Privacy policy

1. Data controller

The data controller for personal data collected through this website is:

Gelato IT Consulting S.r.l.s
Via Tazio Nuvolari, 2 - 40055 Castenaso (BO), Italy
VAT/Tax code: IT03807951201
Email: info@andreabandiera.it
Certified email: amministrazione@pec.gelatoitconsulting.it
Phone: +39 051 19615315

2. Data processed

The website may process the following categories of data:

• Browsing and security data: technical data normally transmitted while browsing and data needed to secure the website and form, such as IP address, browser information, request date and time, and technical signals processed to prevent abuse.
• Contact form data: name, email address, phone number, company, country, request type, message text and any other information voluntarily entered by the user.
• Anti-spam data: the contact form uses Cloudflare Turnstile to distinguish real users from automated activity. The service processes technical signals and returns a token that is verified server-side before the request is sent.

As of the update date of this notice, the website does not use analytics, advertising, profiling tools or a tag manager. Google Maps links are ordinary external links: Google only receives data after the user voluntarily opens one.

3. Purposes and legal bases

Data are processed to:

• reply to enquiries about consulting, courses and ReadyToGo, and take pre-contractual steps requested by the user (Article 6(1)(b) GDPR);
• protect the form and infrastructure from spam, fraud and misuse, based on the controller’s legitimate interest in service security (Article 6(1)(f) GDPR);
• comply with applicable legal obligations (Article 6(1)(c) GDPR).

The checkbox on the contact form acknowledges this notice; it does not authorise marketing or profiling.

4. Recipients and providers

Personal data are not disclosed publicly. They may be processed, only as needed for the purposes above, by persons authorised by the controller and by service providers supporting the website:

• Cloudflare, for hosting, content delivery and Turnstile anti-spam protection; Cloudflare privacy policy and Turnstile privacy addendum;
• Brevo, to send the transactional email generated by the contact form; Brevo privacy policy.

Where required, the controller verifies that its relationship with providers is governed by agreements compliant with applicable data-protection law, including Brevo’s data processing agreement.

5. International transfers

Some providers may process data outside the European Economic Area. In those cases, transfers take place only where safeguards required by applicable law are in place, such as adequacy decisions or standard contractual clauses. Please refer to the providers’ notices linked above for current details of their processing.

6. Retention period

Data submitted through the contact form are retained for the time needed to handle the enquiry and, in any event, for no more than 24 months after the last contact, unless longer retention is required by law or by a relationship started with the user. Technical security data are retained for periods compatible with their purpose and the providers’ settings.

7. Data subject rights

Where the GDPR applies, data subjects may ask the controller for access, rectification, erasure, restriction, portability and objection. They may also lodge a complaint with the relevant data-protection authority.

To exercise these rights or request information about processing: info@andreabandiera.it or certified email amministrazione@pec.gelatoitconsulting.it.

8. Updates

This notice was updated on 1 October 2026. It will be updated before enabling new analytics, advertising, embedded content or further providers that involve processing beyond that described here.