Last updated:
Privacy policy
This policy explains what personal data I collect through this website and when you work with me, why I collect it, and what your rights are. It follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Italian Privacy Code (Legislative Decree 196/2003).
1. Who is responsible for your data
The data controller is Your Full Name, trading as CPD Web Design.
- Address: Via Esempio 1, 00100 Roma (RM), Italia
- Email: hello@cpdwebdesign.com
I haven't appointed a Data Protection Officer, because the GDPR doesn't require one for this kind of processing.
2. What I collect
- Contact form: your name, business name (optional), email address and message, and when you sent it. It's delivered to my inbox by email.
- Email and WhatsApp: whatever you choose to send me, plus your email address or phone number.
- Clients: the details needed to set up and run our contract and to invoice you, such as name, business name, tax code or VAT number, billing address and payment records.
- Technical data: when you visit the site, the hosting provider automatically records your IP address, browser type, the page requested and the time, in server logs used for security and to keep the site running.
- Your choices on this site: your language and cookie preferences, stored in your own browser (see the cookie policy).
I don't use analytics, advertising or tracking tools, and I don't build profiles of visitors. The fonts on this site are served from my own hosting, so no data goes to font providers.
3. Why I use it, and the legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Replying to your enquiry and preparing a proposal | Steps you've asked for before a contract (art. 6(1)(b)) |
| Building, hosting and maintaining your website, and support | Performance of the contract (art. 6(1)(b)) |
| Invoicing, accounting and tax records | Legal obligation (art. 6(1)(c)) |
| Keeping the site secure and working, and stopping spam and abuse | Legitimate interest (art. 6(1)(f)) |
| Establishing or defending legal claims | Legitimate interest (art. 6(1)(f)) |
| Showing Google Maps on the example sites | Your consent (art. 6(1)(a)), which you can withdraw at any time |
Giving me your details is voluntary, but without your name, email address and message I can't reply to you. I don't make decisions about you by automated means alone.
4. Who I share it with
I don't sell your data. I share it only with providers that help me run the business, who act on my instructions as data processors, or with others where the law requires it:
- Vercel Inc. (USA): website hosting and server logs.
- FormSubmit (formsubmit.co): delivers contact form messages to my inbox by email.
- My email provider, which stores the emails I send and receive.
- WhatsApp (Meta Platforms Ireland Ltd.), only if you choose to message me there. WhatsApp's own privacy policy applies.
- Unsplash, which serves some photos on the example sites and receives your IP address to do so.
- Google Ireland Ltd., only if you choose to show a map on an example site.
- My accountant (commercialista), banks and the tax authorities, for invoicing and tax records.
5. Transfers outside the EU
Some of these providers are based in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses. You can ask me for more details.
6. How long I keep it
- Enquiries that don't lead to a contract: up to 12 months after our last contact, then deleted.
- Client and contract data: for the length of the contract, then up to 10 years for accounting and tax purposes (art. 2220 of the Italian Civil Code), or longer if needed for a legal claim.
- Server logs: for a short period set by the hosting provider.
- Preferences stored in your browser: until you clear them. Your cookie choice expires after 6 months.
7. Your rights
Under articles 15 to 22 of the GDPR you can ask me at any time to:
- tell you what data I hold about you and give you a copy;
- correct data that's wrong or incomplete;
- delete your data, unless I have to keep it by law;
- restrict how I use it;
- stop using it where I rely on legitimate interest;
- send it to you or another provider in a common format;
- withdraw your consent, without affecting anything done before.
Email hello@cpdwebdesign.com to do any of these. I'll reply within one month.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority in the EU country where you live or work.
8. How I protect it
The site is served only over HTTPS with strict security headers, and contact form messages aren't stored on the website itself. My email and provider accounts are protected with strong passwords and two-factor authentication.
9. If I build your website
If your site collects personal data from your own visitors, for example through a booking form, you are the controller of that data and I process it on your behalf. We'll sign a data processing agreement under article 28 of the GDPR as part of our contract. Your site will need its own privacy policy, which I can help you set up.
10. Changes to this policy
If I change this policy, I'll update the date at the top of this page. I'll tell clients about significant changes by email.