Privacy notice: how we process personal data

Notice provided under Article 13 of Regulation (EU) 2016/679 (GDPR). Last updated: 2 November 2026.

1. Data controller

The data controller is Micha Marketing di Michaela Beccari, based at Via Tetti Trinità 28, 10020 Montaldo Torinese (TO), Italy, VAT no. 12959970018, REA no. TO-1329260 (entry in the Turin register of businesses). For any request about your data, you can email the data controller.

2. Browsing the website

The website does not use cookies or any analytics or tracking tools, and it does not load scripts or fonts from external services (see the cookie policy). We therefore do not build any profile of visitors. The only information the website stores in your browser is the fact that you have closed the privacy and cookie notice, so that it is not shown to you again on every visit.

The web server that delivers the pages is configured not to keep access logs. However, for a page to reach your device, your IP address necessarily passes through the infrastructure of our hosting provider (Hostinger, in the European Union), which may keep technical system logs for the security and operation of its services. We do not use this data to identify you.

3. Consultation requests: what data we collect and why

If you fill in the ‘Request a consultation’ form, we process the data you enter:

• your first name and surname, your email address and, if you wish, your company;
• the text of your message, in which you describe the task that takes up most of your time;
• the day and time slot you choose for the consultation;
• the source of your visit: the page or website from which you reached the form, and any campaign parameters in the web address (so-called ‘UTM’ parameters, for example those in a link posted on social media). They are read only when you submit the form, and the website does not store anything in your browser;
• the tick box with which you confirm that you have read this notice: it serves only to record that you have received it and does not constitute consent.

We use your name, email address, message, day and time slot to reply to your request, arrange the free consultation and, should the opportunity arise, prepare a proposal. We use the source of your visit only to understand, in aggregate form, which channels our enquiries come from (see section 4). We do not use your data to send you unsolicited marketing communications, and we do not take decisions based on automated processing.

There is currently no newsletter: if we offer one in future, we will ask for your separate and specific consent, never pre-ticked, and we will update this notice beforehand.

If you write to us directly by email or on WhatsApp, we process the data contained in your message (and, on WhatsApp, your phone number) for the same purposes. It is not possible to contact us by phone.

Your data is processed using IT and electronic communication tools, with appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction. Apart from us, only the technical providers listed in section 6 may have access to it.

4. Lawful basis

We process the data in your request on two different lawful bases:

• your request: we need your name, email address, message, day and time slot to reply to you and arrange the consultation, in other words to take the pre-contractual steps you ask us to take (Article 6(1)(b) GDPR);
• our legitimate interest (Article 6(1)(f) GDPR): we need the source of your visit to understand which channels bring in enquiries and to decide where to invest time in promoting our business. We use it only in aggregate form and for internal analysis, without creating profiles.

Your name, email address and message are required: without them we cannot reply to you. Your company is optional; the day and time slot are used only to organise the meeting. If your request leads to a contract, we process the data needed to meet our accounting and tax obligations because the law requires us to (Article 6(1)(c) GDPR).

Right to object. You can object at any time to our use of the source of your visit by writing to the data controller: we will stop using that data and delete it from your request, with no effect on our reply or on the consultation.

5. How your data travels

The form sends your data to an automated workflow (n8n) installed on a server that we manage, hosted by Hostinger in a data centre in Frankfurt, in the European Union. From there, the workflow:

• records the request in our contacts database on Airtable;
• sends us an email with the content of the request to our business mailbox, hosted by Hostinger (European Union);
• creates a provisional event in our Google calendar on the day and in the time slot you chose, with the information needed to identify the request.

We also receive a generic alert on our phone telling us that a new email has arrived, without any data from the request.

Airtable and Google are based outside the European Union: the data they hold may also be processed in the United States (see section 7).

In future, request data may also be stored on Supabase, with servers in the European Union; if this happens, we will update this notice. In our work we use artificial intelligence models provided by third parties, but for now we do not send them the personal data of people who fill in the form. There are no chatbots or other interactive tools on the website that send your data to third parties.

6. Who your data may be disclosed to

Your data is not sold or passed on to third parties for advertising purposes. It may be processed by the providers we use, who act on our behalf or within the limits of their own terms of service:

• Hostinger, for hosting the website and the server on which the automated workflow runs (European Union);
• Airtable, for the contacts database (data may be processed in the United States);
• Google, for the calendar (data may also be processed outside the European Union);
• WhatsApp (Meta), only if you choose to write to us there;
• Supabase, if we use it for requests in future (European Union);
• SiteGround, with which the domain is registered.

You can ask us for the up-to-date list of providers.

7. Transfers outside the EU

The website and the server on which the automated workflow runs are in the European Union. However, some of the providers we use are based outside the EU and may also process data outside the European Economic Area, in particular in the United States:

• Airtable: EU data storage is not available on the plan we use, so the data in our contacts database may be processed in the United States. The transfer is governed by the standard contractual clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), which are included in Airtable's data processing agreement (DPA);
• Google (Calendar) and Meta (WhatsApp, only if you write to us there): the safeguards provided for by the GDPR for international transfers apply, together with those set out by each provider in its own data processing terms.

You can request a copy of these safeguards by writing to the data controller; Airtable's data processing agreement is also published on the provider's website.

If you would rather your request did not go through the automated workflow or our Airtable database, you can email us directly instead of using the form and ask us not to add you to our contacts database. In that case too, your message arrives in our business mailbox, hosted by Hostinger.

8. How long we keep your data

If your request does not lead to a contractual relationship, we keep your data for 24 months from our last contact. At the end of that period we delete it: the record in our contacts database, the emails and the calendar event (and, if you wrote to us on WhatsApp, the conversation). If a contract is concluded, the data needed is kept for the periods required by law for accounting and tax obligations.

9. Use of artificial intelligence

In our work we use artificial intelligence tools, for example to write code, prepare drafts and organise information. Some of the texts on the website were also prepared with the help of AI: we review and approve them ourselves.

Some of the images on the website, including the photograph of me, were edited or generated with artificial intelligence tools from real photographs of me, with my consent. The screenshots of our projects are illustrations: they reflect the structure of the software, but the data in them is made up.

We state this here and, for the photograph, in a short note next to the image, in line with the transparency obligations for content generated or manipulated by AI under Article 50 of Regulation (EU) 2024/1689 (AI Act).

There is no chatbot or other AI-based interactive content on the website that you can converse with. If one is introduced in future, we will say so on this page and at the point where you interact with it.

10. Your rights

You can request access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing (Articles 15–22 GDPR), in particular to our use of the source of your visit on the basis of our legitimate interest (see section 4). We do not currently process any data on the basis of your consent: if we do so in future, you will be able to withdraw it at any time, without affecting the lawfulness of processing carried out before you withdrew it. To exercise your rights, email the data controller: there is no charge for this and we will reply within one month. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection supervisory authority) (garanteprivacy.it).

11. Legal claims

Your data may be used, in court or in the stages leading up to legal proceedings, to defend the data controller against misuse of the website. The data controller may be required to disclose it by order of public authorities.

12. Changes to this notice

This notice may be updated: the date at the top shows when it was last revised. If the changes concern processing based on your consent, we will ask for your consent again where necessary.