Private area and guide privacy notice

Avv. Marco Perilli, Viale delle Milizie 34, Rome, Italy. Data rights contact: marco@perilaw.com.

Name, email, protected password and request status are processed to provide the requested free guide access (GDPR Article 6(1)(b)). Profession and organisation are optional. Security and the essential administrative record rely on the legitimate interest in protecting the service (Article 6(1)(f)). The checkbox records acknowledgement, not marketing consent. No newsletter subscription.

Email verification is required. Marco Perilli personally reviews requests; admission is not decided automatically. Registration does not activate AI features. Private-area data is not used in public statistics.

The service is hosted by Hetzner Online GmbH on a server in Finland under a data processing agreement. Microsoft 365 sends operational emails (recipient address and message content), under the controller’s direct subscription and the Microsoft Products and Services Data Protection Addendum. The service cannot read the mailbox. Social providers are disabled. The admin center lists European Union/EFTA for Exchange Online data at rest. Microsoft services may involve transfers and access from countries outside the EEA: the DPA provides contractual safeguards, including European Commission standard contractual clauses where applicable. Processing exclusively within the EU is not guaranteed for Microsoft. You may ask the controller for information and a copy of the applicable safeguards. The Microsoft DPA is available at Microsoft DPA.

First-party technical cookies maintain the session and protect authentication and the second factor; a session lasts up to 24 hours, renewed during use under the service rules, and is revoked on sign-out or account closure. These are not advertising cookies and do not require optional consent. Profession and organisation, if supplied, help the personal review of the request under the legitimate interest in managing access; you may omit them.

Unverified email: 7 days. Pending requests: 30 days with a reminder to the controller; declined requests: 30 days. Approved accounts: notice after 12 months without sign-ins, followed by deletion after another 30 days. Suspended accounts: review or deletion within 30 days. Technical logs: at most 15 days; encrypted backups: at most 30 days; essential administrative record: 12 months. These are Perilaw’s chosen periods. The owner administrator account is required while the service is managed and is not subject to user inactivity expiry.

Closing an account immediately revokes sessions and removes operational data. Backups expire within 30 days; restores must reapply deletions. Passwords cannot be viewed. Exceptional retention for disputes or incidents requires a reason, limited scope and review.

You may request access, rectification, erasure, restriction and, where applicable, portability and objection. You may complain to the Italian data protection authority. Required fields are necessary for access management; optional fields may be omitted.