Privacy Notice

Last updated 21/09/2026 · v2.4

1Who I am

The Data Controller is Nicola Franchetto, practising under the professional name "Franchetto Legal" (sole practitioner, VAT no. IT04367590231), with registered address at Via Primo Maggio 47, 37059 Zevio (VR), Italy, e-mail nicola@franchetto.legal, certified e-mail (PEC) nicola.franchetto@pec-legal.com. "Franchetto Legal" is the professional name under which I operate and is not a separate legal entity: the Data Controller remains the natural person identified above.

In this notice I explain how I process your personal data when you visit my website, contact me, subscribe to my newsletter or download a resource, enrol in my Academy courses, engage me professionally, or when I collect business information from public sources. I provide it pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

You are not obliged to provide your data, but if you do not do so when requested I may be unable to provide the service or to act on your request.

2What data I collect and process

Browsing data: IP addresses, device and browser identifiers, request times, pages visited - collected automatically by the systems that run the website.
Contact data: name, e-mail and other contact details you provide to me.
Data you communicate to me: the content of the messages, requests and documents you send me.
Newsletter/resource sign-up data: name (optional), e-mail, sector/industry, company/organisation declared at sign-up or download.
E-mail interaction data: opens and clicks, when the relevant measurement is active (subject to consent).
Academy data: learner account data (name, e-mail), course progress, any content you upload, technical access logs.
Data relating to the professional engagement: for clients, identifying data, case-file data and - where necessary for the defence - special categories of data (Art. 9) and data relating to criminal convictions and offences (Art. 10).
Business data from public sources: B2B qualification data collected from public registers and sources (see §3.6).
Third-party data: data of persons other than you (e.g. counterparties, contacts) that you communicate to me or that I acquire to perform the engagement; you are responsible for the lawfulness of the third-party data you provide to me.

3How I process data, by category of data subject

For each category I set out purpose, data, legal basis, retention and recipients.

3.1Website visitor

Purpose	Data	Legal basis	Automated decision-making (Art. 22)	Retention	Recipients
to enable use of the website, ensure its security and operation; to derive aggregate anonymous statistics.	browsing data (IP, device/browser, times, pages).	Legitimate interest (Art. 6(1)(f) GDPR) - my interest in delivering and protecting the service.	No.	for the time strictly necessary to operation and security, and for the period set by the relevant procedures.	the hosting provider, Hostinger International Ltd. (Larnaca, Cyprus; servers in Germany, within the European Union), Processor under Art. 28; where the site is delivered through a content delivery network (CDN) for security, the relevant provider.
Note	The public pages of the website use no analytics, profiling or third-party cookies; the fonts are hosted on my own domain. Details are in the Cookie Policy.

3.2Those who contact me (contact form and call booking)

Purpose	Data	Legal basis	Automated decision-making (Art. 22)	Retention	Recipients
to respond to your request and follow up on preliminary contacts; to arrange the calls you book.	identifying/contact data and the content of the message; for calls, the appointment data.	Performance of pre-contractual measures (Art. 6(1)(b) GDPR) - taken at your request.	No.	for the time necessary to handle the request and the resulting contacts; then for any period required by legal obligations.	the Data Controller, by e-mail (without email-marketing platforms); for calls, Google Workspace (Google Ireland Ltd.) as the calendar-service provider, Processor under Art. 28, with any transfers to third countries covered by standard contractual clauses or the Data Privacy Framework.
Note	Completing the form does not sign you up to any newsletter. Data may be disclosed to public authorities where required by law.

3.3Newsletter subscriber / resource requests

Purpose	Data	Legal basis	Automated decision-making (Art. 22)	Retention	Recipients
(a) to send you the requested resource; (b) to send you the newsletter and informational and promotional communications; (c) to measure e-mail opens and clicks.	e-mail; sector/industry (mandatory) and company/organisation (optional); e-mail interaction data.	(a) Performance of your request (Art. 6(1)(b)); (b) Consent (Art. 6(1)(a); Art. 130 of the Italian Privacy Code (Legislative Decree 196/2003) for the sending of promotional communications) - collected by double opt-in, optional and revocable at any time; (c) Specific consent (Art. 6(1)(a)) - dedicated, non-pre-ticked box; without consent the measurement stays off.	No.	up to 24 months from the last contact or until consent is withdrawn; then deletion or anonymisation.	the mail/newsletter provider (Processor under Art. 28, with servers in the European Union); no disclosure, no sale to third parties.
Note	Profiling is limited to segmenting content by declared sector; no automated decision-making producing legal effects under Art. 22.

3.4Client (grant of a professional mandate)

Purpose	Data	Legal basis	Automated decision-making (Art. 22)	Retention	Recipients
to perform the engagement of assistance, advice, representation and defence, and preparatory activities; to comply with legal obligations (tax, retention).	identifying and case-file data; where necessary for the defence, special categories of data (Art. 9) and data relating to criminal convictions and offences (Art. 10); relevant third-party data.	Performance of the contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)); for special categories, establishment, exercise or defence of a legal claim in court (Art. 9(2)(f), together with the professional-conduct rules referred to by Article 2-quater of the Italian Privacy Code); for judicial data, Art. 10 GDPR together with Article 2-octies of the Italian Privacy Code.	No.	for the duration of the mandate; then for the time necessary to comply with legal obligations and to protect my rights (in particular 10 years pursuant to Article 2220 of the Italian Civil Code), for the limitation period of professional liability and in compliance with the professional-conduct obligations on the safekeeping of files.	judicial and administrative authorities, counterparties and their counsel, court-appointed and party-appointed experts, agents and correspondents, within the limits of the engagement; technical-service providers appointed as Processors (Art. 28).
Note	The data are covered by professional secrecy (Art. 622 of the Italian Criminal Code; Articles 13 and 28 of the Italian Code of Forensic Conduct; Art. 200 of the Italian Code of Criminal Procedure). Providing the data necessary for the engagement is indispensable to performing it. The data subject's rights are subject to the limits set out in §5.

