1. Data Controller

The data controller for personal data is:

2. Types of Data Collected

We collect only the following data:

• Contact data voluntarily provided through the contact form (name, email, phone, message)
• Technical website functionality data (splash screen shown, information banner dismissed) stored in browser localStorage/sessionStorage
• No profiling or behavioral tracking data

3. Processing Purposes

Personal data is processed exclusively for the following purposes:

• Respond to information requests sent through the contact form
• Provide assistance and support related to user requests
• Ensure proper functioning of the website

We do NOT use data for marketing, profiling, or sending unsolicited promotional communications.

4. Legal Basis for Processing

Data processing is based on:

• Consent of the data subject (Art. 6(1)(a) GDPR) for data voluntarily provided through forms
• Legitimate interest of the controller (Art. 6(1)(f) GDPR) for strictly necessary technical cookies

5. Retention Period

Personal data will be retained for:

• Contact form data: until request completion and for a maximum of 24 months
• Technical data (localStorage): until deletion by user or browser
• Data will be automatically deleted at the end of the retention period

6. Data Communication and Transfer

Data management and storage:

• Contact form data is collected and stored exclusively through Google Forms (forms.gle), managed according to Google's Privacy Policy
• The contact form redirects to an external Google Forms page, therefore data is managed directly by Google LLC
• The website is hosted on Vercel (USA), which does NOT store, collect, or process any user personal data
• We do NOT store any personal data in databases, servers, or website storage
• Data is NOT sold, transferred, or shared with third parties for commercial purposes
• Data is NOT subject to automated decision-making or profiling

7. Data Subject Rights

As a data subject, you have the right to:

• Access your personal data (Art. 15 GDPR)
• Request rectification of inaccurate data (Art. 16 GDPR)
• Request deletion of data (Art. 17 GDPR)
• Request restriction of processing (Art. 18 GDPR)
• Object to processing (Art. 21 GDPR)
• Request data portability (Art. 20 GDPR)
• Withdraw consent at any time (Art. 7 GDPR)
• Lodge a complaint with the Data Protection Authority

To exercise your rights, contact us at: bompieri@bompieri.it

8. Data Security

We adopt appropriate technical measures to protect communications:

• Encrypted HTTPS connection for all communications between browser and server
• Contact form data is managed by Google Forms, which applies its own security measures according to Google LLC standards
• The website does NOT store personal data, therefore no backups or disaster recovery procedures for user data are necessary
• Locally stored technical data (splash screen and banner) does not contain personally identifiable information

9. Cookies

The site uses only strictly necessary technical cookies for operation. We do NOT use profiling, marketing, or tracking cookies.

For more information, see our Cookie Policy.

10. Changes to Privacy Policy

This policy may be updated periodically to reflect regulatory or operational changes. We invite you to consult it regularly. The last update date is shown at the top of the page.

11. Contact

For any questions, requests, or exercise of rights related to personal data processing, you can contact us at: