This policy explains how personal data collected through the website operated under the GovernData trade name (the “Website”) is processed. It concerns the Website only. It does not govern the processing of personal data within a client engagement, which is addressed in the Expert’s engagement terms.

Last updated: July 1, 2026

1. Data Controller

1. The controller of the personal data processed through the Website is the entity identified by Italian VAT No., operating under the trade name “GovernData” (the “Controller”, “we”, “us”, or “our”).

2. What This Policy Covers

1. This Notice covers personal data we collect when you visit the Website, contact us through it, or otherwise interact with it. GovernData is a trade name for a network of independent professionals and is not itself a legal entity; the Controller named above is responsible for the Website.

3. Categories of Personal Data We Process

1. Contact data: name, email address, company, role, and the content of any message you send via a contact form or email.
2. Technical data: IP address, browser type and version, device information, and pages visited, collected through server logs and cookies.
3. Usage data: information about how you use the Website, where analytics are enabled.

4. Purposes and Legal Bases

1. Responding to enquiries — to handle requests you submit. Legal basis: our legitimate interest in responding, and steps taken at your request prior to a possible engagement (Article 6(1)(f) and 6(1)(b) GDPR).
2. Operating and securing the Website — Legal basis: legitimate interest in a functioning, secure site (Article 6(1)(f) GDPR).
3. Analytics and non-essential cookies — only where you consent (Article 6(1)(a) GDPR and applicable ePrivacy rules).
4. Compliance with legal obligations — Legal basis: Article 6(1)(c) GDPR.

5. Cookies and Similar Technologies

1. The Website uses cookies and similar technologies. Strictly necessary cookies are used to operate the Website and do not require consent. Analytics, functional, and marketing cookies are used only with your consent, which you may give or refuse through the cookie banner and withdraw at any time.
2. The cookies used are: [LIST COOKIES — name, provider, purpose, duration]. A cookie management tool is available on the Website to review and change your preferences.

6. Recipients and Processors

1. We may share personal data with service providers acting as our processors (for example website hosting, email, and analytics providers), bound by data processing agreements under Article 28 GDPR. Current providers include: [LIST PROCESSORS / HOSTING / ANALYTICS].
2. We do not sell personal data. We may disclose data where required by law or to defend legal claims.

7. International Transfers

1. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision where applicable, or otherwise on appropriate safeguards under Chapter V of the GDPR, including Standard Contractual Clauses adopted by the European Commission. Details: transfers are carried out subject to such Standard Contractual Clauses and, where required, supplementary technical and organisational measures.

8. Retention

1. We keep personal data only as long as necessary for the purposes described, after which it is deleted or anonymised. Enquiry data is generally kept for twenty-four (24) months unless a longer period is required by law or to defend a claim.

9. Your Rights

1. Subject to the conditions in the GDPR, you have the right to access, rectification, erasure, restriction, data portability, and to object to processing, and to withdraw consent at any time without affecting prior processing.
2. To exercise these rights, contact us at [PRIVACY CONTACT EMAIL]. We respond within the time limits set by the GDPR.

10. Security

1. We implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

11. Children

1. The Website is intended for business users and is not directed at children. We do not knowingly collect data from children.

12. Changes to This Notice

1. We may update this Notice from time to time. The current version is always available on the Website, with the date of last update shown above.