Privacy Policy

1. Data Controller

The Data Controller for personal data is:

2. Personal Data Collected

The site collects the following categories of personal data:

Voluntarily provided data

• Identification data: name, surname, email address
• Contact data: phone number, address
• Professional data: profession, company (if provided)
• Communication content: messages sent via contact form

Automatically collected data

• Navigation data: IP address, browser, operating system
• Usage data: pages visited, time spent, links clicked
• Cookies and similar technologies: see Cookie section

3. Purpose of Processing

Personal data is processed for the following purposes:

4. Legal Basis for Processing

The processing of personal data is based on the following legal grounds (Art. 6 GDPR):

• Consent (Art. 6.1.a): for optional analytics, identified CRM history, external content and promotional communications, according to the choices made
• Contractual performance (Art. 6.1.b): for managing consultation requests
• Legitimate interest (Art. 6.1.f): for security and abuse prevention; it does not replace consent for the optional features above
• Legal obligation (Art. 6.1.c): for regulatory compliance

5. Data Recipients

Personal data may be communicated to:

• Principal: principal for financial advisory activities
• Service providers: Google Cloud/Workspace for infrastructure and calendar, Resend for enabled operational email only, HubSpot for CRM and consented identified browsing history, Sentry for diagnostics and Google Analytics 4 for consent-based analytics; providers processing data on our behalf are governed under Article 28 GDPR
• Competent authorities: when required by law

Data will never be sold, transferred or disclosed to third parties for unauthorised marketing purposes.

6. Extra-EU Data Transfers

Some technology providers may process data outside the EEA. Before use, we verify the country, contracting entity and applicable transfer mechanism. Depending on the case, transfers rely on:

• Adequacy decisions of the European Commission
• Standard Contractual Clauses (SCC) approved by the Commission
• For US providers: the Data Privacy Framework only where the specific entity is listed and the certification covers the processing; otherwise SCCs and supplementary measures

7. Retention Period

Personal data is retained for the strictly necessary period:

8. Data Subject Rights

Pursuant to Articles 15-22 of the GDPR, you have the right to:

To exercise your rights, write to: privacy@alessandrovigni.com

Supervisory authority: Italian Data Protection Authority (Garante Privacy)

9. Cookie Policy

This site uses necessary technical cookies and, through separate consent choices, analytics cookies, identified CRM history and external content such as Google Maps and YouTube. For details, see our Cookie Policy.

10. Changes to the Privacy Policy

This policy may be updated periodically. Significant changes will be communicated via a notice on the site. We encourage you to check this page regularly.

Current version: 1.0 - Last updated: 27 September 2026