Privacy Policy

Tuscantek is the name used for the collaboration between the following independent professionals:

For the collection and shared management of enquiries described in this notice, the professionals act as joint controllers under Article 26 GDPR. [TO COMPLETE: confirm the joint determination of purposes and means, the scope of joint controllership and the agreement date; amend the text if the actual roles differ]

Privacy contact point: [TO COMPLETE: shared email address and designated contact person]. You can also exercise your rights against either joint controller.

Data Protection Officer (DPO): [TO COMPLETE: provide contact details if appointed; otherwise replace with “No DPO has been appointed” after checking whether appointment is required].

• Contact form: full name, email, business or profession, and message content.
• Guided service questionnaires: selected service and interest, goal, professional activity, existing tools, process or project details, timeline, indicative budget, name and email. The originating service and submission date and time are also associated with the enquiry when it is sent.
• Technical data: the operation and security of the infrastructure may involve processing IP addresses, network requests and logs. [TO COMPLETE: specify the data actually recorded by hosting, authentication, anti-spam protection and other providers].

We do not request attachments, passwords, payment details, health data or other special categories of personal data. Do not enter confidential information or unnecessary third-party data in free-text fields.

Project enquiries and quote requests: to assess needs, respond, request clarification and prepare a proposal. Where the request concerns a contract to which you may become a party, processing is based on taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

Company contacts and other enquiries: where applicable, processing is based on the legitimate interest in managing professional communications and responding to enquiries (Article 6(1)(f) GDPR). [TO COMPLETE: confirm the applicable situations and document necessity, proportionality and the balancing of interests].

Operation and security: to prevent misuse and maintain service availability, based on the legitimate interest in website security, limited to what is necessary (Article 6(1)(f) GDPR). [TO COMPLETE: verify the actual technical processing and the corresponding balancing assessment].

The current forms do not subscribe users to newsletters or collect consent for promotional campaigns. An enquiry does not amount to a marketing subscription. Any new purposes will be accompanied by appropriate information and, where necessary, consent choices.

Providing data is your choice. Fields marked as required are needed to understand and manage the enquiry; without them, the form may prevent submission or we may be unable to respond.

The home-page form requires name, email, business and message. Guided questionnaires require interest, goal, business, name and email. Additional details are optional; for timeline and budget you can keep “To be agreed together” and “Let’s assess it together”.

During the questionnaire, answers are kept in page memory so you can move between steps. When you submit, the data is sent to the server for validation and, if delivery is configured, to the enquiry management service. Downloadable summaries are generated in the browser on your device.

Application configuration at the draft date: the home-page form validates enquiries but has no storage or delivery integration; guided questionnaires forward data only if the webhook is configured. The absence of delivery does not exclude possible processing in infrastructure logs.

[TO COMPLETE: before adopting the final notice, update this section to reflect the active workflow, enquiry destinations and any retained histories or copies].

The joint controllers and authorised people may access data according to their duties. Providers processing data on their behalf are governed, where applicable, by agreements under Article 28 GDPR. Provider roles must be checked against the services actually used.

• Hosting, website delivery and any authentication: [TO COMPLETE: provider’s legal name, service, privacy role and privacy notice link; check the Sites platform and its infrastructure].
• Webhook and automation: [TO COMPLETE: actual provider, any self-hosted installation, location and execution-history retention; state “not active” if not configured].
• Email and CRM: [TO COMPLETE: actual providers, services, roles and recipients; remove those not used].
• Other recipients, including disclosures required by law: [TO COMPLETE: specify the categories that are actually relevant].

Form data is not intended for publication on the website.

[TO COMPLETE: check each provider’s processing locations, overseas access and subprocessors. State whether transfers outside the EEA occur, the relevant countries or destinations, any applicable adequacy decision or safeguards under Chapter V GDPR, and how to obtain information or copies of the safeguards. Do not claim that there are no transfers before checking].

• Enquiries that do not lead to an engagement: [TO COMPLETE: actual retention period or criterion, its starting event and justification; for example, a period from the last contact, to be selected and applied].
• Enquiries that become an engagement: subsequent processing is covered by the information relating to the professional relationship. [TO COMPLETE: define retention for pre-contractual documentation and any relevant legal retention duties].
• Access and security logs: [TO COMPLETE: retention period for each service actually used].
• Copies in email, CRM, automation histories and backups: [TO COMPLETE: deletion periods, overwrite cycles and how copies are handled].

Any additional retention for legal duties or the protection of rights must be limited to the necessary data and duration. [TO COMPLETE: state the situations and criteria that actually apply].

[TO COMPLETE: complete this summary only after defining the arrangement: scope of shared processing, responsibility for the notice, access and providers, rights requests, deletion and coordination of personal data breaches].

How to access the essence of the arrangement: [TO COMPLETE: include the summary in this section or provide a working link or access method]. A shared contact person does not limit your ability to contact either joint controller.

Where and to the extent provided by the GDPR, you may request access, rectification, erasure and restriction of processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. Portability applies when the conditions of Article 20 GDPR are met. For any processing based on consent, you may withdraw it without affecting the lawfulness of earlier processing.

To exercise your rights, write to [TO COMPLETE: operational privacy contact address], or contact either joint controller. We will normally respond within one month; if an extension permitted by the GDPR applies, we will explain the reasons. Exercising your rights is normally free, subject to the exceptions in the Regulation.

You may lodge a complaint with the Italian Data Protection Authority (Garante) or the competent supervisory authority, and use the other remedies available by law.

The application code reviewed for this draft does not integrate advertising or analytics tools, or send form contents to AI models. The forms perform validation and anti-spam checks; they do not make automated decisions producing legal or similarly significant effects under Article 22 GDPR.

[TO COMPLETE: check the published site for cookies and other identifiers introduced by hosting, authentication and external services. Describe their purposes, duration and parties involved and, where necessary, implement consistent consent management and cookie information. Reviewing code alone does not certify the absence of tracking].

Offering AI services does not mean that visitor enquiries are analysed by AI. Before enabling any AI processing or new integrations, update this notice and check the legal bases, providers and safeguards.

This notice will be updated when processing or services change. The final version will state its update date; any new processing will be communicated as required by law.

Review references: privacy information and transparency duties; joint controllership; cookies and tracking tools.