Privacy notice on the processing of personal data

Last updated: 5 October 2026

1. Data controller

Ferdinando Mercuri, management control consultant, VAT no. 04285300135, Vertemate, province of Como (Italy). Contact: controller.fm@outlook.com, tel. +39 348 2448625.

2. Data processed

Data you provide voluntarily when you fill in the contact form, email or call me: first and last name, email address, phone number, company or property, property type and size and any other information you choose to include in your message.

Technical browsing data (for example IP address, browser type, date and time of access), collected automatically by the systems of Cloudflare, which hosts the site, for its operation and security.

When you submit the form, the Cloudflare Turnstile anti-spam service checks that the request comes from a person by analysing technical signals from your browser and device (for example IP address and browser characteristics). Turnstile does not use profiling cookies and is not used for advertising.

Please do not send special categories of data (Art. 9 GDPR), such as health data, unless strictly necessary.

3. Purposes and legal basis

a) Answering your requests for information and preparing a possible proposal: legal basis is your consent (Art. 6(1)(a)) and steps taken at your request prior to entering into a contract (Art. 6(1)(b)).

b) Complying with legal obligations, such as accounting and tax requirements, if a professional engagement follows (Art. 6(1)(c)).

c) Ensuring the operation and security of the site and protecting the contact form from spam and abuse (Cloudflare Turnstile, submission rate limits): legitimate interest of the controller (Art. 6(1)(f)).

Your data is not used for newsletters or marketing and is not sold or passed on to third parties.

4. Whether providing data is mandatory

Providing your data is optional. Without contact details, however, I cannot reply to your request. Required form fields are marked with an asterisk.

5. Processing methods and retention

Data is processed electronically, with appropriate technical and organisational measures to protect it. No automated decision-making or profiling takes place.

Requests sent via the form are stored in a Cloudflare D1 database with data located in the European Union and forwarded by email to the controller. I keep your data for as long as needed to handle your request and in any case no longer than 24 months from the last contact, after which it is deleted automatically. If an engagement follows, I keep it for the duration of the relationship and for the following 10 years required by civil and tax law.

Technical browsing data is kept by Cloudflare only for as long as strictly necessary for the security of the service, under its own policies.

6. Recipients

Data may be processed, only for the purposes above, by service providers acting as processors (Art. 28 GDPR): Cloudflare, Inc. (website hosting, contact form database, Turnstile anti-spam protection); the email delivery service that forwards requests to controller.fm@outlook.com; Microsoft (Outlook email service, mailbox controller.fm@outlook.com, and Microsoft Teams for online meetings); any accountants I engage. Data is not made public.

7. Transfers outside the European Union

Some providers (website hosting and protection, email) are based in the United States and may process data outside the European Economic Area. Transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), to which the providers adhere, or on standard contractual clauses approved by the European Commission (Art. 46 GDPR).

The site's typefaces are hosted on the same server as the site: your browser does not connect to Google Fonts or other external services to display them.

8. Cookies and local storage

The site uses no profiling cookies and no analytics or advertising tools. Only your light or dark theme preference is stored in your browser, a technical setting that does not require consent. Details in the cookie policy.

9. Your rights

At any time you can request access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Arts. 15-22 GDPR). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Just write to controller.fm@outlook.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

10. Changes

This notice may be updated over time. The current version is always published on this page, with the date of the last update.