This notice describes data collected by AEGIS Tech technology components of LANGA Corp. Srl, pursuant to arts. 13-14 of Regulation (EU) 2016/679 (GDPR).
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Site URL and domain | Connected site identification | Contract performance (art. 6.1.b) | Service duration + 1 year |
| Online/offline status (heartbeat) | Availability monitoring | Contract performance | 1 year |
| Software versions (CMS, PHP, plugins, themes) | Security and compatibility monitoring | Legitimate interest (art. 6.1.f) | 1 year |
| SSL certificate status and expiry | Security monitoring | Legitimate interest | 1 year |
| Site error logs | Diagnostics and maintenance | Legitimate interest | 6 months |
| Overall site score | Technical quality assessment | Contract performance | Service duration |
| Commerce/login/form events (Pro/Premium only) | Advanced analytics for owner | Consent (art. 6.1.a) — can be disabled | 1 year |
Important: the above data relates to the site (server, software, configuration), NOT the site's visitors. The Microchip does not collect visitor personal data, does not install cookies on visitor browsers, does not track visitor behavior.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| User queries | AI service delivery | Contract performance / Consent | 2 years |
| AI-generated responses | Service delivery, improvement | Contract performance | 2 years |
| Model and provider used | Request routing | Contract performance | 2 years |
| API costs per provider | Internal accounting | Legitimate interest | 10 years |
| User feedback on responses | Quality improvement | Consent | 2 years |
The _langa_sso cookie contains the encrypted user ID and email. It is a session cookie on the .langa.tv domain, necessary for cross-domain authentication. It is not shared with third parties.
When the Microchip is installed on a client-owned site: technical site data is transmitted to LANGA and stored in the LANGA database; the site owner accepts data collection during Microchip installation/activation; LANGA has no direct relationship with the site's visitors; the client is responsible for their own privacy policy toward their visitors; collected data is accessible to the site owner via their management panel.
| Provider | Location | Transfer safeguard |
|---|---|---|
| Anthropic (Claude) | USA | SCC |
| OpenAI | USA | SCC |
| Google (Gemini) | USA | SCC |
| Mistral | France (EU) | No extra-EU transfer |
| Perplexity | USA | SCC |
Data collected by AEGIS Tech components is stored in the shared database on servers located in the European Union (qualified third-party infrastructure provider). Access is limited to authorized LANGA personnel.
Data subject rights (access, rectification, erasure, portability, objection) can be exercised per the LANGA Galaxy Privacy Policy. Contact: [email protected].
Last updated: January 15, 2025
Pursuant to arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR).
LANGA Corp. Srl
Registered office: Piazza IV Novembre, 4 — 20124 Milano (MI), Italia
VAT No.: IT10637600965
Sole director: Luca Prata
Certified email (PEC): [email protected]
Email: [email protected]
For any request related to personal data processing, the data subject may contact the DPO at the above address.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Access, communications, invoicing | Contract performance (art. 6.1.b) | Account duration + 10 years | |
| Full name | Identification, invoicing | Contract performance | Account duration + 10 years |
| Phone number | OTP, emergency contact | Consent (art. 6.1.a) | Until revocation |
| Password (bcrypt hash) | Authentication | Contract performance | Account duration |
| Address | Invoicing, VAT determination | Contract performance + legal obligation (art. 6.1.c) | 10 years (fiscal obligation) |
| VAT No. / Tax code | Invoicing, VIES verification, DAC7 | Legal obligation | 10 years |
| Certified email (PEC) / SDI code | Electronic invoicing | Legal obligation | 10 years |
| IP address | Security, VAT OSS geolocation proof | Legitimate interest (art. 6.1.f) | 2 years, then anonymized |
| Leghe balance | Voucher wallet management | Contract performance | Account duration |
| Interests / user type | Service personalization | Consent | Until revocation |
| Data | Legal basis | Retention |
|---|---|---|
| Amount, currency, payment status | Contract performance + legal obligation | 10 years |
| Payment method | Contract performance | 10 years |
| Provider reference (Stripe/PayPal) | Contract performance | 10 years |
| Bank transfer receipt (file URL) | Contract performance | 10 years |
| Payment IP | Legitimate interest | 2 years |
| Credit card data | Never stored by LANGA. Handled directly by Stripe/PayPal (PCI DSS compliant). | |
Data collected by technology components (Microchip, Shield, Intelligence, APIs) is described in the AEGIS Tech Privacy Notice, which forms an integral part of this privacy policy. In summary: connected site technical data, AI data (queries, responses, costs), SSO data.
