Privacy notice

Who processes your data

The data controller is 3Epc Bio Srl, Viale Europa 55, 00144 Rome, Italy, VAT number 17721811002. For anything concerning your data, write to info@acquastream.com or call 347 769 2795.

What we collect, and when

If you fill in the «let's start with your postcode» form: postcode, name, phone number and which water you prefer (still, or sparkling too). We need them to call you back and to check whether the service reaches your address. Alongside them we record the moment you sent the form, the moment you gave consent and the date of this notice, so that we can show which text you gave it on. Without the consent tick we save nothing: that is not a formality, it is how the program is written.

If you fill in the «subscribe» form: first name, surname, address with postcode and town, mobile number, email, which water you prefer and any notes. We need them to contact you about starting the subscription: to check the service reaches your address, arrange the installation and send you the contract and terms to read before signing. We use the email for that and for service messages, not for newsletters. As with the other form we record the moment you sent it and the date of this notice, and without the tick we save nothing.

Where you came from: together with a request or a subscription we record the page you entered the site on, the site that brought you here (its address only, nothing more) and, if you came from an advert, the campaign name and the click identifier that Google or Meta add to the page address. They tell us which adverts bring real enquiries. They contain neither your name nor your phone number, and we send them to no one, with a single exception: if you came from an advert on ChatGPT we keep the click identifier OpenAI itself added to the address, in order to send it back to them together with the fact that you submitted a request and the page you submitted it from. It serves to measure whether the advert works, it does not include name, email or phone number, and it does not depend on your cookie choice.

If you enter only the postcode: the site sends it to our server to tell you whether it belongs to one of the towns we serve. The answer comes back and the postcode is not kept.

If you use the «do the sum» calculator: the numbers you type stay in your browser. The calculation happens there; it does not reach us.

If you choose WhatsApp: the site opens WhatsApp with a message already written, which you can check before sending. From then on the conversation goes through WhatsApp, which applies its own privacy notice.

In every case: the server hosting the site writes technical visit logs — IP address, time, page requested, browser type. It produces them by itself and they serve to keep the site running and to defend it against abuse; the IP address also serves to limit repeated form submissions.

Why we process them

To call you back and check coverage at your address. The legal basis is your consent (Article 6(1)(a) GDPR): you give it with the tick on the form, never pre-selected, and you can withdraw it whenever you like. We do not use this data for newsletters or advertising.

To start the subscription you asked for. When you fill in the «subscribe» form, the legal basis is the performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR): without this data we cannot check the address, install the system and prepare your contract. If you then do not become a customer, the data follows the same retention periods as the form.

To keep the site running. The technical logs rest on our legitimate interest (Article 6(1)(f)) in a site that works and is not abused.

Google advertising: only if you authorise it. The site can load Google Ads and Google Analytics 4 to measure which adverts bring people to these pages and, if you accept, to show you our adverts again on other sites and apps in Google's network (remarketing): Google puts you on a list of people who have visited the site, and keeps you there for 30 days. They start only with your authorisation — the legal basis is your consent (Article 6(1)(a) GDPR) — and they never receive name, phone number or postcode. If you do not authorise them, they are not even downloaded: that is the order in which the site does things, not a promise given in words.

Meta advertising: only if the notice names it and you authorise it. The site can load the Meta pixel (Meta Platforms Ireland Ltd.) to measure which adverts on Facebook and Instagram bring people to these pages and bring enquiries, and, if you accept, to show you our adverts again on Facebook and Instagram. It starts only if the notice asking your permission names Meta and you accept: a yes given on a notice that named only Google does not switch it on. The legal basis is your consent (Article 6(1)(a) GDPR). We never send the pixel name, phone number or postcode: only that a page was viewed and that a request was sent. Meta may process this data in the United States as well, under its own privacy notice.

Microsoft Clarity: we do not load it today. If one day its heat maps were needed, we would ask you with a notice that names it.

Cookies and browser storage

Until you authorise it, no statistics cookie and no profiling cookie. On your first visit the site asks your permission with a notice at the foot of the page: «Accept» and «Decline» are two identical buttons, and closing without choosing does not count as a yes — in fact it cannot be closed without choosing. If you decline, or if you do not answer, the tools are not downloaded.

