Who is responsible
The controller of your personal data is Gabriele Mele, [Registered office: to be added]. For any question about your data, or to use your rights, write to info@cyberfuturegm.com.
We are not required to appoint a data protection officer, given the size and nature of our activity. We handle requests ourselves.
What we collect and why
We only collect what you choose to give us, plus the technical data any website needs to work. In detail:
Email updates
- Data
- Your email address, the language of the page, where you signed up and the date.
- Purpose
- Sending you occasional updates on EU and Dutch cybersecurity and compliance law.
- Legal basis
- Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email or by writing to us.
- Kept for
- Until you unsubscribe. We then delete your address within 30 days.
Free compliance check
- Data
- Your answers (sector, size, use of AI, digital products, link to the financial sector, countries), the indicative result, the language and the date. No name or contact details.
- Purpose
- Showing you your result and, in aggregate, improving the check.
- Legal basis
- Our legitimate interest in offering and improving a free tool (Art. 6(1)(f) GDPR). The answers alone do not identify you.
- Kept for
- 24 months, then deleted.
Summary by email
- Data
- Your email address together with your answers and result.
- Purpose
- Sending you the summary you asked for and, if you reply, discussing it with you.
- Legal basis
- Steps taken at your request before a possible contract (Art. 6(1)(b) GDPR).
- Kept for
- 12 months after our last contact, unless you become a client.
When you contact us or book a call
- Data
- Your name and email address, your phone number if you give it, your time zone, the topics and budget range you choose, what you write to us, and the time of the call.
- Purpose
- Arranging and preparing the call, answering you and, where relevant, preparing and carrying out an engagement. Your budget range only helps us prepare the right conversation: no decision about you is made automatically, and you can always book a call. Before the call we send a reminder, and every email about it carries a private link to change or cancel it.
- Legal basis
- Steps at your request before a contract, or the contract itself (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering messages (Art. 6(1)(f) GDPR).
- Kept for
- Up to 24 months after our last contact. If you become a client, records are kept as long as tax law requires: 7 years in the Netherlands, 10 years in Italy. Copies of the emails we send about the call are kept as long as the booking.
Invoices
- Data
- Your name, email address and the invoice details (number, amount, dates), the invoice PDF and the emails we send about it, including payment reminders.
- Purpose
- Sending you invoices and, when one is overdue, a reminder.
- Legal basis
- The contract with you (Art. 6(1)(b) GDPR) and our legal duty to keep accounts (Art. 6(1)(c) GDPR).
- Kept for
- As long as tax law requires: 7 years in the Netherlands, 10 years in Italy.
Technical data when you visit
- Data
- Your IP address, browser and device type, the pages requested and the date and time. To limit abuse of the booking form and the dashboard, a scrambled form of your IP address: it cannot be turned back into the address and changes every day.
- Purpose
- Delivering the website and keeping it secure, for example against abuse.
- Legal basis
- Our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).
- Kept for
- Only for a short period in our providers' server logs, for security and troubleshooting. The scrambled address is deleted after 48 hours at the latest.
Visit statistics
- Data
- Anonymous counts of visits and pages viewed.
- Purpose
- Seeing which pages help, to improve the site.
- Legal basis
- Only with your consent (Art. 5(3) ePrivacy Directive and Art. 6(1)(a) GDPR). No statistics tool is active at the moment: see the cookie policy.
- Kept for
- Will be stated in the cookie policy before any tool is used.
Settings you choose on the site, such as dark mode or text size, are stored only in your own browser and never reach us. See the cookie policy.
Who receives your data
We do not sell your data and do not share it for advertising. We use a small number of service providers that process data only on our instructions, under a data processing agreement (Art. 28 GDPR):
- Lovable (Sweden): hosting of this website, and sending its emails: booking confirmations, call reminders, changes and cancellations, invoices, and alerts to us about new requests.
- Supabase: the database where sign-ups and check results are stored.
- Google (Google Workspace): the calendar in which a booked call is placed. Google sends you the invitation and hosts the video call (Google Meet).
We disclose data to public authorities only when the law requires it.
Transfers outside the EU
We aim to keep your data in the European Economic Area. Where a provider processes some data outside it, for example for support or service monitoring, the transfer relies on an adequacy decision of the European Commission (Art. 45 GDPR) or on the Commission's standard contractual clauses (Art. 46 GDPR). You can ask us for a copy of these safeguards.
Automated results
The free check applies fixed, published rules to your answers and shows an indicative result. It is not a decision with legal or similarly significant effects on you (Art. 22 GDPR), and it is not legal advice.
Your rights
You can ask us at any time to:
- see the data we hold about you and receive a copy (Art. 15 GDPR);
- correct it (Art. 16) or delete it (Art. 17);
- limit how we use it (Art. 18);
- receive it in a commonly used, machine-readable format (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw your consent, without affecting what was done before (Art. 7(3)).
Write to info@cyberfuturegm.com. We answer within one month (Art. 12(3) GDPR) and may ask you to confirm your identity first. Providing your data is never required: without an email address we simply cannot send updates or a summary.
Complaints
If you think we handle your data wrongly, please tell us first so we can put it right. You also have the right to complain to a supervisory authority, in particular in the EU country where you live, work or where the issue took place (Art. 77 GDPR):
Security
The site is served only over encrypted connections (HTTPS). Visitors can add entries to our database but cannot read anything stored in it, and access is limited to the people who need it.
Changes to this notice
When we change this notice we update the date at the top. If a change matters for how we use your data, we will say so clearly on the site.