Privacy policy
LAST UPDATED:
How I handle the data of people who visit the site, book an analysis, a call or a consultation, take the Brand Scan or request the Strategic Artefacts. In short: only the data that is needed, only for what you ask, never sold to anyone. The Italian version is the reference text.
Who handles your data
The data controller is Mattia Forza, Via Sebastiano Caboto 4, 36100 Vicenza, Italy. VAT number IT04234940247. For any privacy request you can write to info@mattiaforza.com or to the certified email address mattiaforza@legalmail.it.
FORZA is the brand under which Mattia Forza offers brand strategy, brand identity and Fractional Brand Management services. No data protection officer (DPO) has been appointed, as it is not required for this activity.
What data, why and for how long
| What you do | Data processed | Why | Legal basis (GDPR, art. 6) | How long |
|---|---|---|---|---|
| You browse the site | IP address, browser, pages requested, date and time (technical logs) | To run the site and protect it from abuse | Legitimate interest (art. 6.1.f) | Kept by Netlify for up to 90 days online and up to 1 year in archive, under its data processing agreement |
| You accept statistics cookies | Browsing data collected by Google Analytics, in aggregate form | To understand how the site is used and improve it | Consent (art. 6.1.a) | 14 months |
| You book the preliminary analysis or a consultation | Name, email, company, website, role, answers to the questions, participants | To organise the session and provide the service | Performance of a contract or pre-contractual measures (art. 6.1.b) | For the duration of the relationship and 24 months after the last contact |
| You fill in the analysis questionnaire | Name, email, role, company details, answers, billing details | To prepare and carry out the analysis; to issue the invoice | Contract (art. 6.1.b); legal obligation for the invoice (art. 6.1.c) | Answers 24 months from submission; billing details 10 years, as required by law |
| You pay for a service | Company name, VAT number, SDI code or certified email, amount, payment outcome | To invoice and meet tax obligations | Legal obligation (art. 6.1.c) | 10 years (art. 2220 of the Italian Civil Code) |
| You book the intro call | Name, email, company, website, role, your question | To answer your request | Pre-contractual measures (art. 6.1.b) | 24 months from the last contact |
| You take the Brand Scan | Email, name and company if you provide them, answers to the questionnaire, result | To show you the result and email you a copy | Measures requested by you (art. 6.1.b) | 24 months, unless you ask for deletion earlier |
| You request the PDF of a Strategic Artefact | Email, name if you provide it | To send you the PDF | Measures requested by you (art. 6.1.b) | 24 months |
| You ask to be notified of new releases | Email, name if you provide it, date of confirmation | To notify you when a new volume comes out, after you have confirmed your subscription | Consent (art. 6.1.a) | Until you unsubscribe, with the link in every email |
| You email me | The data you choose to send me | To reply to you | Pre-contractual measures or legitimate interest | 24 months from the last contact |
Providing the data requested in forms and bookings is necessary to receive what you ask for: without it, I cannot reply or provide the service. I do not use your data for automated decision-making or profiling. The Brand Scan score is a calculation based on your answers and has no legal effect on you.
Who I entrust it to
The data is processed by me and by the providers I use to run the site and the service. Each one processes only the data it needs.
| Provider | What for | Location | Transfer outside the EU |
|---|---|---|---|
| Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA | Website hosting and form collection | United States | Yes: Netlify participates in the EU-U.S. Data Privacy Framework, with the UK and Swiss extensions |
| Google Ireland Ltd. (Google Analytics 4) | Statistics, only with your consent | Ireland, with transfers to Google LLC | Yes: Google LLC participates in the EU-U.S. Data Privacy Framework |
| TidyCal (Sumo Group, Inc., 1305 E. 6th St #3, Austin, TX 78702, USA) | Calendar and bookings | United States | Yes: standard contractual clauses (TidyCal data processing agreement; TidyCal and the GDPR) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg | Payments, via TidyCal | Luxembourg | According to the PayPal privacy statement; PayPal acts as an independent controller of payment data |
| Brevo SAS, 17 rue de Salneuve, 75017 Paris, France | Sending emails only: Brand Scan result, Strategic Artefacts PDF and release notices (with double opt-in), analysis questionnaire. Open and click tracking is turned off | France | No |
| Google Meet (Google Ireland Ltd.) and Zoom (Zoom Communications, Inc.) | Video calls for the sessions, depending on the tool agreed | Ireland and United States | Yes: Google LLC and Zoom participate in the EU-U.S. Data Privacy Framework; Zoom also uses standard contractual clauses |
Providers are appointed as data processors (art. 28 GDPR), except PayPal, which processes payment data as an independent controller. I do not sell or pass on your data to third parties for commercial purposes.
The questionnaire answers reach only me by email and are stored by Netlify (forms); I do not use them for newsletters or pass them on to third parties.
Where the data is processed
I process the data in Italy, from my office, and in the services of the providers listed above. Some providers are based in the United States (Netlify, Google, TidyCal by Sumo Group, Zoom) or transfer data there: in these cases the transfer takes place with the safeguards provided by the GDPR, that is participation in the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission. PayPal processes payment data as an independent controller, under its own privacy statement.
Your rights
At any time you can ask me to:
- know what data I process and get a copy of it (art. 15);
- correct it (art. 16) or delete it (art. 17);
- restrict its processing (art. 18);
- receive it in a format that another application can read (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw the consent you gave, without affecting processing already carried out (art. 7.3).
Write to info@mattiaforza.com or to the certified email address mattiaforza@legalmail.it: I reply within one month. If you believe the processing is not correct, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.
Security and changes
The site uses an encrypted connection (HTTPS). I access the data only from protected accounts, and I keep it only in the services listed above. For security and maintenance, Netlify records technical logs of requests to the site (IP address, browser, page, date and time), kept as shown in the table.
If I change this policy, I update the date at the top; for important changes I also flag it on the site. If a change concerns processing based on your consent, I ask for it again.
For cookies, see the cookie policy.