If you accept, Google installs its own cookies to measure adverts and for remarketing: among them _ga and _ga_<ID> (two years) and _gcl_au (three months) on this site, and on Google's domains cookies such as IDE (up to thirteen months). If the notice names Meta and you accept, the Meta pixel installs _fbp and, if you arrived from an advert on Facebook or Instagram, _fbc (three months each). They do not contain your name, your phone number or your postcode. We will give you the up-to-date list of active tools if you write to info@acquastream.com.

If you accept, the site also remembers where you came from (the campaign, the click identifier, the entry page) in your browser's storage, for 90 days: so if you fill in the form on another day, we still know which advert brought you. If you do not accept it remembers nothing, and we attach to the request only what is on the page you send it from.

The anonymous measurement of visits, described below, uses neither cookies nor browser storage: that is why it does not depend on your choice.

Your choice stays in your browser's storage — not in a cookie — and does not reach us. The only cookies the site uses by itself are technical ones: they keep the private preview open while the site is being worked on. They do not profile and cannot be switched off without making the site unusable.

You can change your mind whenever you like, from the button on the Italian version of this page: it reopens the request, and appears only if there is something to authorise.

Anonymous measurement of visits

No cookies and no identifiers, for everyone. To understand which pages work, the site records which page was opened, the advertising campaign it was reached from (the campaign name and the keyword, and whether the click comes from a Google or Meta advert: yes or no, not the click identifier) or, if you arrive from a search engine or an AI assistant, which one from a closed list (for example «Bing», «Copilot» or «ChatGPT»: the name, not the address of the page you come from), how long the page stays visible, how far it is scrolled, whether a button is used or a form started, whether a postcode is checked (that a check happened, not the postcode) and whether the screen is a phone or a computer.

It does not record the IP address, the browser type, the full address of the page or that of the page you come from, and it neither writes nor reads anything in your browser's storage: there is nothing that would allow you to be recognised or two pages viewed by the same person to be linked. The IP address serves only, for a few minutes and without being saved, to limit repeated submissions, as it does for the forms.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing which pages and which campaigns actually work; that is why the measurement does not depend on the cookie choice. We read the data summed by day and by page, and it is kept for 13 months, then deleted.

Who else sees it

Inside 3Epc Bio, the staff responsible for handling enquiries. Outside, only the suppliers that keep the site, its infrastructure and the system in which staff follow up enquiries running: they process the data on our behalf, as processors (Article 28 GDPR), and not for purposes of their own.

We do not sell your data and we do not pass it to third parties for marketing.

Where it is hosted

The site and its database run on the infrastructure of Railway Corp., in a region located in the United States: the data you leave us is therefore transferred outside the European Union. The transfer is covered by the safeguards provided for in Chapter V GDPR — the standard contractual clauses approved by the European Commission, provided for in the data processing agreement entered into with the supplier. You can ask us for a copy of those safeguards by writing to the address above.

How long it stays

Form data is kept for 24 months from the last contact between you and us, then deleted. If you become a customer in the meantime, the data of the relationship follows the periods set by law: ten years for accounting and tax documents, for example.

Technical logs are kept for as long as is needed for the security and diagnostics of the site, and they do not serve to profile anyone.

The data from the anonymous measurement of visits is kept for 13 months, so that a month can be compared with the same month a year earlier, and is then deleted.

What you can ask us

You can ask to access your data, to correct it, to erase it, to restrict its processing, to object, and to receive it in a readable format in order to take it elsewhere (portability). You can withdraw your consent at any time: from then on we stop, and only what was already done before the withdrawal remains valid.

Writing to info@acquastream.com is enough. We answer within a month.

If you think we are getting it wrong

You can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali — Piazza Venezia 11, 00187 Rome, garanteprivacy.it. It is your right and it takes nothing away from the others.

No automated decisions

We make no automated decisions about you: the person who calls you back is a person, and the result of the calculator is seen only by you. The only processing that resembles profiling is the Google and Meta remarketing described above, and only if you authorise it: it decides who is shown our adverts again, not what to offer you or at what price.

Italian version last updated: 1 November 2026.