Privacy notice

Last updated: 20 October 2026.

This notice describes how personal data is processed through theusualnext.com, contact and quotation forms, Tholus Account and connected commercial journeys. Software applications published by the usual neXt have a separate privacy notice.

Data controller

THE USUAL NEXT S.R.L., Corso Umberto I 10, 67031 Castel di Sangro (AQ), Italy, VAT no. IT02182990669. For privacy enquiries or to exercise your rights: [email protected].

Data we process

• Technical and security data: IP address, date and time, requested page, browser, device, operating system, logs and technical or anti-fraud events.
• Enquiries: name, email, telephone number, company, VAT or UID number, role, messages, files, project details, place, date and information needed for delivery, site inspection or a quotation.
• Account and commercial data: identity data, credentials and sessions, account references, quotations, orders, support, invoicing and payment status. When online payment is available, full card details are collected directly by the payment provider, not by this website.
• Preferences: subscription to commercial communications, consent records and measurement technology choices.

Data comes from you, your browser or device and, where needed to perform a contract, the organisation or partner you work with.

Purposes and legal grounds

• answering enquiries and managing quotations, accounts, orders, deliveries, rentals, support and payments: pre-contractual steps and performance of a contract;
• issuing and retaining tax, accounting and administrative records: legal obligation;
• protecting the website, infrastructure, accounts and rights, preventing abuse and improving reliability and service: legitimate interests balanced against individual rights;
• measuring usage, performance and interactions in aggregate and without persistent identifiers with Rybbit to improve the website, journeys and products: legitimate interests balanced against individual rights;
• linking visit activity through a pseudonymous identifier and recording protected session replays: consent, which may be withdrawn at any time;
• sending newsletters or promotional communications: separate consent, which may be withdrawn at any time;
• establishing, exercising or defending legal claims: legitimate interests and, where applicable, legal obligations.

Fields marked as required are needed to respond or provide the requested service. Without them, we may be unable to issue a quotation, create an account or enter into a contract. Optional fields may be left blank.

Cookies and similar technologies

The website uses technologies required for sessions, security, abuse prevention and storage of your privacy choice. Cloudflare protects and delivers the website and may set strictly necessary cookies when security checks are triggered. Its Web Analytics beacon collects aggregate traffic and performance measurements without using cookies or localStorage to recognise visitors.

Rybbit, open-source software operated on our European servers, immediately collects aggregate, non-identifying analytics about the page, source, browser, operating system, device type, screen size, approximate country and usage events. Only UTM campaign parameters are retained from the URL query; traffic from AI assistants and requests from their crawlers are classified by service, type and page. The IP address is carried by the request and used to derive the approximate country, but is not retained in aggregate analytics. Before consent we do not load the session recorder, set persistent analytics identifiers or use advertising measurement tools.

If you choose “Accept complete analytics”, events are linked to a random pseudonymous identifier generated by the backend and renewed at least monthly; the IP address and browser characteristics are not used to build the identifier. If you submit a commercial enquiry while consent is active, we store the same pseudonymous identifier and the sanitised first source (landing page, referrer domain and campaign parameters) with the enquiry in Merxera. Qualification, meeting, proposal and sale outcomes can then be linked to the visit in Rybbit without sending names, email addresses, phone numbers, companies or messages. On public pages only, we also enable interaction replay: page structure and changes, clicks, scrolling and navigation. Forms, inputs, sensitive areas and account, authentication, checkout and order paths are blocked or masked. Your choice lasts no more than 180 days, can be changed through “Privacy preferences” in the footer, and withdrawal stops new links, stops the recorder and removes browser identifiers.

