01Data controller
The data controller is Davide De Sanctis, [business address], VAT no. [VAT number]. For any privacy question or to exercise your rights, write to dds@businessinquires.com.
No Data Protection Officer has been appointed, as one is not required for this activity.
02What data I process
Contact requests. When you use the contact form I collect: name, email address, project type, message, page language, and the date and time of submission. The same applies to emails you send me directly.
Anonymous statistics (always on, no cookies). To understand how the site is used I record aggregate events that carry no identifier at all: page visited, which sections of the page were actually viewed and for how long, language, referring site (domain only, never the full address), country (provided by the hosting infrastructure), and generic device type, browser and operating system (e.g. "mobile", "Chrome", "iOS"), plus a screen-width bucket. In this mode nothing is stored in your browser, and events cannot be linked to each other or to you.
Statistics with your consent. Only if you accept in the banner, the site generates a random browser identifier and a session identifier (stored in your browser, see the Cookie Policy). They are used to count unique and returning visitors, visit duration, scroll depth and clicks on links and buttons (the link or button text, its destination and the section it sits in). What you type into form fields is never recorded, and no name, email or other directly identifying data is collected.
IP address. Your IP address is never stored in this site's database. It is processed transiently by the hosting provider to deliver pages (and used by it to derive your country only), and by the site, in memory only and as a salted hash, to limit abuse (too many requests in a short time). This temporary value is never written anywhere and disappears within minutes.
Traffic from recognisable bots and crawlers is discarded. The site uses no profiling, advertising, social media pixels or third-party analytics services.
03Purposes, legal bases and retention
- Purpose
- Replying to contact and quote requests
- Legal basis
- Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR); for general enquiries, legitimate interest in replying (Art. 6(1)(f))
- Retention
- 24 months from receipt. If the request becomes an engagement, for the duration of the relationship and the periods required by law (e.g. tax obligations)
- Purpose
- Anonymous, aggregate statistics on site usage
- Legal basis
- Legitimate interest in improving the site (Art. 6(1)(f) GDPR); nothing is stored on or read from your device
- Retention
- 13 months, then automatic deletion
- Purpose
- Statistics with an identifier (returning visitors, clicks, duration)
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code), which you can withdraw at any time
- Retention
- 13 months from last activity; your choice is asked again after 6 months
- Purpose
- Security and abuse prevention
- Legal basis
- Legitimate interest in site security (Art. 6(1)(f) GDPR)
- Retention
- In memory only, a few minutes
Deletion is carried out by an automatic procedure that runs periodically on the database.
04Is providing data mandatory?
Contact form data is needed to reply to you: without it I cannot follow up. Consent to statistics is entirely optional: declining does not limit your use of the site in any way.
05How data is protected
Data travels over encrypted connections (HTTPS/TLS). Access to the database and to the reporting panel is restricted to the controller and to people he has expressly authorised, each with personal credentials; passwords are stored only as hashes.
06Who receives the data
Data is not sold or shared with third parties for marketing. It is processed on my behalf, as processors (Art. 28 GDPR), by the technical providers the site needs to run:
- site hosting and delivery: Vercel Inc. (provider to be confirmed);
- database: Neon Inc. (provider to be confirmed), region [database region (e.g. EU - Frankfurt)];
- contact-form email notifications: Resend, Inc.
The current list of processors is available on request. Data may also be disclosed to authorities where required by law.
07Transfers outside the EU
Some providers are based in the United States. Where possible I choose servers in the European Union; otherwise transfers rely on the EU-U.S. Data Privacy Framework adequacy decision, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).
08Your rights
At any time you can exercise the rights under Articles 15-22 GDPR:
- access to your data and a copy of it (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you provided (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- withdrawal of consent at any time, without affecting processing already carried out (Art. 7(3));
- not being subject to decisions based solely on automated processing (Art. 22): this site makes none.
Write to dds@businessinquires.com: I reply within one month, as required by Art. 12 GDPR. Anonymous statistics cannot be traced back to a person precisely because they carry no identifier.
09Complaints
If you believe the processing breaches the law you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Art. 77 GDPR), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the EU country where you live or work.
10Minors
The site is aimed at professionals and businesses and is not intended for children under 14.
11Changes to this notice
This notice may be updated, for example when providers change. The date of the last update is shown at the top of the page.