1. Scope of this notice
This notice is provided under Articles 12 and 13 of Regulation EU 2016/679, the GDPR, and applies to brunomuratore.consulting, its Italian and English pages, the call booking system and the WebCare client area. It does not apply to external websites reached through ordinary links.
2. Data Controller
ePiazza di Bruno Muratore
Via Duca di Salza 27, 80049 Somma Vesuviana (NA), Italy
Italian tax code MRTBNR77L15F839F - VAT number 07406001219
General email: info@brunomuratore.consulting
Certified email, PEC, and privacy contact: e-piazza@legalmail.it
3. Data processed and its source
The website processes data supplied directly by the user and technical data generated through use of the services. This may include:
- identification and contact data, such as name, email address and company;
- the content of emails, enquiries, booking notes, tickets and related replies;
- account and authentication data, user identifiers and session information;
- technical and usage data, such as IP address, browser, device, URL and the date and time of a request;
- pseudonymous statistical data collected by Google Analytics only after consent.
The website does not request health, biometric, political, religious or other special categories of data. Do not include them in emails, booking notes or support tickets. If they are received accidentally, they will be deleted as soon as possible unless a legal obligation requires their retention.
4. Purposes, legal bases and retention
Each processing activity is limited to a specific purpose. The periods below may be extended where retention is necessary to comply with a legal obligation, respond to a public authority, or establish, exercise or defend a legal claim. The periods stated below are the Controller's adopted retention policy and are applied through periodic reviews and the settings of the services used.
- Data
- Name, contact details, company and the content of communications voluntarily sent by email or certified email.
- Purpose
- Respond to questions, consulting enquiries and quote requests, and organise any necessary follow-up.
- Legal basis
- Pre-contractual steps requested by the data subject, Article 6(1)(b) GDPR; legitimate interest in handling non-contractual communications, Article 6(1)(f) GDPR.
- Retention
- Until the request is resolved and, as a rule, no longer than 24 months after the last meaningful contact. Data connected to a subsequent contract follows the contractual and administrative periods below.
- Data
- Name, email address, time zone, appointment date and time, answers to booking questions and any notes entered in Cal.com.
- Purpose
- Arrange the appointment, send confirmations and reminders, and follow up on the user's request.
- Legal basis
- Pre-contractual steps or performance of a contract, Article 6(1)(b) GDPR.
- Retention
- As a rule, up to 24 months after the appointment or its cancellation, unless the data is required for a contractual relationship, legal obligation or the protection of a legal right.
03Client area and WebCare support
- Data
- Email address, user identifier, session data, company, role, access status, creation dates, ticket subject and description, priority, status and conversation messages.
- Purpose
- Authenticate clients, verify access rights, provide support and maintain an operational history of requests.
- Legal basis
- Performance of a contract, Article 6(1)(b) GDPR; legitimate interest in security, traceability and service continuity, Article 6(1)(f) GDPR.
- Retention
- The client profile and access permissions are retained for the duration of WebCare access and for up to 24 months after deactivation. Tickets and messages are retained for up to 24 months after closure. These periods may be extended only to meet a legal obligation or protect a legal right.
04Administration, contracts and legal obligations
- Data
- Identification, tax, contractual and accounting data, together with correspondence relevant to the professional relationship.
- Purpose
- Manage the professional relationship, meet tax and accounting obligations and respond to lawful requests from public authorities.
- Legal basis
- Performance of a contract, Article 6(1)(b) GDPR; legal obligation, Article 6(1)(c) GDPR; protection of legal rights, Article 6(1)(f) GDPR.
- Retention
- Contractual and accounting records are retained for 10 years from the last entry, or longer where required by law, a tax audit, an investigation or legal proceedings.
05Security and technical operation
- Data
- IP address, requested URL, date and time, browser and device, authentication events and technical or error logs.
- Purpose
- Deliver the website, prevent abuse, protect systems and accounts, diagnose faults and maintain service continuity.
- Legal basis
- The Controller's legitimate interest in the security and reliability of its digital services, Article 6(1)(f) GDPR.
- Retention
- Logs available to the Controller are retained only as long as required for security and in any event no longer than 90 days. A longer period is allowed only to investigate an incident, meet a legal obligation or defend a legal right. Logs controlled exclusively by providers follow the documented periods for the service used.
06Statistics with Google Analytics 4
- Data
- Pseudonymous identifiers, cookies, visited pages, events, URLs, browser and device information and approximate geographic area.
- Purpose
- Understand statistically how the website is used and improve its content, navigation and performance.
- Legal basis
- Consent, Article 6(1)(a) GDPR, which may be withdrawn at any time.