Service providers and other recipients

Data is available only to authorised staff and providers needed to deliver the service, under instructions and confidentiality duties. Depending on the journey you use, these may include:

• Hetzner and RunCloud for hosting and infrastructure management, including the Rybbit instance operated by us;
• Cloudflare for network delivery, security and aggregate performance measurements;
• Google Fonts and the unpkg and CARTO CDNs for fonts, components and maps on pages that require them; your browser sends the technical data needed to make the request;
• YouTube and Vimeo only when you choose to open an external video; default previews remain local and the players use the most privacy-protective modes available;
• the SMTP provider for email delivery;
• Tholus Account and Merxera for identity, catalogue, quotations, availability, orders and support;
• Stripe, only when online payment is offered;
• Mailchimp, only if you subscribe to a newsletter managed through that service;
• Glacom, only after separate consent if you request an assessment for possible public funding. The assessment is preliminary and does not guarantee funding.

Data may also be disclosed to professional advisers, insurers, authorities or entitled parties where necessary for legal duties, security or the protection of rights. We do not sell personal data.

International transfers

Some providers may process data outside the European Economic Area or Switzerland. In those cases we use an adequacy decision, the EU–US or Swiss–US Data Privacy Framework where the recipient participates, or standard contractual clauses and supplementary measures appropriate to the transfer. You may ask the controller for information about the safeguards used.

Retention

• technical and security logs: normally up to 12 months, and longer only to investigate incidents or protect rights;
• Rybbit analytics: up to 24 months; session replays: no more than 14 days; browser privacy choice and pseudonymous identifiers: up to 180 days or until withdrawal;
• enquiries and quotations that do not lead to a contract: normally up to 24 months after the last meaningful contact;
• accounts: for the life of the account and afterwards as needed for legal duties, disputes and security;
• contracts, orders, invoices and accounting records: normally 10 years or another period required by applicable law;
• marketing: until consent is withdrawn, while retaining what is necessary to evidence the choice and respect an objection.

If a dispute or preservation duty applies, the period may be extended for no longer than necessary.

Your rights

Where provided by the GDPR and Swiss data protection law, you may request access, correction, deletion, restriction, objection and, where applicable, data portability. You may withdraw consent at any time and object to direct marketing free of charge. Email [email protected] to exercise a right; we may request only the information needed to verify your identity.

You may complain to the Italian Data Protection Authority or, for processing governed by Swiss law, the Federal Data Protection and Information Commissioner. We nevertheless invite you to contact us first so we can address the matter directly.

Automated decisions, children and security

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. Any matching between a project, products or funding opportunities is preliminary and subject to human review.

The website services are intended for businesses and adults and are not directed to children under 16. If you believe a child has submitted data, contact us so we can verify and delete it.

We use technical and organisational measures proportionate to the risk, including encryption in transit, access controls, event logging and incident procedures. No system is risk-free; we limit data, access and retention to reduce exposure.

Grants and funding

In the “Grants and funding” section we process personal data in four cases only:

• “Report an error”: the field you report, the optional message and an encrypted fingerprint of your IP address, used only to limit abuse. The report starts an automatic check of that fact against the official act; the text of the message is never sent to artificial intelligence systems. Legal ground: legitimate interest in publishing correct information. We keep the report for up to 12 months after it is closed.
• “Free check: can I apply?”: the form data and the call you write from. The request reaches the usual neXt and a person answers it. The data go to Glacom or another consultant only if you choose to share them, with a consent that names the recipient. Legal grounds and retention are those of the requests described above.
• “My grants”: if you use Account Tholus, the calls you save stay linked to your account until you remove them or close the account. Without an account the list stays only in your browser.
• “E-mail alerts”: the e-mail address (stored encrypted), the chosen filters, the frequency and the date of consent. We only write after you confirm with the link we send you, and you can unsubscribe from every message. The e-mails are sent through the SMTP provider the site uses for all its messages, without tracking. Legal basis: your consent. Unconfirmed subscriptions are deleted after 7 days, closed ones after 30; of addresses that reject our messages only an encrypted fingerprint remains, so that we never write to them again.

The grant pages are written with artificial intelligence (Claude by Anthropic) from the official texts of ministries, regions, agencies and European programmes. Before processing we remove from those texts the names of people, personal emails and phone numbers, tax codes and IBANs. Form data and visitor data never reach artificial intelligence systems.

Changes to this notice

We may update this notice when services, providers or laws change. The current version and its date are always published here; material changes will be communicated through appropriate means.