SYD Platform
Privacy Notice

Privacy Notice

Last updated: 8 May 2026

This Privacy Notice is available in Italian and English; in case of discrepancy, the English version prevails for users subject to US law. The Notice describes how the Celerya / SYD group collects, uses, discloses, and protects personal data submitted through the Celerya website and the SYD registration form, and explains the rights available to you depending on your jurisdiction.

It covers only the registration stage, that is, the contact information you provide when you express interest in SYD before any contract is concluded. Any subsequent processing connected to use of the SYD platform after account activation falls outside the scope of this Notice and is governed by a separate Data Processing Agreement provided at that time.

The websites and forms within the scope of this Notice are operated by:

  • Celerya S.r.l., with registered office at Via Don Turinetti 11, 10080 Bosconero (TO), Italy, VAT 12230960010, acting as the controller for users in the European Union, the European Economic Area, the United Kingdom, and any jurisdiction outside the United States;
  • Monolithus Protocol Corporation, with registered office at 16192 Coastal Highway, Lewes, DE 19958, USA (Registered Agent: Harvard Business Services, Inc.), acting as the controller and as the “business” within the meaning of US state privacy law, for users resident in the United States.

Each entity acts as an independent data controller for the persons it serves and is solely responsible for the personal data processed in its jurisdiction. Where registration data is exchanged between the two entities for group coordination, the transfer is governed by the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, supplemented by transfer impact assessments where required following the Schrems II judgment.

For privacy matters, the contact email is amministrazione@celerya.com for both entities. In this Notice, “we” and “us” refer to the applicable controller.

1. Personal data we collect

We collect the following personal data through the registration form:

  • full name of the individual completing the form;
  • business email address;
  • company name;
  • company registered address;
  • VAT number or tax identification number.

We do not collect special categories of personal data within the meaning of Article 9 GDPR, or “sensitive personal information” within the meaning of the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), at this stage.

2. How we use registration data and on what legal basis

We use registration data only to evaluate your registration request and contact you to discuss next steps; to maintain our internal prospect database; to comply with applicable legal obligations, including accounting and tax obligations; and to defend our legal rights where necessary. We do not use registration data for targeted advertising, behavioural profiling, or any purpose unrelated to the above.

For users to whom the GDPR applies, the legal bases under Article 6 GDPR are: pre-contractual measures taken at your request, for evaluating your registration and contacting you (Art. 6(1)(b)); our legitimate interests in maintaining a prospect database and protecting our legal position, where not overridden by your rights and freedoms (Art. 6(1)(f)); and compliance with legal obligations under EU and Italian law (Art. 6(1)(c)). The processing described in this Notice does not produce legal effects, nor does it similarly significantly affect you, within the meaning of Article 22 GDPR.

For users in the United States, the same activities constitute standard business purposes within the meaning of Section 1798.140(e) CCPA and the corresponding provisions of other state privacy laws.

3. Disclosure and recipients

We do not sell registration data, and we do not share registration data for cross-context behavioural advertising. Registration data may be disclosed to authorised internal personnel on a need-to-know basis; to service providers (typically cloud hosting, transactional email, and customer relationship management), appointed where required as data processors under Article 28 GDPR and contractually bound to use the data only for the purposes for which it was disclosed; to the other group entity (Celerya or Monolithus Protocol, as applicable), for group coordination, subject to the safeguards described above; and to regulatory, tax, judicial, or law enforcement authorities, where required by applicable law.

4. Retention

Registration data is retained for a maximum of 12 months from receipt. After that period, the data is deleted or anonymised, unless a contract has been concluded, in which case retention is governed by the agreement entered into at that time.

5. Security

We adopt technical and organisational measures appropriate to the risk of processing this category of data, including encryption in transit and access controls. In the event of a personal data breach, we will notify the competent supervisory authority and, where required, the affected individuals pursuant to Article 33 GDPR (within 72 hours of becoming aware, where feasible) and to applicable US state breach-notification laws.

6. Your rights (European Union, EEA, United Kingdom, and other GDPR-aligned jurisdictions)

Pursuant to Articles 15 to 22 GDPR, you have the right to obtain confirmation of whether we process your personal data and access to that data; to have inaccurate or incomplete data corrected; to have your data erased in the cases set out in Article 17; to have processing restricted in the cases set out in Article 18; to receive your data in a structured, commonly used and machine-readable format and to transmit it to another controller; to object to processing based on legitimate interests on grounds relating to your particular situation; and to withdraw any consent given, without prejudice to the lawfulness of processing carried out before the withdrawal.

Verified requests are answered within 30 days, extendable by a further 60 days in cases of particular complexity. To exercise these rights, please write to amministrazione@celerya.com.

You also have the right to lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it), or with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

7. Your rights (United States)

7.1 California (CCPA / CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we have collected, the sources, purposes, and categories of recipients; to delete personal information we hold about you, subject to the exceptions in Section 1798.105(d); to correct inaccurate information; to opt out of the sale or sharing of personal information for cross-context behavioural advertising (we do not sell or share, so this right is automatically satisfied); to limit the use and disclosure of “sensitive personal information” (which we do not collect at this stage); and to be free from discrimination for exercising any of these rights.

Requests are submitted by email to amministrazione@celerya.com, with the subject line “CCPA Rights Request”. Identity is verified in proportion to the sensitivity of the request; we respond within 45 days, extendable once by a further 45 days. Authorised agents may submit requests on your behalf under Section 1798.135, with proof of authorisation.

7.2 Other US states

Comparable rights are available under the privacy laws of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and the other US states that have adopted comprehensive consumer privacy laws, whether in force or coming into force. The substantive rights (access, deletion, correction, opt-out of targeted advertising, opt-out of sale, and appeal of denied requests) are similar in scope. Requests are submitted by email to amministrazione@celerya.com, indicating your state of residence and the right you wish to exercise.

8. Cookies

The website uses strictly necessary technical cookies required for the registration form to function, such as session management and CSRF protection. Pursuant to Article 122 of D.Lgs. 196/2003 as amended, those cookies do not require consent. Profiling, analytical or marketing cookies, where used, are installed only after explicit consent obtained through the cookie banner. A separate Cookie Notice is published on the website.

9. Children

The SYD platform is a B2B service intended for use by business entities and their authorised representatives. We do not knowingly collect personal data from children under the age of 16 in the European Union, or under the age of 13 in the United States, consistent with the GDPR and the US Children’s Online Privacy Protection Act. Any such data inadvertently collected will be deleted without delay.

10. Beyond the registration stage

Processing related to use of the SYD platform itself (including login records, audit logs, usage analytics, and any product, compliance, or commercial data uploaded by clients) is outside the scope of this Notice. It is governed by the Data Processing Agreement provided at contract execution, together with any service-specific privacy terms attached to the platform agreement.

11. Changes

This Privacy Notice may be updated. Material changes will be published on our websites, with a revised “last updated” date and, where appropriate, communicated by email to registered users.

12. Contact

For privacy matters, including the exercise of your rights: