Notice under Article 13 of Regulation (EU) 2016/679 (GDPR) covering visits and contact requests on the Studio Toffoletto website. Updated on 24 September 2026.
1. Controller and contact details
The controller is Andrea Toffoletto – Chartered Accountant, Studio Toffoletto, Via Villar Focchiardo 5, 10138 Turin, Italy. For privacy enquiries and rights requests: andrea@studiotoffoletto.it; telephone +39 011 7712443.
2. Connection and security data
To deliver pages and protect the service, the hosting and delivery infrastructure may process IP addresses, request dates and times, requested URLs, browser and device information, request results and signals needed to detect abuse. These data may be personal and are not described as anonymous.
The purposes are website delivery, troubleshooting and security. The legal basis is the controller’s legitimate interest in making the service available and protecting it (Article 6(1)(f) GDPR). Connection data must be transmitted to visit the website.
3. Contact form and email
The form prepares an email in the visitor’s chosen email application. Name, email address, subject and message are processed in the browser to compose the draft. The form does not send them to a form-processing service or save them in a website database or persistent browser storage. The Firm receives the message only if the visitor sends it from their email application. The visitor’s email provider handles the draft and delivery under its own terms.
After receiving an email, the Firm processes the information to respond and handle the request. For professional service enquiries, the legal basis is steps taken at the individual’s request before entering into a contract (Article 6(1)(b)). For other correspondence relevant to the Firm’s work, it is the legitimate interest in handling correspondence (Article 6(1)(f)). Legal obligations are based on Article 6(1)(c).
Providing data is voluntary; without contact details and necessary information we may be unable to respond. Marketing consent is not required to contact the Firm. This form does not subscribe you to a newsletter or authorise promotional communications. Do not include health information, tax documents, passwords or other confidential information; agree on an appropriate channel with the Firm.
4. Recipients and providers
Data may be processed by the controller, authorised personnel and providers of necessary hosting, content delivery, website security, email and IT support services. The website is published through OpenAI Sites and uses Cloudflare infrastructure. Emails pass through the email providers involved. Authorities and other legally entitled recipients may access data where required by law. Contact requests are not published on the website.
You may ask the controller for information about providers and their respective roles. Providers acting as processors must be engaged under arrangements complying with Article 28 GDPR.
5. Processing outside the European Economic Area
Infrastructure and email services may involve processing outside the EEA. Transfers must comply with Chapter V GDPR through an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and any necessary supplementary measures. Contact the controller for details of destinations and safeguards applicable to the providers used, or to obtain a copy of those safeguards. This notice does not state that data are stored exclusively in Italy or the EU.
6. Retention
The form does not retain message copies on the website. Received emails are retained according to the time needed to respond, complete requested follow-up and handle the correspondence. If a professional engagement follows, the periods and obligations described in the client notice apply. Retention for legal obligations or legal claims must be limited to relevant data and applicable statutory or limitation periods.
Technical data retention is determined by the time needed to deliver the service and diagnose or handle incidents, in accordance with infrastructure providers’ settings and terms. Any further retention requires a specific purpose, such as investigating abuse or meeting a legal obligation. The controller can provide information about the periods applicable to individual data categories.
7. Cookies and external services
The website code does not set advertising or profiling cookies, integrate Google Analytics or save preferences in localStorage. Language selection uses page URLs without a language cookie. Fonts available on your device are used; fonts are not downloaded from Google Fonts.
Google Maps is not embedded. “Open in Google Maps” opens an external website only when you choose it. Review links and the client portal also open external services, whose privacy notices apply when you visit them.
The infrastructure may use technical security and bot protection mechanisms. Depending on enabled features, Cloudflare documents cookies such as __cf_bm (expires after 30 minutes of inactivity) and cf_clearance (validity depends on challenge settings). This does not mean these cookies are set on every visit. See the Cloudflare cookie documentation for current details.
Strictly necessary cookies do not require prior consent under Article 122 of the Italian Privacy Code. No acceptance banner is displayed in the absence of optional tracking tools. Any future introduction of tools requiring consent must prevent their use before a choice is made and provide an easy way to withdraw consent. You can manage or delete cookies in browser settings; blocking technical cookies may affect security checks.
8. Rights and complaints
Under the conditions in Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. The website does not provide automated decision-making producing legal or similarly significant effects, or commercial profiling.
Contact andrea@studiotoffoletto.it. You may lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority and seek a judicial remedy.
9. Scope
This notice covers the website and initial enquiries. For professional engagements, consult the client notice (Italian); for supply relationships, the supplier notice (Italian). This notice will be updated when services or processing change.