Privacy policy

Last updated: 19 October 2026

This privacy notice describes how personal data are processed in relation to users who visit the website www.professioneinformatica.eu (the “Website”) or who contact the Controller through the form available on the Website. It is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree no. 196 of 30 June 2003 (the “Italian Data Protection Code”), as amended by Legislative Decree no. 101 of 10 August 2018.

This notice applies to the Website only and does not cover other websites that may be reached through external links, for which reference should be made to their respective notices.

1. Data controller

The data controller is:

Professione Informatica S.r.l.
Via Tiberio Imperatore, 65 – 00145 Roma (RM), Italy
VAT no. IT12685051000
Email: info@professioneinformatica.eu
Certified email (PEC): professioneinformatica@legalmail.it

The Controller has not appointed a Data Protection Officer (DPO). For any matter relating to the processing of personal data, please write to the contact details above.

2. Categories of data processed

2.1 Browsing data

The IT systems that operate the Website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols. These include in particular: the IP address of the device, browser type and operating system (user agent), date and time of the request, address (URL) of the requested resource and outcome of the request. These data are not collected in order to identify users but, by their nature, could allow identification if combined with other information.

2.2 Data voluntarily provided through the contact form

By filling in the contact form, users provide: name, email address, message and, if they wish, company name and telephone number (optional fields). To submit the form, users are required to confirm, by ticking the relevant box, that they have read this notice.

Users are asked not to include in their message any special categories of data (for example data concerning health, political opinions or religious beliefs, Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR), unless strictly necessary for the request.

2.3 Usage statistics

Subject to the user’s consent, the Website collects aggregate statistics on page views (for example pages visited, referring website, device and browser type, country). The tool used does not set cookies and does not store IP addresses in clear form. Details are provided in section 3.3 and in the Cookie Policy.

2.4 Cookies and other technologies

For information on the cookies used by the Website, please refer to the Cookie Policy.

3. Purposes and legal basis of processing

3.1 Operation and security of the Website

Browsing data are processed in order to deliver the Website pages, ensure the security of the Website and of the Controller’s systems, prevent and detect abuse or cyber attacks (including automated submissions of the contact form) and, where necessary, establish liability in the event of unlawful acts.

Legal basis: the Controller’s legitimate interest in ensuring the security and proper operation of the Website (Article 6(1)(f) GDPR).

3.2 Replying to requests sent through the contact form

Data provided through the form are processed solely to reply to the user’s request and to manage any resulting exchange of communications.

Legal basis: the taking of steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR) and, for requests that are not pre-contractual in nature, the Controller’s legitimate interest in responding to the communications it receives (Article 6(1)(f) GDPR).

Providing the data marked as mandatory is necessary in order to receive a reply: without them, the request cannot be handled. Providing the optional data does not affect the possibility of receiving a reply.

Data collected through the form are not used for marketing purposes, nor for sending newsletters or promotional communications.

3.3 Aggregate usage statistics

The Controller uses Umami, a web analytics software installed and operated directly on its own servers (self-hosted), in order to understand, in aggregate form, how the Website is used and to improve its content. The tool does not use cookies, does not store IP addresses in clear form, does not send any data to third parties and produces aggregate data only, which do not allow individual users to be identified.

Legal basis: the user’s consent (Article 6(1)(a) GDPR), given through the cookie banner (“Statistics” category). Consent may be withdrawn at any time through the Cookie preferences panel, without affecting the lawfulness of processing carried out before its withdrawal.

3.4 Compliance with legal obligations and protection of rights

Data may also be processed to comply with obligations laid down by law or by orders of the authorities (Article 6(1)(c) GDPR) and, where necessary, to establish, exercise or defend the Controller’s legal claims (Article 6(1)(f) GDPR).

4. Processing methods and security measures

Processing is carried out using electronic and telematic tools, in a manner strictly related to the purposes stated above and with technical and organisational measures appropriate to ensure the confidentiality, integrity and availability of the data, in accordance with Article 32 GDPR.

