Information under art. 13 GDPR
Privacy notice
EDIL NOZZI S.R.L. collects personal data on edilnozzi.it through the contact form and nowhere else. This page sets out what is collected, why, on what legal basis, for how long, who receives it and what rights you have.
Controller
Who handles the data collected on edilnozzi.it
The controller of the data collected on edilnozzi.it is EDIL NOZZI S.R.L., a building contractor with its registered office at Via Torre 168, 66010 Torrevecchia Teatina (CH), Abruzzo, Italy, VAT and tax number 02760240693, registry number REA CH-422003 at the Chieti Pescara Chamber of Commerce.
This notice is given under art. 13 of Regulation (EU) 2016/679 (GDPR) and describes the only processing this website carries out: handling the enquiries sent through the contact form. Reading the pages requires you to supply nothing.
The site uses no analytics, no tag manager, no advertising, no profiling, no social buttons and no embedded third-party content. The typefaces are served from our own servers, so opening a page triggers no request to any outside service. No cookies are set beyond any that are strictly technical.
EDIL NOZZI S.R.L. has not appointed a data protection officer and is not required to appoint one. Art. 37 GDPR imposes that appointment on public authorities and on organisations whose core activity is large-scale regular and systematic monitoring, or large-scale processing of special categories of data. None of those conditions applies to a building contractor receiving requests for site visits and quotes, so data protection matters are handled by the controller directly.
The processing in detail
What we collect, why, and for how long
EDIL NOZZI S.R.L. collects personal data only when someone fills in and sends the contact form on edilnozzi.it. The entries below describe that processing, and there is no other.
- Data collected
- Your name, your email address and, if you choose to give them, a phone number, the type of work and the comune where the property is. To that is added the free text of your message, which contains whatever you decide to tell us. We collect nothing else, we buy no lists, and we do not enrich what you send with outside sources.
- What is required
- Name, email and message are needed in order to reply; without them the form cannot be sent. Phone, type of work and comune are optional and only make the reply more accurate, because they tell us the distance, the site access and which building regulations apply.
- Technical anti-abuse data
- The IP address the submission comes from is processed transiently to count closely spaced attempts and stop automated submissions. It stays in memory for the length of the checking window, is not added to the message, and is not written to any store.
- Purpose
- To read and assess the enquiry, to reply, and where the enquiry calls for it to arrange a site visit and prepare a quote. Alongside that, to keep the form usable against automated submissions. No use for marketing, newsletters, statistics or disclosure to third parties.
- Legal basis
- Art. 6(1)(b) GDPR: steps taken at the request of the data subject prior to entering into a contract. We ask for no consent and there is none to withdraw, because the processing does not rest on consent: sending the form is the request itself. For the anti-abuse measures alone the basis is art. 6(1)(f), our legitimate interest in keeping the form usable.
- Retention
- The enquiry stays in the company mailbox for as long as it takes to handle and answer it. If no appointment follows, it is deleted within twenty-four months of the last contact. If a contract does follow, the details become part of the contractual and accounting records, kept for the periods the law sets, in particular the ten years required by art. 2220 of the Italian civil code.
- Recipients
- The message is delivered through Amazon SES, in the US East region (Ohio), and the site itself runs at a hosting provider whose function executes in Frankfurt; both act as processors under art. 28 GDPR. The mailbox that receives it is ivannozzi38@gmail.com, operated by Google, which involves a transfer to the United States — the section “Where the data travels before it reaches us” sets this out in full. There are no other recipients: the data is not passed to commercial partners, not sold and not published.
Recipients and transfers
Where the data travels before it reaches us
Enquiries sent from the form on edilnozzi.it are received by a function that the hosting provider runs in the European region of Frankfurt. From there they are delivered by Amazon SES, the transactional email service of Amazon Web Services — which is configured in the US East region (Ohio): to be delivered, the content of the enquiry leaves the European Union and is processed in the United States. The service only delivers the message on our behalf and does not use it for purposes of its own. In Amazon SES we have not enabled message archiving.
Amazon Web Services and the provider hosting the site are both appointed as processors under art. 28 GDPR and handle the data only on our instructions. There are no other recipients: nothing is passed to commercial partners, nothing is sold, nothing is published. Disclosure to public authorities or to a court remains possible where the law requires it.
For this step we do not rely on an adequacy decision: the United States is not an adequate country in general. The transfer is covered by the controller-to-processor standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, provided for by art. 46(2)(c) GDPR. We signed nothing: Amazon Web Services incorporates them automatically into its Service Terms and its Data Processing Addendum whenever a customer subject to the Regulation transfers data outside the European Economic Area. The text is published on aws.amazon.com; we will send a copy free of charge on request.
The mailbox that receives enquiries is currently ivannozzi38@gmail.com, a service operated by Google. It is the address of Ing. Ivan Nozzi, with whom we share the studio. Google is not a processor of ours: it runs the mailbox on its own terms and under its own privacy policy, and decides for itself how it handles the data and where. That processing may involve a transfer to the United States; Google LLC participates in the EU-U.S. Data Privacy Framework, the subject of the adequacy decision adopted by the European Commission on 10 July 2023. That is a safeguard of Google's own, however, not one we have put in place. We state this plainly because it matters: a request for a quote can describe a specific building and who owns it. Should the mailbox later move to an address on the edilnozzi.it domain, this notice will be updated and the date at the foot of the page will change with it.
Your rights
The rights you have and how to use them
Anyone who has sent an enquiry to EDIL NOZZI S.R.L. may exercise the rights in articles 15 to 22 GDPR at any time, without giving a reason and at no cost.
Those are the right of access to the data and to information about the processing (art. 15), to have inaccurate or incomplete data corrected (art. 16), to erasure (art. 17), to restriction of processing (art. 18), to receive the data you gave us in a machine-readable format or have it sent to another controller (art. 20), and to object to processing based on legitimate interest, which here means the anti-abuse measures alone (art. 21). Art. 22 concerns automated decisions, which do not occur here.
Requests go to the controller by certified email (PEC) at edilnozzisrl@pec.it, the certified channel for legal communications, or by post to the registered office at Via Torre 168, 66010 Torrevecchia Teatina (CH), Italy. For a question about this notice you can also use the contact form. We answer without undue delay and in any case within one month of receipt, a period that may be extended by two months in the cases allowed by art. 12 GDPR, telling you of the extension and the reason for it.
Anyone who considers the processing of their data to breach the GDPR may lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority, whose contact details and forms are published at www.garanteprivacy.it, or bring the matter before a court. The two routes are alternatives and neither requires you to contact us first, although writing to us is usually the fastest way to get something corrected.
Security
How the form is protected, and why there is no profiling
EDIL NOZZI S.R.L. protects the form on edilnozzi.it with technical measures proportionate to the risk, as art. 32 GDPR requires, and those measures can be checked by looking at how the site behaves.
Pages and form submissions travel over an encrypted connection (HTTPS). The form accepts submissions only from its own domain. A hidden field, which a person never sees or fills in, and a minimum fill time discard automated submissions. A cap on how many submissions one IP address may make in a minute prevents bulk sending.
The site keeps no contact database. The form transmits the enquiry and does not store it: from that moment the enquiry exists as a message in the company mailbox, readable only by the people who need to read it in order to reply. Addresses collected this way are never used for commercial mailings, newsletters or lists passed to anyone else.
No decision about you is taken by automated means and no profile is built of anyone who writes: enquiries are read and assessed by people. We do not knowingly process special categories of data under art. 9 GDPR, and we suggest you keep health information and other sensitive details out of the message, since assessing building work does not call for them.