Privacy Policy

1. Scope, controller and contact

This notice covers personaletedesco.it, its Italian and English pages and enquiries submitted through the contact panel. External sites linked from these pages have their own notices; subsequent professional services may require specific information.

The controller is Leo Borsutzky, operating under the Klarsons brand, Strada Leontina 129, 47865 San Leo (RN), Italy; VAT number IT04462160401.

For the site and your rights, write to info@personaletedesco.it, managed by Leo Borsutzky. Within the organisation, only Leo is authorised to access the data and enquiries received through this site; no other collaborator is authorised to consult them. Technical providers can carry out the processing needed to deliver the services described below.

2. Data collected and sources

The form requires email and message; name and phone are optional. It also sends language, source page and technical information against automated submissions; date and time are added to the email. Attachments are not supported. Limit your text to what the enquiry needs; avoid credentials, identity documents, health data or other irrelevant information.

Opening the panel does not start a conversation with an operator or automatically send its fields: the enquiry is sent when you press the submit button. The form flow is addressed to info@personaletedesco.it; the visitor's address is used to reply. The site does not create a separate conversation archive outside email.

Connections involve network addresses and technical data needed for transmission, operation and security. Anti-abuse controls also use an identifier derived from the network address: this reduces exposure of the address without automatically making the data anonymous.

3. Purposes and legal bases

T1 — Enquiries from a person who could personally be a contracting party: receive and handle the enquiry, quotation and necessary pre-contractual exchanges requested by that person. Basis: Art. 6(1)(b) GDPR. This does not automatically extend to an employee writing for a company.

T2 — Business representatives and general information: answer the contact and handle relevant follow-up. Basis: Art. 6(1)(f), the concrete interest in answering enquiries and coordinating the relationship with the represented organisation.

T3 — Pages and contact panel: provide requested pages and open the panel on the user's action. Basis: Art. 6(1)(f), the interest in making information and the contact channel available. We do not use browser storage to anticipate a contact request.

T4 — Anti-abuse, diagnosis and continuity: prevent spam and saturation, identify faults or incidents and restore service. Basis: Art. 6(1)(f), availability and integrity of the site and communications. Data are limited to what is relevant to these functions.

T5 — Exercise of rights: receive and proportionately verify the request, respond and retain a minimal outcome. Basis: Art. 6(1)(c), the duties under Arts. 12 and 15–22 GDPR and accountability under Art. 5(2).

For legitimate-interest processing, the balancing assessment considers the response expected by the user, restricted access, minimisation, proportionate retention, the risk of control errors and an alternative email contact. The form does not subscribe you to newsletters or introduce contact enrichment, profiling or AI training. Sending an enquiry is not general consent to further uses.

Subsequent contracts and accounting duties have their own purposes and bases. A concrete legal-defence need requires a specific documented restriction, without automatically extending retention of every message.

4. Providing data and consequences

You can browse without using the form. A valid email and message are necessary to submit; omitting name and phone does not prevent an enquiry. Controls can reject invalid data or submissions beyond 5 requests in 1 hour per network address; people using a shared network can share that quota. Direct contact at info@personaletedesco.it is available. No marketing subscription or general-consent checkbox is required.

5. Recipients and providers

Enquiries are addressed to info@personaletedesco.it and organisational handling by Leo alone. Technical providers are OVHcloud for web hosting and Aruba Dominio con Email for email. They handle the data needed for these services, including through authorised staff and subcontractors for infrastructure, security and support. We do not make enquiries available to other collaborators.

The site's DNS is moving from Wix to Cloudflare: Wix continues to answer during the transition; Cloudflare becomes the authoritative DNS service when delegation is active. The Cloudflare DNS-only configuration resolves names to the server and does not route HTTPS traffic or form content through its proxy. DNS and account administration involve technical processing separate from enquiry content.

Aruba remains the registrar. Providers can independently process data needed for their own account, security and legal duties under their respective notices. Relevant data-protection terms apply to processing on our behalf. Information: Aruba, OVHcloud, Cloudflare, Wix.

Enquiries are not sold or disclosed for others' marketing. Any disclosure to an authority is limited to legal duties or the protection of a concrete right.

6. Countries, access and transfers

The web server is OVHcloud in Frankfurt, Germany. Aruba states that its standard email service uses Italian data centres. These locations do not guarantee that every support access or technical copy is at the same site. Leo's email handling can include access through a local client; we do not state that all copies are on the web server alone.

