Privacy notice
Provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Personal Data Protection Code), as subsequently amended. Last updated: October 2026. This is a courtesy translation; in case of discrepancy, the Italian version prevails.
1. Data controller
Michele Di Lorenzo, professional under Italian Law no. 4 of 14 January 2013, VAT no. IT14702560963, place of business: Via Brunico 22, 20126 Milan, Italy. Email: advisory@micheledilorenzo.com. No data protection officer has been designated, as the conditions laid down in Article 37 GDPR are not met. I reply to requests from data subjects without undue delay and in any event within one month of receipt; that period may be extended by two further months where necessary, taking into account the complexity and number of the requests (Article 12 GDPR).
2. Personal data processed
- Data provided through the contact form: full name, email address, company, phone number (optional) and the free text in which you describe the reason for your request (optional). When the form is submitted, the platform also records your IP address, browser (user agent), referring page and date and time, which are also used by the spam filter.
- Data provided by email, phone, WhatsApp or LinkedIn: the data contained in your communication.
- Browsing data: IP address, date and time of the request, browser type and operating system, pages requested. These are collected by the hosting provider's technical systems for the operation and security of the website.
The website does not request special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR) and is not directed at minors. Please do not include such data in the free text, nor data about other people that is not needed for your request.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to your request and arranging a possible intro call | Pre-contractual measures taken at the data subject's request (Art. 6.1.b GDPR) |
| Managing any professional engagement and related administrative, accounting and tax obligations | Performance of a contract and legal obligations (Art. 6.1.b and 6.1.c GDPR) |
| Ensuring the operation and security of the website and preventing abuse and automated submissions (spam) | Legitimate interest of the controller in a secure and functioning service (Art. 6.1.f GDPR) |
| Establishing, exercising or defending legal claims | Legitimate interest of the controller (Art. 6.1.f GDPR) |
Data are not used to send promotional communications or newsletters, nor passed on to third parties for commercial purposes.
4. Whether providing data is required
Providing the data marked as mandatory in the form is necessary in order to reply to your request: without them no reply is possible. The phone number and the free text are optional. For an engagement, the data needed to enter into the contract and to invoice are a contractual and legal requirement: without them the engagement cannot proceed. The checkbox relating to this notice constitutes acknowledgement of having read it, not consent to processing, which relies on the legal bases set out in section 3.
5. Processing methods and retention
Data are processed by electronic means, with technical and organizational measures appropriate to ensure security and confidentiality (Article 32 GDPR). Access is limited to the controller and to the recipients listed in section 6.
| Data category | Retention period |
|---|---|
| Contact requests that do not lead to an engagement | Up to 24 months from the last exchange |
| Data relating to a professional engagement | Duration of the relationship and thereafter the periods required by tax and civil law (normally 10 years) |
| Requests received through the form and stored on the hosting platform | Until deleted by the controller, and in any case within the periods above |
| Browsing data and the hosting provider's technical logs | Under the provider's DPA, logs of the components supporting its services are retained online for 90 days and offline for 1 year |
6. Recipients and transfers outside the European Economic Area (EEA)
Data may be disclosed to the following recipients:
| Recipient | Role | Transfer outside the EEA |
|---|---|---|
| Netlify, Inc., 101 2nd Street, San Francisco, CA 94105 (United States) | Processor (Article 28 GDPR): website hosting and management of form submissions, including spam filtering | Yes, in particular to the United States. Netlify, Inc. is a self-certified participant in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795 of 10 July 2023); the standard contractual clauses (Implementing Decision (EU) 2021/914) apply as a fallback |
| Google, provider of the Google Workspace service | Processor (Article 28 GDPR): email | Yes, to non-EEA countries where Google or its sub-processors maintain facilities, including the United States: to Google LLC under the EU-U.S. Data Privacy Framework; otherwise the standard contractual clauses in Google's data processing terms apply |
| Professional advisers (accountant, legal advisers where applicable) | Accounting, tax and legal obligations; they act as independent controllers or, for specific tasks, as processors | No |
Netlify acts as a processor on the basis of its Data Processing Agreement (DPA), which the provider states forms part of its contractual terms. Netlify in turn engages sub-processors, whose up-to-date list it publishes; among them is the provider of the form's spam filter (currently Automattic, Inc., Akismet service). You can request a copy of the safeguards adopted for transfers by writing to the email address given in section 1.
If you choose to contact me through WhatsApp or LinkedIn, those providers process data as independent controllers under their own privacy policies. Data are not disseminated or disclosed to other parties, except where required by law or by judicial authorities.
Styles, fonts and images are embedded in the website: simply browsing the pages does not trigger requests to third-party servers.
7. Cookies
The website uses no cookies, whether technical, profiling or analytics cookies, and no other tracking tools: no consent is therefore required and no banner is shown (Italian Data Protection Authority's guidelines on cookies and other tracking tools of 10 June 2021). The language is chosen with the IT/EN links on every page, without storing any information on your device.
8. No automated decision-making
No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out. The organizational check-up on the website processes your answers exclusively in your browser, transmits and stores no data and produces no legal effects.
9. Your rights
You may at any time exercise the rights set out in Articles 15–22 GDPR: access, rectification, erasure, restriction of processing and data portability (in the cases provided for by Article 20 GDPR). Requests should be sent to advisory@micheledilorenzo.com and are free of charge, except for manifestly unfounded or excessive requests.
Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Article 21 GDPR).
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). In Italy the authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome (www.garanteprivacy.it). You may also bring proceedings before the courts (Article 79 GDPR).
10. Changes to this notice
This notice may be updated to reflect legal, technical or organizational changes. The current version is always published on this page, with the date of the latest update.