Privacy Policy

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

1. Data controller

The data controller is Davide Iacomi – Cromia (the “Controller”). For any request concerning the processing of personal data you can reach the Controller through the contact form available on this website.

2. Data we process

a) Data voluntarily provided through the contact form. The contact and quote form (operated through the Typeform service, see section 5) collects the data entered by the user, typically: first and last name, email address, phone number (optional), subject and content of the message.

b) Browsing data. This is a static presentation website: it has no user registration and performs no first-party profiling. As with any website, the systems hosting the site and the third-party services loaded by its pages (see section 5) may process, for technical operation and security purposes only, data such as IP address, browser type and request time.

3. Purposes and legal basis

  • Replying to contact and quote requests: data submitted through the form is processed in order to answer the user’s request. Legal basis: pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR).
  • Technical operation and security of the website: legal basis is the Controller’s legitimate interest in providing and securing the service (Art. 6(1)(f) GDPR).
  • Compliance with legal obligations, where applicable (Art. 6(1)(c) GDPR).

Providing data through the form is optional; however, failure to provide the mandatory fields makes it impossible to handle the request. Data is not used for marketing purposes nor sold or transferred to third parties for commercial purposes. No automated decision-making or profiling is carried out.

4. Storage and retention

Data is processed by electronic means with measures suitable to ensure its security and confidentiality. Data submitted through the contact form is kept for the time needed to handle the request and in any case no longer than 24 months from the last contact, unless the request results in a contractual relationship (in which case statutory retention periods apply) or retention is necessary to defend a legal claim.

5. Recipients and third-party services

Data may be processed, as independent controllers or processors, by the providers of the technical services used by this website:

  • Typeform S.L. (Barcelona, Spain – EU): operates the contact form embedded in the “Contact” pages. Data entered in the form is transmitted to and stored on Typeform’s systems. See Typeform’s own privacy policy for details.
  • jsDelivr (CDN): delivers the Bootstrap front-end framework files and receives the technical requests (including the IP address) needed to serve them.
  • Google Fonts (Google Ireland Ltd.): serves the typefaces used by the website and receives the technical requests needed to deliver the fonts.

Some CDN providers may operate servers outside the European Union; in that case transfers take place under the safeguards provided for by Articles 44 et seq. GDPR (adequacy decisions or standard contractual clauses).

6. Data subject rights

Under Articles 15–22 GDPR, data subjects have the right to access their data and to obtain its rectification or erasure, the restriction of processing, data portability, and to object to processing based on legitimate interest. Requests can be sent through the contact form. Data subjects also have the right to lodge a complaint with a supervisory authority; in Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

7. Updates

This notice may be updated from time to time; the version published on this page is the one in force. Last updated: July 2026.