Cloudflare describes a global organisation and data processed primarily in the United States and the European Economic Area, with support access and subcontractors in multiple countries. For EEA-to-US transfers it states that it relies on the EU–US Data Privacy Framework; for other international transfers it describes the use of standard contractual clauses, supplemented where necessary by additional measures. These are safeguards described by the provider, not a promise of exclusive EEA storage.

You can consult Cloudflare's transfer information, its DPA and applicable clauses and the subcontractor list with activities and countries. For Aruba and OVHcloud, the Aruba data-protection terms and OVHcloud DPA are available. Write to info@personaletedesco.it for information about relevant safeguards or a copy, with only omissions needed to protect other people's data and confidential information.

7. Retention and deletion

Enquiries that do not become contracts are retained for a maximum of 12 calendar months from documented closure. Closure is the final reply or a documented decision not to follow up further. Leo checks deadlines every 30 days and schedules deletion by the deadline, including in identified email copies. Only relevant data move into a contractual file with specific rules.

For the exercise of rights, we retain a minimal record of the request, verification and outcome for 3 years from closure. Identity-document copies are removed as soon as verification ends, unless a specific documented need applies.

Anti-abuse controls consider a 1-hour window. Expired references are excluded from the count and removed at the next state check; the window is not a maximum physical-deletion deadline. These data are not used to track browsing or build a commercial profile.

Dedicated site logs are retained for a maximum of 4 days, technical form outcomes for 7 days and separately managed derived copies for 14 days. For the shared system journal, a 14-day retention threshold and, for its persistent disk copy, a 256 MiB space limit are configured. Forwarding to a text log is also configured, with weekly rotation retaining 4 archives in addition to the active file. Deletion applies to rotated files: these criteria do not guarantee physical deletion of every record within 14 days; persistence in active files and forwarded copies depends on their respective rotations being carried out. Monitoring uses a 24-hour control window; its alert-send ledger is retained for 30 days from the end of the monitoring window and alert messages for 30 days from incident closure.

For backup copies containing visitor data that we manage directly, the retention period is 30 calendar days from capture, with physical removal within a further 7 days. OVHcloud's automated backup of the whole VPS system can include technical site data and is configured to run daily with a rotation of 1 restore point. How long the point remains depends on subsequent backup cycles completing and may be extended if executions fail. This criterion does not guarantee physical deletion of all the provider's technical copies within the periods stated for directly managed copies. Site recovery kits contain the release and configurations needed for restoration; they are not an archive of visitors' messages. We do not retain enquiries in them to extend these periods. For a copy that cannot be removed immediately, we restrict access and use until removal; after restoration, we reapply relevant deletions before reusing the data.

A concrete legal-defence need can require retention of only relevant data for the documented time needed for that case. The controller checks when the restriction ends; this does not automatically extend every message or promise instant deletion of all technical copies.

8. Cookies and browser storage

The site does not activate analytics, advertising, profiling or third-party chat; images, fonts and resources are local.

The contact panel opens only when you press its button. We do not save browsing or automatic-opening states in browser storage; form fields are not saved in that storage and are transmitted when you press submit.

With optional functions disabled, the site does not read or write an earlier consent preference. It does not automatically delete data left by a previous version: you can remove them in browser settings. Future optional functions require relevant information and choice before activation.

9. Security and automated decisions

We use encrypted connections, request-format and size checks, anti-spam measures, submission limits and protected access. No measure offers an absolute security guarantee.

The site does not perform profiling or solely automated decisions producing legal or similarly significant effects. Controls can reject invalid or abusive requests; direct email contact remains available.

10. Rights and complaints

Subject to the GDPR conditions, you can request access, rectification, erasure and restriction. You can object, on grounds relating to your particular situation, to processing based on legitimate interests. The controller assesses any compelling legitimate grounds or legal-defence needs. Portability concerns data you provided that are processed by automated means on a contract or consent basis, where applicable.

Write to info@personaletedesco.it, managed by Leo. We respond without undue delay and in any event within 1 month; any extension of up to a further 2 months due to complexity or the number of requests is communicated with reasons within the first month. Further identity information is requested only where there is reasonable doubt and only as necessary.

You can complain to the Italian Data Protection Authority, through garanteprivacy.it, or the competent authority, and seek a judicial remedy. Contacting the controller does not restrict a complaint.

11. Version and updates

Last updated: 2026-10-21. Equivalent Italian and English information is available at /privacy-policy and /en/privacy-policy. We update this notice when the described processing changes.