Privacy Policy
Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) · Last updated: [GG/MM/AAAA]
1. Data controller
The data controller is:
- Name: [Nome e Cognome / Ragione sociale]
- VAT no. / Tax code: [Partita IVA / Codice Fiscale]
- Address: [Via, numero civico, CAP, Città, Provincia]
- Email: [email@dominio.it]
- Certified email (PEC): [indirizzo.pec@pec.it]
No Data Protection Officer (DPO) has been appointed, as the conditions of Article 37 GDPR are not met.
2. Personal data processed
a) Browsing data
The servers hosting the website may automatically record some technical information (IP address, date and time of the request, requested page, outcome, user agent). This data is not used to identify or profile users and is necessary for the operation and security of the service.
b) Data voluntarily provided through the contact form
Name, email address and the content of the message, plus any other information the user chooses to include.
c) Authors of testimonials
The “What people say” section shows, with name and role, recommendations that their authors have already published on their own LinkedIn profiles. Anyone wishing to have their testimonial corrected or removed can write to the controller at the contact details above.
d) Cookies and tracking tools
This website does not use cookies for profiling, analytics or from third parties, nor any other tracking tools. Fonts are hosted on the website itself and no requests are made to external services to load them. For this reason there is no cookie banner.
3. Purposes and legal basis of processing
| Purpose | Legal basis |
|---|---|
| Replying to requests sent through the contact form or by email | Art. 6(1)(b) GDPR: pre-contractual measures taken at the data subject's request; alternatively, point (f) legitimate interest in replying to requests received |
| Ensuring the operation and security of the website (browsing data) | Art. 6(1)(f) GDPR: legitimate interest of the controller |
| Complying with legal obligations (e.g. tax and accounting, if a request leads to a contractual relationship) | Art. 6(1)(c) GDPR |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR |
4. Nature of the provision of data
Providing the data marked as mandatory in the contact form is necessary in order to reply to the request; if it is not provided, the message cannot be followed up. Submitting the form requires confirming that you have read this notice by ticking a dedicated box, which is not pre-selected.
5. Methods of processing and retention period
Data is processed using electronic tools and appropriate security measures. Contact form data is kept for as long as necessary to reply to the request and, if no contractual relationship follows, for a maximum of [12] months, unless otherwise required by law. If a contractual relationship arises, data is kept for the duration of the relationship and for the subsequent legal periods (generally 10 years for tax and accounting data). Browsing logs are kept for the period set by the hosting provider, generally not exceeding [30] days.
6. Recipients of the data
Data may be processed, as data processors under Article 28 GDPR, by:
- the website hosting provider: Vercel Inc.;
- the controller's email service provider: [state the email provider];
- [any third-party form service, if configured: state name and registered office];
- professional advisers (e.g. accountant, lawyer) bound by confidentiality obligations, where necessary.
Data is not disclosed or transferred to third parties for marketing purposes.
7. Transfers of data outside the EU
The hosting provider is based in the United States. The transfer relies on an adequacy decision (EU-US Data Privacy Framework, where applicable) or, failing that, on standard contractual clauses approved by the European Commission under Article 46 GDPR. [Check and update according to the hosting region actually chosen and the providers used.]
8. Rights of the data subject
At any time you may exercise against the controller the rights provided by Articles 15-22 GDPR:
- access to your personal data (Art. 15);
- rectification (Art. 16);
- erasure, the “right to be forgotten” (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- withdrawal of consent, where processing is based on it, without affecting the lawfulness of prior processing (Art. 7(3)).
To exercise them, write to [email@dominio.it] or to the PEC address [indirizzo.pec@pec.it]. You also have the right to lodge a complaint with the supervisory authority: the ItalianData Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome), or the authority of your country of residence.
9. Automated decision-making
No profiling or automated decision-making within the meaning of Article 22 GDPR is carried out.
10. Changes to this notice
The controller may update this notice; the version in force is always the one published on this page, with the date of the latest update.