Privacy notice
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, the Data Controller provides the following information on the processing of the personal data of users of the website slabengineering.com and of anyone who contacts the firm through the form, by email, by phone or on WhatsApp.
Data Controller
SLAB.engineering — Ing. Giovanni La Penna, self-employed professional
Via Privata Battista De Rolandi 1, 20156 Milano (MI)
Tax code (C.F.) LPNGNN85S02D643S — VAT no. IT10847710968
Email: info@slabengineering.com
Certified email (PEC): giovanni.lapenna1@ingpec.eu
Tel: +39 02 3598 5682
No Data Protection Officer (DPO) has been appointed, as the conditions of Art. 37 GDPR do not apply.
Categories of data processed
- Identification data: first name, surname, company name if any
- Contact data: email address, phone number, WhatsApp contact
- Content of the request: type of request, text of the message and any documents the data subject chooses to send
- Billing data: only if the request leads to an assignment — address, VAT number or tax code, SDI recipient code or certified email (PEC) address
- Browsing data: IP address, browser and device type, pages requested, date and time of the request (see below)
- Analytics data: collected only with consent, through Google Analytics (see Cookie Policy)
Special categories of data (Art. 9 GDPR) and data relating to criminal convictions and offences (Art. 10 GDPR) are not processed. If the data subject provides them spontaneously, they will be deleted without delay.
Browsing data
In the course of their normal operation, the IT systems that run the website collect certain data whose transmission is implicit in the use of Internet protocols: IP address, browser type and operating system, address of the page requested, time and server response code. These data are recorded in the technical logs of the hosting provider (Netlify), are used only to ensure the security and correct operation of the website and are not associated with identified data subjects. They are not used to profile users.
Purposes and legal basis of processing
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to requests for information and quotes sent through the form, by email, by phone or on WhatsApp | Pre-contractual measures taken at the request of the data subject (Art. 6.1.b) | 24 months from the last interaction |
| Performance of the professional assignment, if awarded | Performance of the contract (Art. 6.1.b) | Duration of the assignment + 10 years (Art. 2220 of the Italian Civil Code and limitation periods) |
| Invoicing and accounting and tax obligations | Legal obligation (Art. 6.1.c) | 10 years (Presidential Decree 633/1972, Art. 2220 of the Italian Civil Code) |
| Website security, diagnostics and abuse prevention, including the contact form's anti-spam filter (server technical logs) | Legitimate interest of the Data Controller (Art. 6.1.f) in the security and continuity of the service | According to the hosting provider's policy, normally no longer than 30 days |
| Statistical measurement of website use (Google Analytics 4) | Consent (Art. 6.1.a), given through the banner | Up to 14 months (see Cookie Policy) |
The website does not offer online bookings or payments, and the data are not used to send marketing communications or for profiling.
Whether providing data is mandatory, and consequences of refusal
Providing your name, email address and the content of the message is necessary to receive a reply: without these data the request cannot be followed up. The type of request is optional. Consent to statistical measurement is optional: refusing it has no consequences for browsing the website. The checkbox in the contact form only confirms that you have read this privacy notice and does not constitute consent to processing.
No automated decision-making
The Data Controller does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Methods of processing
Data are processed using IT tools and, where necessary, on paper, with technical and organisational measures appropriate to ensure their security and confidentiality (Art. 32 GDPR), by the Data Controller and by any authorised and instructed collaborators.
Recipients of the data
Data may be disclosed to the following parties, appointed as Data Processors under Art. 28 GDPR where the conditions apply:
- Netlify, Inc. — website hosting and receipt of messages sent through the contact form (Netlify Forms)
- Google Ireland Ltd. — statistical measurement services (Google Analytics 4), activated only with consent and within the limits set out in the Cookie Policy
- WhatsApp Ireland Ltd. (Meta group) — if the user chooses to contact the Data Controller through this channel
- Email service provider — for correspondence with the data subject
- Accountant and tax advisers — for accounting and tax obligations, in the event of an assignment
- Public authorities — upon a reasoned request and in the cases provided for by law
Data are not transferred to third parties for their own marketing purposes and are not disseminated. The up-to-date list of the parties appointed as Data Processors under Art. 28 of the Regulation is available at the Data Controller's office and can be requested by writing to info@slabengineering.com.
Transfer of data outside the European Union
Some of the providers listed above (in particular Netlify, Google and the Meta group) are based in, or have infrastructure in, the United States. Using their services may therefore involve a transfer of personal data outside the European Economic Area. Such transfers take place in compliance with Articles 44–49 GDPR, on the basis of the Standard Contractual Clauses approved by the European Commission and/or of the provider's participation in the EU-US Data Privacy Framework, as declared by each provider.
A copy of the safeguards adopted can be requested by writing to info@slabengineering.com.
Rights of the data subject
As a data subject, the user has the right to:
- Access (Art. 15): obtain confirmation of the processing and a copy of the data
- Rectification (Art. 16): correct inaccurate data or complete them
- Erasure (Art. 17): request erasure in the cases provided for
- Restriction (Art. 18): restrict processing in certain cases
- Portability (Art. 20): receive the data in a structured format
- Objection (Art. 21): object to processing based on legitimate interest
- Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before withdrawal
To exercise these rights, write to info@slabengineering.com. The Data Controller replies within one month of receiving the request; this period may be extended by two months in particularly complex cases, in which case the data subject is informed within the first month (Art. 12.3 GDPR).
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante Privacy) (www.garanteprivacy.it), Piazza Venezia 11, 00187 Roma.
Version and changes
Privacy notice — Version 2.0 of 9 October 2026. The Data Controller may amend this notice to reflect changes in legislation or in the services used. The version in force is always the one published at this address, with its date. Substantial changes are communicated to data subjects by appropriate means.