⚠️ DRAFT — not to be used before review by a qualified professional.
Last updated: [DATE]
Data controller
The data controller is [FULL NAME / COMPANY NAME], [ADDRESS], VAT number [No.], email [CONTACT EMAIL].
What data we process
Service listings: the data you choose to publish (public name, category, description, contacts, photo, languages and service area) and the contact details for the administrators (contact person name and email), which are not published.
Reviews: the name provided, rating, comment and date. To prevent abuse we store a code derived from the IP address (irreversible keyed hash), not the IP itself.
Admin panel: one technical session cookie, used only by the administrator.
We do not use tracking, advertising or third-party analytics cookies. Fonts and photos are served by the site itself.
Purposes and legal bases
Publishing and maintaining your profile: performance of the service you requested (Art. 6(1)(b) GDPR) and your consent to publication (Art. 6(1)(a)), which you may withdraw at any time.
Publishing reviews: legitimate interest in providing useful information to the community (Art. 6(1)(f)).
Security and abuse prevention: legitimate interest (Art. 6(1)(f)).
Compliance with legal obligations (Art. 6(1)(c)).
Machine translation
Public texts (news and listing descriptions) may be sent to a machine-translation service — [PROVIDER] — only to generate versions in other languages. Contact details are never sent. If the provider is outside the EEA, transfers rely on standard contractual clauses.
Recipients
Our hosting provider ([NAME]) and, for public texts, the translation provider. We do not sell or share data for commercial purposes.
Retention
Profile and admin contact details: while the profile is active and up to [12] months after a deletion request.
Reviews: as long as the reviewed profile exists.
IP-derived code: up to 180 days.
Your rights
You may request access, rectification, erasure, restriction, portability, object to processing and withdraw consent by writing to [CONTACT EMAIL]. You may also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).