Privacy Policy

Controller: FMDigitech (Francesco Tontaro), operating in Italy. Privacy contact: [email protected].

No Data Protection Officer (DPO) has been appointed, as the conditions under Art. 37 GDPR do not apply to the activity currently carried out.

Account and authentication data (including sign-in via Google or Apple), contact details, tax and billing data, commercial requests, quotes, orders, support tickets, technical security logs, cookie preferences and consent records collected via the cookie banner.

Providing requested services and managing the client area — performance of pre-contractual/contractual measures (Art. 6.1.b GDPR).

Authentication via Google or Apple Sign-In — performance of a contract (Art. 6.1.b GDPR).

Processing payments via Stripe — performance of a contract and tax obligations (Art. 6.1.b and 6.1.c GDPR).

Responding to contact requests, quotes and support tickets — legitimate interest in handling received requests (Art. 6.1.f GDPR).

Site security, abuse prevention and protection from malicious traffic via Cloudflare — legitimate interest in system security (Art. 6.1.f GDPR).

Anonymised statistical analysis of traffic via Google Analytics — only with explicit consent given through the cookie banner (Art. 6.1.a GDPR).

Sending marketing communications — only with explicit, freely revocable consent (Art. 6.1.a GDPR).

Accounting and tax obligations — legal obligation (Art. 6.1.c GDPR).

Google Ireland Limited — "Sign in with Google" authentication and, only with consent, statistical analysis via Google Analytics (Google Tag Manager). Notice: policies.google.com/privacy.

Apple Inc. — "Sign in with Apple" authentication. Notice: apple.com/legal/privacy.

Stripe — online payment processing. Notice: stripe.com/privacy.

Cloudflare, Inc. — content delivery network (CDN) and web traffic security protection. Notice: cloudflare.com/privacypolicy.

Email servers and hosting infrastructure managed directly by FMDigitech or by providers based in the European Union.

Google, Apple, Stripe and Cloudflare may process data outside the European Economic Area. Transfers are covered by the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, where applicable.

Accounts: for the duration of the relationship and up to 12 months after deactivation, unless longer legal obligations apply.

Tax and billing data: per Italian legal obligations (typically 10 years).

Contacts and quotes: for the time needed to handle the request, unless otherwise agreed.

Security logs: proportionate periods, typically no longer than 12 months.

Google Analytics data: retained for 14 months, aggregated where possible.

Cookie preferences: 180 days, as described in the Cookie Policy.

Under Articles 15-22 GDPR you may at any time exercise the rights of access, rectification, erasure, restriction, portability, objection to processing and withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal. You can exercise them by writing to [email protected].

You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) if you believe the processing violates applicable law.

Providing the data needed to deliver requested services (e.g. contacts, quotes, billing) is necessary: failing to provide it prevents us from handling the request. Providing data for analytics or marketing purposes is instead optional and based on consent.