Last updated

12 October 2026

Data controller

Controller: BUSCATTI DEMIAN (VAT ID 18512301005), Via Giuseppe Renato Bellot, 00122 Rome, Italy.
Email: soluzioni@demianweb.it - Tel: +39 351 742 90 85.

Categories of personal data

• identification and contact data sent through forms (name, email, phone number, message content)
• technical browsing data required for website operation, including requests to hosting and Google Fonts
• only with consent: online identifiers, device and browser information, pages and interactions measured through Google Analytics

Purposes and legal basis

• handling contact, call and quote requests: art. 6(1)(b) GDPR (pre-contractual steps requested by the data subject)
• website security and abuse prevention: art. 6(1)(f) GDPR (legitimate interest)
• statistical analysis of website usage through Google Analytics, only with consent: art. 6(1)(a) GDPR

Mandatory or optional data provision

Providing data through forms is optional, but required to receive a reply. Without required fields, your request cannot be processed.

Online payments

This website does not handle online payments and does not collect payment data (e.g. card details).

Google Analytics and consent

Google Analytics 4 (property G-Z3J601SW05) is loaded only after accepting statistics. Refusal does not prevent use of this website or forms. Withdraw consent using Cookie preferences in the footer. Withdrawal stops future collection by this website, but does not delete data already collected. Google processes Analytics data; see the Cookie Policy and Google Privacy Policy. Cookie expiry is set to 180 days; Analytics data retention depends on the property settings.

Data recipients

Data is not sold or transferred for marketing. Enquiries are processed by a PHP script on Aruba Linux hosting and handed to the hosting mail service. Notifications are delivered to the controller's soluzioni@demianweb.it mailbox, hosted by Aruba and also used as the public contact address. Hosting and email providers process the data needed to deliver and store messages. No separate form-delivery platform is used.

Form security

Fields are validated on the server. A hidden anti-spam field and sending limits help prevent abuse. A temporary file outside the public website stores pseudonymous network-address identifiers and request times, not names, emails, phone numbers or messages. The rate-limit window is 15 minutes; expired entries are removed on the next valid request. Contact requests are not saved in a website database. Hosting and email infrastructure may retain their own technical logs.

Transfers outside the EEA

Some technical providers may process data outside the European Economic Area. In such cases, processing relies on safeguards under arts. 44 et seq. GDPR.

Retention period

Contact data is retained for the time needed to handle the request and, as a rule, no longer than 12 months from last contact, unless legal obligations or legal defense needs apply.

Data subject rights

You may exercise rights under arts. 15-22 GDPR (access, rectification, erasure, restriction, objection, portability where applicable), and lodge a complaint with the Italian Data Protection Authority (art. 77 GDPR).