- Retention
- User-level and event-level data is retained for no longer than 14 months. Google Analytics cookies may last up to 2 years, unless deleted or limited earlier by the browser.
5. Providing personal data
Data sent by email is optional, but a reply is not possible without contact details and the minimum information required to understand the issue. Data requested by Cal.com is necessary to book and manage an appointment. An email address and ticket details are necessary to access the WebCare client area and receive support. Consent to Google Analytics is always optional, and refusing it does not restrict any other website function.
6. Processing methods and security
Data is processed using digital tools by authorised persons and in accordance with the principles of lawfulness, fairness, transparency, minimisation and storage limitation. Technical and organisational safeguards proportionate to the risk are used, including access controls, authentication, encrypted connections, separation of privileges and system updates. No system can guarantee zero risk.
7. Providers and recipients
Within the limits required for the purposes described above, data may be processed by the Controller, authorised collaborators and technical providers used for hosting, content delivery, email, authentication, databases, support, bookings and statistical analysis. Providers acting on the Controller's behalf process data as processors under agreements compliant with Article 28 GDPR. Other recipients act in the role assigned by applicable law and their respective terms.
The main services integrated into the website are:
- Cal.com, Inc. manages the calendar and booking data on the Controller's behalf as a processor. It may process names, email addresses, time zones, appointment details, answers and technical data. Read the Cal.com privacy policy.
- Supabase, Inc. provides authentication, database services and the infrastructure used by the client area as a processor. It processes email addresses, account identifiers, roles and access status, session data, tickets and messages according to the project settings. Read the Supabase privacy policy and its data processing addendum.
- Google Ireland Limited is the contractual provider of Google Analytics 4 for users in the European Economic Area. Analytics loads only after consent. Google and its group companies may process pseudonymous identifiers, events and technical data under the service terms. Read the Google Analytics terms.
- Google Fonts remotely provides the IBM Plex font files. A request is made on every page and transmits technical connection data to Google, such as the IP address, browser, date, time and requested file. This processing is used to present a consistent, readable interface and is based on the Controller's legitimate interest, Article 6(1)(f) GDPR. The Controller does not use the request to create a profile. Read the Google privacy policy.
- broogle.io, a domain managed by the Controller, serves the portrait displayed on the About page. The server hosting the file receives standard HTTP request data; the page referrer is not sent.
Data may also be disclosed to professional advisers, administrative providers and public authorities where necessary or required by law. Personal data is not sold.
8. Google Analytics and cookies
The website uses Google Analytics 4, measurement ID G-L2B2BF4MXR. The tag does not load until statistical cookies are accepted. The choice is stored in the browser and can be changed at any time through “Cookie preferences” in the footer. Google states that GA4 uses IP addresses to determine an approximate geographic area and discards them before logging. Further information is available in the Cookie Policy.
9. Transfers outside the European Economic Area
Cal.com, Inc. is established in the United States and states that booking data is processed there. For transfers subject to the GDPR, its documentation provides for Standard Contractual Clauses or, where applicable, an adequacy mechanism such as the EU-US Data Privacy Framework. Supabase may process data in the project region selected by the Controller and through subprocessors in other countries; its data processing addendum incorporates Standard Contractual Clauses for transfers that require safeguards. Google Ireland Limited may use group companies and subprocessors outside the European Economic Area; Google states that it uses adequacy decisions and the Data Privacy Framework for covered transfers, and Standard Contractual Clauses in other cases. The sources and contractual safeguards are linked in the previous section; a copy or further information may be requested through the certified email address above.
10. Your rights
Where the GDPR applies, you may request access, rectification, erasure, restriction of processing or data portability, or object to processing based on legitimate interests. You may also withdraw consent to Google Analytics at any time without affecting the lawfulness of processing carried out before withdrawal.
Send requests to e-piazza@legalmail.it. Identity verification may be required to protect your data. The Controller normally responds within one month, subject to the extensions permitted by the GDPR for complex or numerous requests.
11. Complaints and legal remedies
If you believe that processing infringes data protection law, you may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, or seek a judicial remedy. Information and the complaint form are available on the Garante website.
12. Children, profiling and automated decisions
The professional services described on this website are not directed at children. The Controller does not use data collected through the website for solely automated decisions producing legal or similarly significant effects and does not perform commercial profiling.
13. Changes to this notice
This notice is updated when services, purposes, providers or applicable law change. The version published on this page, identified by its update date, replaces earlier versions. For material changes, the Controller will use a notice proportionate to the context and, where a direct relationship exists, may also notify the data subject by email.