Privacy policy

The data controller is Gianmarco Pacetti — Italian self-employed IT consultant trading as EraOne Solutions, with registered office at Via Acqua del Lauro, 5 · Palinuro (SA).

• Italian VAT 06329840653
• Italian fiscal code PCTGMR07B01L628L
• Email: info@eraone.it
• Certified email (PEC): gianmarco.pacetti@pec.it
• Phone: +39 327 169 2122

No Data Protection Officer (DPO) has been appointed since the conditions of Art. 37 GDPR are not met. The controller handles all data subject requests directly.

• Browsing data: IP address, user agent, pages visited, request date and time, browser, device.
• Data voluntarily provided via the contact form: name, email and/or phone, company or business, the service you are interested in, whether you already have a website (and its address, if you give it), the budget range if you choose one, the chosen package, the message (optional).
• Customer portal account data: name, email, encrypted password, access and activity data.
• Call booking data, if you book from the calendar on the Contact page: name, email, the date and time you choose and any notes you write. Cal.com collects them and they reach us with the booking confirmation.
• Cookies: see the Cookie Policy for the full list.

• Reply to requests received via form/email — basis: pre-contractual measures at your request (Art. 6.1.b GDPR).
• Organising the call you book from the calendar on the Contact page — basis: pre-contractual measures at your request (Art. 6.1.b GDPR).
• Service delivery and management of contractual relationships including the customer portal — basis: contract performance (Art. 6.1.b GDPR).
• Legal obligations (tax, accounting, anti-money laundering) — basis: legal obligation (Art. 6.1.c GDPR).
• IT security and fraud prevention — basis: legitimate interest of the controller (Art. 6.1.f GDPR).
• Aggregate traffic analytics — basis: consent (Art. 6.1.a GDPR), via optional analytical cookies.
• Measuring advertising campaigns on Facebook and Instagram (Meta Pixel) — basis: consent (Art. 6.1.a GDPR), via optional advertising cookies.

You give and withdraw consent to analytical and advertising cookies at any time from the banner or from «Cookie settings» at the bottom of every page; without consent these tools do not load.

Data is processed with IT and electronic tools, with technical and organisational measures appropriate to ensure security, integrity and confidentiality (Art. 32 GDPR): in-transit encryption (HTTPS/TLS), password hashing (bcrypt), role-based access control, encrypted backups, access monitoring.

The site's typefaces (Geist and Instrument Serif) are served from our own domain: opening the pages, your browser makes no requests to Google Fonts.

• Form contact data: 24 months from the last interaction, unless a contractual relationship is established.
• Contractual and tax data: 10 years from the end of the relationship (Art. 2220 Italian Civil Code).
• Customer portal accounts: for the duration of the relationship and until a deletion request is received.
• Access logs: 12 months.
• Analytical and advertising cookies: see the Cookie Policy for durations.

Data may be communicated to the following providers acting as processors under Art. 28 GDPR:

• Vercel Inc. (USA) — site hosting and CDN. Extra-EU transfer covered by Standard Contractual Clauses.
• Neon Inc. (USA, EU region) — managed PostgreSQL database. Data hosted on EU instances.
• Resend Inc. (USA) — transactional email delivery. Extra-EU transfer covered by SCC.
• OpenAI Ireland Ltd. (EU) — AI assistant features (only when enabled by admin). Requests are not used for training.
• Google Ireland Ltd. (EU) — Google Analytics (only with prior consent). Fonts are hosted on our own server.

Only if you accept advertising cookies does the Meta Pixel send visit data to Meta Platforms Ireland Ltd. (EU). For collecting and transmitting this data Meta is a joint controller with us (Art. 26 GDPR, under the Meta Business Tools terms); once received, Meta processes it as an independent controller under its privacy policy.

The Contact page embeds the calendar of Cal.com, Inc. (United States), which we use for bookings of the 30-minute call. It loads with that page, and only there: it receives the technical data of the visit (such as IP address and browser type) and, if you book, the data you enter, which it then forwards to us. Cal.com processes this data under its own privacy policy.

Some providers (Vercel, Resend) are based in the United States. Transfer is carried out on the basis of Standard Contractual Clausesapproved by the European Commission (Decision EU 2021/914) and additional contractual safeguards, in accordance with the Schrems II judgment (CJEU C-311/18).

If you accept analytical or advertising cookies, Google and Meta may transfer data to their group companies in the United States, certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

Cal.com is also based in the United States: the transfer of the data it receives from the calendar on the Contact page follows the safeguards set out in its privacy policy.

You can exercise the rights provided by Arts. 15–22 GDPR at any time:

• right of access (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure («right to be forgotten», Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing (Art. 21)
• withdrawal of consent at any time

To exercise your rights write to info@eraone.it. We will reply within 30 days of receipt.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe that the processing infringes GDPR (Art. 77).

We do not use automated decision-making or significant profiling under Art. 22 GDPR.

This Privacy Policy may be updated. The date of the last update is shown at the top. Changes will be posted on the site and — if substantial — communicated directly to registered users.