This page explains what personal data this website processes, why, for how long, and how you can exercise your rights under the GDPR (Regulation EU 2016/679).
Last updated:
1. Who is responsible for your data
The data controller for this website is RM Solution di Romeo Mattolini, a sole trader registered in Italy and based in Palaia, in the province of Pisa.
Registered address:Str. Prov. 11 delle Colline per Legoli 12, Palaia (PI), Italy
VAT number (partita IVA):02589970504
No Data Protection Officer has been appointed, as RM Solution is not required to appoint one under Article 37 of the GDPR.
2. What data is processed
This website is a static site. It runs no advertising, no profiling and no social media tracking. It uses one measurement tool, Google Analytics 4, which loads only if you consent to it. Four kinds of data are involved.
a. Data you choose to send
If you write, call or message on WhatsApp, the content of your message and the contact details you use are processed in order to reply. Please send only what is needed for the enquiry, and avoid special categories of data such as health, religious or political information.
The contact form on the homepage sends exactly what you type into it — your name, your email address, the name of your business if you give one, and your message — to the email address above. The website itself stores none of it: the message is checked, passed straight to an email delivery service and forgotten. Your email address is used only to reply to you.
The delivery service used isZoho ZeptoMail. It acts as a data processor under Article 28 of the GDPR and handles the message only in order to deliver it. Nothing is loaded from it in your browser: the message leaves this website from the server, not from your device.
b. Technical data recorded by the hosting provider
Like every website, the server that delivers these pages records standard connection data: IP address, date and time of the request, the page requested, the browser and operating system reported by your device, and the referring page. These records exist to deliver the site and to protect it from abuse. They are not used to identify or profile visitors.
c. Preferences stored in your own browser
One small value is saved in your browser's local storage. It stays on your device, is never sent to a server and is not readable by anyone else.
rm-consent — remembers your choice on this page's consent banner.
If you accept measurement on the consent banner, this website loads Google Analytics 4 and sets two cookies, “_ga” and “_ga_LH5YZ2NRB5”. They are used to count visits and to see which pages are read and roughly where visitors arrived from — not to identify you. Until you accept, nothing is requested from Google at all, and if you withdraw your consent the cookies are deleted again.
Google Analytics 4 does not log or store individual IP addresses: an address is used briefly to work out an approximate location, then discarded. On top of that, Google Consent Mode keeps advertising storage, ad personalisation and ad user data denied at all times, so the measurement data is never used for advertising purposes.
3. Why, and on what legal basis
Purpose
Legal basis (GDPR Art. 6)
Replying to your enquiry and preparing a possible quote
Art. 6(1)(b) — steps taken at your request before entering into a contract
Delivering the website and keeping it secure and available
Art. 6(1)(f) — legitimate interest in operating a functioning, protected website
Remembering your consent choice
Strictly necessary to provide the service you asked for; no consent required
Meeting accounting and tax obligations, if you become a client
Art. 6(1)(c) — compliance with a legal obligation
Measuring which pages are read, with Google Analytics 4
Art. 6(1)(a) — your consent, requested in advance and withdrawable at any time
Providing your data is never mandatory, but without contact details it is not possible to reply to an enquiry.
4. Who else is involved
Your data is not sold, rented or shared for marketing. It is accessible only to RM Solution and to the suppliers strictly needed to run the site and reply to you, each acting as a data processor under Article 28 of the GDPR.
Hosting and content delivery — the provider that serves these pages and keeps the security logs described above.
Email delivery — Zoho ZeptoMail, which carries a contact-form message from this website to the RM Solution mailbox. It is used for nothing else: no newsletter, no marketing, no mailing list.
WhatsApp — if you choose to start a WhatsApp conversation, that conversation takes place on WhatsApp's own infrastructure and is governed by WhatsApp's privacy policy, not by this one. Using WhatsApp is entirely optional; the phone number and, once published, the email address are alternatives.
Measurement — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides Google Analytics 4 and acts as a data processor under Article 28 of the GDPR. It receives measurement data only from visitors who have consented to it.
Accountant and public authorities — only where a legal obligation requires it.
Apart from Google Analytics, and only once you have consented to it, this website embeds no third-party content: no external fonts, maps, videos, social widgets or advertising scripts are loaded.
5. Transfers outside the EEA
Some suppliers — the content delivery network, the email delivery service, Google and WhatsApp — operate global infrastructure and may process data outside the European Economic Area. Where that happens, the transfer is covered by the safeguards allowed under Chapter V of the GDPR: the European Commission's Standard Contractual Clauses, or an adequacy decision. Transfers to Google LLC in the United States rely on the EU–US Data Privacy Framework, of which Google is a certified participant, together with the Standard Contractual Clauses. You may ask for a copy of the safeguards that apply.
6. How long data is kept
Enquiries that do not lead to a project:up to 12 months from the last message, then deleted.
Client project correspondence:for the duration of the project and up to 24 months afterwards, for support and warranty purposes.
Accounting records:10 years, as required by Italian law.
Server security logs:short retention periods set by the hosting provider, typically a few days to a few weeks.
Consent record:12 months, or until you clear your browser storage.
Measurement data:the retention period set on the Google Analytics property, after which Google deletes the user-level records. The two cookies expire 2 years after your last visit, or immediately if you withdraw consent.
7. Your rights
Under Articles 15 to 22 of the GDPR you can ask, at any time, to:
obtain confirmation of whether your data is being processed, and receive a copy of it;
have inaccurate or incomplete data corrected;
have your data erased, where there is no overriding obligation to keep it;
restrict processing, or object to processing based on legitimate interest;
receive your data in a portable, machine-readable format;
withdraw any consent you gave, without affecting what was lawful before the withdrawal.
To exercise any of these rights, use the phone number or WhatsApp above. There is no charge, and you will receive an answer within one month. Consent for optional storage can also be changed directly on this website at any time, using the settings button in the bottom corner of every page.
If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority in your country of residence.
8. Security
The site is served over an encrypted HTTPS connection. It runs no database and no login. The only processing that happens on the server is the contact form, which checks a message and passes it straight on without storing it, so there is no store of enquiries to breach. Messages received are kept in access-controlled accounts protected by strong, unique credentials.
9. Children
This website offers a professional service to businesses and is not directed at children. No data is knowingly collected from anyone under 14, the age of digital consent in Italy. If you believe a child has sent personal data, please get in touch and it will be deleted.
10. Changes to this policy
This policy will be updated whenever the website changes in a way that affects personal data — for example if the email delivery service changes or any measurement tool is added. The date at the top of the page always shows the current version.