The Website is hosted on servers owned by the Controller and located at its premises in Italy. Communications with the Website take place over an encrypted connection (HTTPS). To protect the contact form against automated submissions and abuse, the Controller uses measures that do not rely on third-party services (hidden control fields and limits on the number of requests per IP address); no third-party CAPTCHA services are used.

The Website’s fonts and scripts are hosted directly on the Controller’s servers: browsing the Website does not involve loading resources from third-party content delivery networks (CDNs).

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

5. Recipients of the data

Data are processed by the Controller’s staff who have been authorised to process them and have received appropriate instructions (Article 29 GDPR and Article 2-quaterdecies of the Italian Data Protection Code).

Messages sent through the contact form are forwarded to the Controller’s business mailbox through its email service provider, Sendinblue SAS (Brevo), which acts as a data processor pursuant to Article 28 GDPR.

Where necessary, data may also be disclosed to consultants or suppliers providing technical or professional support services to the Controller, appointed as data processors, and to public authorities where required by law.

Data are not disseminated, nor transferred or sold to third parties.

6. Transfer of data outside the European Union

The Website and the related browsing and statistical data reside on servers located in Italy. The Controller does not intentionally transfer personal data to countries outside the European Economic Area. The email service provider stores data on servers located in the European Union; where, in the course of its services (for example technical support provided by companies of its group or by its sub-processors), it processes data outside the European Economic Area, the transfer is based on the standard contractual clauses adopted by the European Commission (Article 46 GDPR) or, for participating US recipients, on the adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR).

7. Retention period

• Server technical logs (browsing data): retained for [DA VERIFICARE: 30 days] and then automatically deleted, unless they need to be kept longer to investigate unlawful acts or following a request from the authorities.
• Contact form data: recorded in a database hosted on the Controller’s servers, retained for as long as necessary to handle the request and in any case for no longer than 24 months from receipt, after which they are automatically deleted. Should the request lead to a contractual relationship, the data will be retained for the duration of that relationship and thereafter for the periods required by applicable law, as set out in the notice provided at that time.
• Statistical data: retained in aggregate form, which does not allow users to be identified.

Data may be retained for longer periods where necessary to comply with legal obligations or to protect the Controller’s rights.

8. Rights of the data subject

As a data subject, the user may at any time exercise the rights provided for by Articles 15 to 22 GDPR, and in particular:

• access: to obtain confirmation as to whether data concerning them are being processed and to receive a copy (Article 15);
• rectification: to have inaccurate data corrected or incomplete data completed (Article 16);
• erasure: to obtain the erasure of data in the cases provided for (Article 17);
• restriction: to obtain the restriction of processing in the cases provided for (Article 18);
• portability: to receive the data they have provided in a structured, commonly used and machine-readable format and to transmit them to another controller, in the cases provided for (Article 20);
• objection: to object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (Article 21);
• withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3)). Consent to statistics can be withdrawn directly from the Cookie preferences panel.

Requests may be sent to info@professioneinformatica.eu or by post to the Controller’s address. The Controller will reply without undue delay and in any event within one month of receipt of the request, a period which may be extended in the cases provided for by Article 12(3) GDPR. It may be necessary to verify the identity of the requester in order to handle the request.

9. Right to lodge a complaint

If they consider that the processing of their data infringes the GDPR, data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR), without prejudice to the right to bring proceedings before the courts.

10. Minors

The Website is not intended for children under the age of 14 and the Controller does not knowingly collect personal data relating to them. Should the Controller become aware that it has received data from a child under 14, it will delete them.

11. Links to external websites

The Website may contain links to third-party websites, such as the link to Google Maps or OpenStreetMap to view the location of the Controller’s premises. These services are not embedded in the Website: they are reached only if the user chooses to click on the link, and from that moment the privacy and cookie policies of the respective providers apply, over which the Controller has no control.

12. Changes to this notice

The Controller may amend or update this notice, including as a result of changes in legislation or in the services offered through the Website. The updated version is always published on this page, together with the date of the last update. Users are invited to consult it periodically.