint with the supervisory authority of the Member State of his or her habitual residence or place of work.

Art. 15 — Changes to this Cookie Policy

The version number and the date of this document are stated on its cover and are updated at every revision. A change that affects the scope of the consent already collected, in particular the introduction of a new purpose, of a new category or of a new third party, entails the publication of a new version and the resetting of the preferences already expressed, so that consent is requested again before the new technology is activated. A change that does not affect that scope, such as an editorial correction, a shortening of the duration of a cookie, a change of contact details or the removal of a technology, is published with a new version number and does not require a new consent.

The version in force is always published at the "Cookie policy" link in the footer of the website and is made available inside the preference centre. Previous versions are archived by the Provider, together with the date on which each of them was in force, and are made available on request for at least five years, so that the text that was displayed at the moment of a given consent can be reconstructed.

Art. 16 — Status of this document and validation

This text is the release candidate, version 1.0, of the IndustryUX Cookie Policy. The inventory in Article 5, the durations stated there and the description of the banner in Article 9 must be verified against the configuration actually in production before this document is published, and must be verified again at every release of the platform that adds, removes or modifies a technology stored in the terminal equipment of users. Its adoption towards real customers and its publication on the website require the prior validation of qualified legal counsel and, where one is appointed, of the data protection officer: this document is an editorial deliverable prepared for that review and does not constitute legal advice.

IUX-EN-34 · v1.0 · 2026-08-10 · IndustryUX® è un marchio registrato di DEVIBRAIN S.r.l.