Privacy policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

Last updated: 24 September 2026

1. Data controller

The controller is also the point of contact for data protection. No Data Protection Officer (DPO) has been appointed, as the conditions set out in Article 37 GDPR do not apply.

2. Types of data collected

We collect and process the following personal data:

• Identification and contact data: first name, surname, email address, telephone number, address of the property (provided through the website's contact form).
• Data about the service requested: type of work (garden maintenance, pruning, tree felling, design, etc.), contact preferences, any free-text notes.
• Communication data: content of the messages sent via WhatsApp, email or telephone while handling the request.
• Technical data: IP address, website access logs (kept for security purposes for a maximum of 30 days).

Website usage statistics

To know how many people visit the site and which pages they read, we collect a few browsing statistics ourselves, without cookies or any other identifier stored on the device and without third-party tools. For each page viewed we record: the page, the referring page, the browser language, the browser, operating-system and device family (e.g. "Safari", "smartphone"), any campaign parameters in the address, time spent on the page and clicks on phone, e-mail, WhatsApp and map links and on contact buttons. The IP address is used only at the time of the request to derive an approximate location (country, region, city) and a pseudonymous identifier that changes every day, and is not stored. None of this data makes it possible to identify a person.

3. Purposes and legal basis of the processing

The data are processed for the following purposes:

• Replying to quote requests and managing the service — legal basis: performance of pre-contractual and contractual measures (Art. 6(1)(b) GDPR).
• Service communications via WhatsApp and email (e.g. proposed appointments for the site visit, confirmations, reminders) — legal basis: explicit consent given when the form is submitted (Art. 6(1)(a) GDPR).
• Accounting and tax obligations (issuing invoices, bookkeeping) — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Establishing or defending legal claims — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Website usage statistics: the Controller's legitimate interest (art. 6(1)(f) GDPR) in knowing how its own website performs; no profiling.

4. How the data are processed

The data are processed electronically and on paper, in compliance with the technical and organisational security measures required by Article 32 GDPR. Access to the data is limited to the controller and to collaborators who have been expressly authorised and instructed.

The main IT systems (database, management application, email) are hosted by providers with data centres located in the European Union. CDN, DNS management, TLS termination and DDoS protection for the website verdevercelli.it are provided by Cloudflare; given the global nature of the service, some traffic metadata (IP addresses, HTTP headers, access logs) may pass through nodes located in non-EU countries, on the basis of the safeguards set out in section 6.

5. Retention period

• Requests that did not go ahead (quotes not accepted): 24 months from the last contact.
• Active customers: for the whole duration of the contractual relationship.
• Accounting and tax data: 10 years from the last entry, as required by tax law.
• Consent to be contacted on WhatsApp: until withdrawn by the data subject.
• Technical access logs: 30 days at most.
• Website usage statistics: about 13 months, in pseudonymous form.

6. Disclosure and transfer of data to third parties

Personal data may be disclosed to the following parties, solely for the purposes set out above:

• Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) — provider of the WhatsApp Business API used to send the messages the user has asked for. Meta acts as a processor for the content and metadata of the messages exchanged. Privacy policy: whatsapp.com/legal/business-policy.
• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA — European office: Lisbon, Portugal) — provider of CDN, DNS management, TLS termination and DDoS protection for the website verdevercelli.it. Cloudflare processes IP addresses, HTTP headers and access logs solely for security and technical-functionality purposes. Privacy policy: cloudflare.com/privacypolicy.
• Technical service providers for hosting, email and operations (EU data centres), appointed as processors under Article 28 GDPR. The up-to-date list is available on request by writing to [email protected].
• Accountants and tax advisers, professionals engaged for the legal obligations and bound by professional secrecy.
• Competent authorities, only where required by law.

The data are not disseminated and are not systematically transferred to non-EU countries. Any transfer needed for technical services to work (e.g. WhatsApp/Meta, Cloudflare) takes place on the basis of the EU-US Data Privacy Framework (for certified providers) and/or the Standard Contractual Clauses approved by the European Commission, together with the other appropriate safeguards provided for in Chapter V GDPR.

7. Your rights as a data subject

You may exercise the following rights at any time, under Articles 15–22 GDPR:

• Access to your personal data and to information about how they are processed.
• Rectification of inaccurate data or completion of incomplete data.
• Erasure of the data ("right to be forgotten") in the cases provided for by law — see also Data deletion.
• Restriction of processing.
• Portability of the data in a structured, machine-readable format.
• Objection to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

To exercise these rights, write to [email protected]. We will reply within 30 days of receiving the request.

Complaint to the supervisory authority

You also have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali, the Italian data protection authority (Piazza Venezia 11, 00187 Rome — garanteprivacy.it), if you believe that the processing of your data infringes the applicable law.

8. Changes to this policy

This policy may be updated at any time. Previous versions are kept as evidence. Any substantial change will be communicated to data subjects through the available contact channels.