3.5Academy enrolee (training courses)

Depending on how you access the courses, I act in one of two privacy roles.

(1) Direct or self-directed access - you enrol and use a course on your own initiative (including where your company has purchased the access but you enrol and use it autonomously): I am the Data Controller of your data and the information below applies.

(2) Training assignment on your company's instructions - where it is your company that determines the purposes and means of the processing: your company is the Data Controller and I act as Data Processor (Art. 28 GDPR) on the basis of an agreement (DPA); in this case the Art. 13 notice is provided to you by your company, to which you may address your requests.

Purpose	Data	Legal basis	Automated decision-making (Art. 22)	Retention	Recipients
to create and manage your account on the training platform; to deliver the courses; to record and show you your progress and issue the course completion certificate, which records the completion of the course and the passing of the final test, stating the outcome and the relevant score; to ensure the platform's security and operation.	account data (name, e-mail), course progress, the outcome and score of the final test, any content you upload, technical access logs.	Performance of the contract (Art. 6(1)(b)) for account creation, course delivery and progress recording; Legitimate interest (Art. 6(1)(f)) for technical security logs; Consent (Art. 6(1)(a)) for any promotional communications about the training offering.	No.	account and progress data for the duration of the account and, after the last activity, up to 24 months, after which they are deleted or anonymised; any completion certificates for the time necessary to evidence the training provided (as a rule 5 years); technical logs for 6-12 months.	the training platform is hosted on hosting infrastructure provided by Hostinger International Ltd (Larnaca, Cyprus; servers in Germany, European Union), Data Processor for the hosting, on which I autonomously run the application (open-source software LearnHouse, run by me; the software provider has no access to the data); service e-mails are sent through Google Workspace (Google Ireland Ltd; any transfers to the USA are covered by the Data Privacy Framework and/or the standard contractual clauses); DNS resolution for the domain is provided by Cloudflare, Inc., limited to DNS metadata (USA, with equivalent safeguards). At launch no third-party analytics, payment or artificial-intelligence providers are used; if any are activated in future (e.g. course payments), I will update this notice and the relevant safeguards.

3.6Commercial contact from public sources

Purpose	Data	Legal basis	Automated decision-making (Art. 22)	Retention	Recipients
to qualify potential B2B contacts and assess interest in my professional services.	business/professional qualification data (e.g. company name, sector, business contact details). I do not process special categories (Art. 9) or judicial data (Art. 10) for this purpose.	Legitimate interest (Art. 6(1)(f) GDPR) - my B2B commercial qualification, following a balancing test.	No.	for the time necessary for qualification and any contact; deletion upon objection.	the Data Controller; technical-service providers appointed as Processors (Art. 28).
Source of the data	public sources - the business register, VAT databases (VIES), company websites. I do not scrape social networks.
Note	Since the data are not collected from you, I inform you pursuant to Art. 14 GDPR no later than the first contact. You may object at any time (Art. 21): upon objection I cease the enrichment and the contact.

4Where your data are

I process your data, as a rule, within the European Union. Where a Processor entails a transfer to countries outside the European Union, the transfer takes place only where adequate safeguards under Chapter V of the GDPR are in place (an adequacy decision of the European Commission, or standard contractual clauses). You may ask me for a copy of the safeguards adopted.

5How you can control your data and your choices

Pursuant to Articles 15-22 GDPR you may at any time ask me for: access to your data, rectification, erasure, restriction, portability and objection; you may withdraw consent at any time (e-mail to the Data Controller), without prejudice to processing already carried out.

Limits applicable to the professional context (clients): the right to erasure does not override legal retention obligations (Art. 17(3)(b) GDPR) or the need to retain files for the exercise or defence of a legal claim; the rights of objection and restriction are compressed where processing is necessary for the establishment, exercise or defence of a legal claim in court; the exercise of rights may be limited or deferred pursuant to Article 2-undecies of the Italian Privacy Code (protection of secrecy, defensive investigations and the rights of third parties).

How to exercise them: by writing to the Data Controller at the contact details in §1. I respond within one month of receipt (extendable by a further two months in complex cases). You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.gpdp.it).

6What this notice does not cover

Cookies and the website's tracking technologies: see the dedicated Cookie Policy.
Processing carried out by third parties as independent controllers (e.g. social platforms, linked external sites), for which their respective notices apply.

7Changes to this notice

I may update this notice to reflect changes to the services or to the law. The updated version is always published on this page, with the date of the last update. Where a change materially affects the processing of clients' data (purposes, legal bases, retention, recipients), I notify the clients concerned; changes of mere form or relating to the website, newsletter and Academy contexts do not entail such notification.

8Definitions

Data Controller: the person who determines the purposes and means of the processing - here, the person identified in §1.
Data Processor: a person who processes data on behalf of the Data Controller, appointed under Art. 28 GDPR. An up-to-date list of Processors is available on request, by writing to the contact details in §1.
Special categories of data (Art. 9): data revealing, among other things, health, beliefs, sex life or sexual orientation.
Public sources: registers and databases accessible to the public (e.g. the business register, VIES, company websites).