When the User browses services displaying sponsored content, LANGA may use the following data for targeting:
| Data | Legal basis | Opt-out |
|---|---|---|
| User type (business/individual) | Legitimate interest (art. 6.1.f) | Account > Settings |
| Networks visited | Legitimate interest | Account > Settings |
| Declared interests (profile) | Consent (art. 6.1.a) | Remove interests from profile |
| Purchase history (categories only) | Legitimate interest | Account > Settings |
| Geolocation (country/region only) | Legitimate interest | Account > Settings |
Specific personal data (name, email, phone, address) is never used for advertising targeting. Data is never shared with advertisers: LANGA displays the ad on behalf of the advertiser, who receives only aggregate statistics (impressions, clicks, conversions).
Personal data may be shared with:
Some providers are based outside the European Economic Area:
| Service | Destination | Safeguard |
|---|---|---|
| Stripe (payments) | USA | Standard Contractual Clauses (SCC) |
| PayPal (payments) | USA | SCC |
| Anthropic (AI) | USA | SCC |
| OpenAI (AI) | USA | SCC |
| Google (AI) | USA | SCC |
Data is never sold to third parties.
Pursuant to arts. 15-22 of the GDPR, the data subject has the right to:
| Right | Article | How to exercise |
|---|---|---|
| Access | Art. 15 | Email to [email protected] or Account Area → Privacy & Data |
| Rectification | Art. 16 | Account Area → Profile |
| Erasure | Art. 17 | Email to [email protected] or Account Area → Privacy & Data |
| Restriction | Art. 18 | Email to [email protected] |
| Portability | Art. 20 | Account Area → Privacy & Data (JSON/CSV export) |
| Objection | Art. 21 | Email to [email protected] or Account Area → Settings |
| Withdraw consent | Art. 7.3 | Account Area → Settings or link in email |
LANGA will respond within 30 days of receiving the request, extendable by a further 60 days in case of complexity.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it).
LANGA does not carry out fully automated decision-making processes that produce legal effects on the data subject. AI services provide suggestions and responses that do not constitute binding decisions.
The site scoring system (LINK Network) produces automated technical assessments used exclusively to provide the requested service, without legal effects on the data subject.
LANGA Galaxy Services are restricted to persons aged at least 16 years, in compliance with art. 8 of the GDPR. LANGA does not knowingly collect data from persons under 16. If reported, such data will be promptly deleted.
LANGA implements appropriate technical and organizational measures pursuant to art. 32 of the GDPR, including:
Cookie usage is described in the separate Cookie Policy, forming an integral part of this privacy policy.
For users residing in the United Kingdom, LANGA processes personal data in compliance with the UK GDPR (General Data Protection Regulation as incorporated into UK law) and the Data Protection Act 2018. The rights and safeguards described in this policy apply in full. The competent supervisory authority is the Information Commissioner's Office (ICO — ico.org.uk).
For users residing in California, LANGA recognizes the rights provided by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
Categories of data collected (past 12 months): identifiers (name, email, IP), commercial data (purchase history, Leghe balance), Internet activity (logs, AI queries), geolocation data (IP for VAT determination).
To exercise rights: [email protected]. LANGA will respond within 45 days.
LANGA is committed to complying with applicable data protection laws in the countries where the Services are accessible. In particular:
Where local laws impose higher standards, such standards apply in addition to this policy.
LANGA reserves the right to update this policy. Material changes will be communicated via email and/or notice in the Account Area with at least 30 days' prior notice. The updated version will always be available on langa.tv.
Last updated: January 15, 2025
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Legal name / business name | Identification, DAC7 | Legal obligation | 10 years |
| Tax ID / VAT number | Taxation, DAC7 | Legal obligation | 10 years |
| Date of birth (natural persons) | DAC7 | Legal obligation | 10 years |
| IBAN | Payment of proceeds | Legal obligation | 10 years |
| Address | Identification, DAC7 | Legal obligation | 10 years |
| Total sales/transactions | DAC7, commission invoicing | Legal obligation | 10 years |
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Shipping address | Product delivery | Contract performance | Order duration + 2 years |
| Order history | Order management, returns | Contract performance | 10 years (fiscal obligation) |
| Reviews | Community feedback | Consent | Until revocation |
LANGA transmits to vendors only the data strictly necessary to fulfill the order (name, shipping address). Payment data is never shared with vendors.