Notice on the processing of personal data

1. Data controller

The controller of personal data collected through this website is:

Brand Lift Projects di Federica Patta
VAT ID 13788640962 · Milan, Italy
Email: info@brandliftprojects.com

The Digital Identity Studio is a studio of Brand Lift Projects; all processing described in this notice is carried out by the same controller.

2. Data collected

Through the brochure request and For Leaders application forms we collect:

• Email address (mandatory, provided by the user)
• Truncated IP address (e.g. 123.45.67.0): retained as anti-abuse security measure (rate limiting); does not allow user re-identification
• URL of the origin page and timestamp of the request and consent tick

We do not collect profiling data or special categories of data under Art. 9 GDPR. The site does not use profiling cookies or third-party analytics tools; only strictly necessary technical cookies (exempt from consent under Art. 122 Italian Privacy Code).

3. Purposes and lawful basis

Data are processed solely to:

• Respond to the brochure request (sending informational material) and evaluate the application to the For Leaders programme — lawful basis: Art. 6(1)(b) GDPR (pre-contractual measures at the data subject’s request).
• Ensure site security (prevent abuse, automated attacks) — lawful basis: Art. 6(1)(f) GDPR (controller’s legitimate interest in the security of its systems). Security data (truncated IP) are kept only for the strictly necessary time.

We do not use data for direct marketing, profiling or further purposes without first requesting separate, specific consent.

4. Processing methods

Processing is carried out by electronic means, with adequate technical and organisational measures pursuant to Art. 32 GDPR (TLS-encrypted connections, authenticated SMTP, rate limiting, security logs, access restricted to authorised personnel only).

5. Recipients and external processors

Data are transmitted to the following providers, appointed as data processors under Art. 28 GDPR:

• Vercel Inc. — hosting of the website and of the email-sending function. Region: Frankfurt (Germany, EU).
• SecureMail.pro / Register.it S.p.A. — SMTP service provider for the delivery of email notifications. Based in Italy (EU).

Data are not transferred outside the European Economic Area. They are not communicated to third parties for commercial purposes.

6. Retention

The email and request message are retained in the info@brandliftprojects.com mailbox for the time needed to process the request and manage any pre-contractual relationship, and in any case no longer than 24 months from the last contact. Technical security logs (truncated IP, timestamp) are retained for at most 30 days and then automatically deleted.

7. Data subject rights

You may at any time exercise the rights under Articles 15-22 GDPR:

• access to your data (Art. 15)
• rectification (Art. 16)
• erasure / right to be forgotten (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interest (Art. 21)

To exercise these rights, write to info@brandliftprojects.com — we will respond within 30 days.

8. Right to lodge a complaint

You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your EU country of residence.

9. Changes to this notice

We may update this notice to reflect regulatory or operational changes. The current version is always available at this URL. The date at the top indicates the last update.