Privacy policy

Data controller

The data controller is Giuseppe Foti — a sole proprietorship, VAT 03974730792. For any matter relating to personal data you may write to info@gflexconsulting.it. No Data Protection Officer (DPO) has been appointed, as the conditions for it do not apply.

What data we process

This site requires no registration, has no newsletter and uses no profiling tools. The only data processed are the following:

• Data you provide to us — by filling in the contact form (full name, email, area of interest, message content), by writing to the practice’s email address or by contacting us via WhatsApp (number, profile and message content). We ask you not to include in your message data belonging to special categories (Article 9 GDPR: health, beliefs, etc.): on first contact it is enough to describe the matter in general terms.
• Browsing data — for the operation and security of the site, the hosting provider’s systems record technical logs such as IP address, date and time of the request and browser information. These data are necessary to deliver the site and to prevent abuse.
• Cookies — the site uses no profiling cookies and no tracking tools; any technical cookies are described in the cookie policy.

Why we process them and on what legal bases

• To reply to you. Data sent through the form or by email are processed to respond to your request. The legal basis is the performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR); for requests not connected to a possible engagement, the consent you express by sending the message after reading this notice (Article 6(1)(a) GDPR).
• For the site’s security. Technical logs are processed on the basis of the controller’s legitimate interest in ensuring the operation and security of the infrastructure (Article 6(1)(f) GDPR).
• To comply with legal obligations. If an engagement arises from the contact, the necessary data are also processed for accounting and tax obligations (Article 6(1)(c) GDPR).
• To protect a right. Where necessary, data may be processed to establish, exercise or defend a right of the controller (Article 6(1)(f) GDPR).

Providing data is voluntary, but the fields marked as required in the form are necessary in order to reply to you. There is no automated decision-making or profiling (Article 22 GDPR); no data is processed for marketing purposes.

Who the data may be disclosed to

Data are not disseminated or sold for commercial purposes. They may be accessed only, each within its own remit, by:

• the hosting provider (Vercel Inc., based in the United States) that supplies the site’s infrastructure, as a data processor under Article 28 GDPR;
• the provider of the contact-form delivery service (as of now: Formspree, Inc.), also a processor under Article 28 GDPR;
• the provider of the practice’s email service (as of now: Zoho Corporation), which processes messages sent to the practice’s email addresses as a processor under Article 28 GDPR;
• WhatsApp (WhatsApp Ireland Ltd, Meta Platforms group), if you choose to contact us through this channel: the conversation data are also processed under WhatsApp/Meta’s privacy policy, with possible transfers to third countries (United States);
• any professionals or suppliers the controller relies on, bound by confidentiality, where this is necessary to handle your request or legal obligations.

Transfers outside the European Union

Some technical providers may process data in third countries, in particular the United States. In that case the transfer takes place with the safeguards provided by Articles 44 et seq. of the GDPR: an adequacy decision of the European Commission (for the United States, the EU–U.S. Data Privacy Framework, for certified providers) or the standard contractual clauses under Article 46. Details are set out in the privacy notices of the individual providers.

How long we keep them

• Messages and contact requests: for as long as needed to respond and to handle any follow-ups; if no engagement follows the contact, as a rule no longer than twelve months.
• Data relating to engagements: for the duration of the relationship and, after it ends, for the retention periods required by law for contractual, accounting and tax documentation.
• Technical logs: for the short periods strictly necessary for security purposes, according to the hosting provider’s settings.

Your rights

In Articles 15 to 22 the GDPR grants you, among others, the rights of access, rectification, erasure, restriction of processing, objection and data portability. Where processing is based on consent, you may withdraw it at any time (Article 7(3) GDPR), without affecting processing already carried out. To exercise your rights, simply write to info@gflexconsulting.it.

If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali; Article 77 GDPR; garanteprivacy.it).

Updates to this notice

This notice is in force from June 2026. Any changes — for example in the case of new tools or providers — will be published on this page with the date of the update.