Privacy policy
Last updated: [TODO: date of review]
Draft — not yet reviewed. This policy must be reviewed by a qualified person before the site goes live. Items marked [TODO] are incomplete.
This policy explains what personal data we collect through this website, why we collect it, and what rights you have over it under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Italian data protection law (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018).
Who is responsible for your data
The data controller is [TODO: legal entity name, registered address, VAT number]. You can contact us about anything in this policy athello@chiaro.tax.
We have not appointed a Data Protection Officer because we are not required to under Article 37 GDPR. [TODO: confirm.]
What we collect
When you request a quote
The quote form asks for:
- your email address (required);
- optionally: your residency status, type of income, an approximate income band, whether you hold assets outside Italy, whether you own a company, whether you hold crypto-assets, and any free text you choose to add.
Please don’t include information about your health, religion, political views or other special categories of data in the free-text box. We don’t need it to prepare a quote.
When you become a client
If you go ahead, we will need further documents and information to prepare your return, such as your codice fiscale, income statements (e.g. Certificazione Unica), bank and investment statements, and details of foreign assets. We will tell you exactly what we need at that point, and this policy applies to that data too.
When you visit the site
We use Cloudflare Web Analytics to count visits. It does not use cookies, local storage or any other identifier stored on your device, and it does not track you across sites. Our hosting provider, Cloudflare, also processes your IP address and basic request data to deliver the site and protect it from abuse.
When you reach the quote form, it loads Cloudflare Turnstile, which checks that a person, not a bot, is submitting it. Turnstile processes technical information about your browser and device for that purpose only. Cloudflare states that it is not used for advertising or tracking. [TODO: confirm against Cloudflare’s current Turnstile privacy addendum.]
This site sets no cookies. That is why there is no cookie banner.
Why we use it, and on what lawful basis
| Purpose | Lawful basis (GDPR Art. 6(1)) |
|---|---|
| Preparing and sending you the quote you asked for, and answering follow-up questions about it | (b) steps taken at your request before entering into a contract |
| Optional details and free text you choose to give us in the form | (a) your consent, which you can withdraw at any time; and (b) as above |
| Preparing your return and providing the service once you are a client | (b) performance of a contract |
| Keeping client and invoicing records for as long as Italian law requires | (c) legal obligation |
| Counting visits in aggregate and keeping the site secure | (f) our legitimate interest in running a secure, working website |
We do not use your data for marketing unless you separately ask us to. We do not sell or rent it to anyone. We do not make decisions about you by automated means, including profiling.
Who we share it with
We use a small number of service providers who process data on our behalf, under written data processing terms:
- Resend (Plus Five Five, Inc., USA) — delivers quote form submissions to our inbox by email.
- Cloudflare (Cloudflare, Inc., USA) — website hosting, receiving the quote form, security, cookieless analytics, and Turnstile, the spam check on the quote form.
- [TODO: email provider] — our email, where your quote request and our reply are stored.
If your return needs to be signed or transmitted by a registered professional, we will share the relevant data with a licensed commercialista. We will tell you who they are before we do so. [TODO: confirm whether the commercialista acts as an independent controller or as our processor, and document the arrangement.]
We may also disclose data where the law requires it, for example to the Agenzia delle Entrate or to a court.
Transfers outside the EU
Cloudflare and Resend are based in the United States. Where data is transferred there, it is protected by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards. [TODO: verify each provider’s current certification and DPA.]
How long we keep it
- Quote requests that don’t lead to work: deleted 12 months after we send the quote, or sooner if you ask.
- Form submissions: our website doesn’t store them. They arrive as an email, and Resend keeps a delivery log for [TODO: check Resend’s current retention] days.
- Client records: kept for 10 years after the end of the tax year concerned, as required by Italian law (art. 2220 Codice Civile and tax record-keeping rules). [TODO: confirm.]
- Analytics: Cloudflare Web Analytics stores only aggregate counts; we hold no visitor-level data.
Your rights
Under Articles 15 to 22 GDPR you have the right to:
- Access (Art. 15) — get a copy of the personal data we hold about you.
- Rectification (Art. 16) — have inaccurate or incomplete data corrected.
- Erasure (Art. 17) — have your data deleted, unless we are legally required to keep it.
- Restriction (Art. 18) — ask us to limit how we use your data while a concern is resolved.
- Notification (Art. 19) — be told that we have passed on any correction, erasure or restriction to the people we shared your data with.
- Portability (Art. 20) — receive data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection (Art. 21) — object to processing based on our legitimate interests.
- Not to be subject to automated decisions (Art. 22) — we don’t make any, but the right is yours.
Where we rely on your consent, you can withdraw it at any time (Art. 7(3)). Withdrawing it does not affect anything we did before.
To exercise any of these rights, email hello@chiaro.tax. We will reply within one month (Art. 12(3)), free of charge. We may ask you to confirm your identity first.
Complaints
If you think we have mishandled your data, please tell us first so we can fix it. You also have the right to complain to the Italian supervisory authority, theGarante per la protezione dei dati personali, or to the authority in the EU country where you live or work.
Security
The site is served over HTTPS only. Access to client data is limited to the people who need it to do the work. [TODO: describe how client documents are stored and shared, e.g. encrypted storage, no documents by plain email.]
Changes to this policy
If we change this policy we will update the date at the top of this page. If a change affects how we use data you have already given us, we will tell you by email.