Privacy notice
Data controller
Alessandro Sposito, Viale Aldini 232, 40136 Bologna (BO), Italy, VAT no. 02806461204. For any request about your data you can write to alessandro@sposito.eu. No data protection officer (DPO) has been appointed, as one is not required for this activity.
What data and where it comes from
I only process the data you provide through the site (forms, booking, Decision Lab, assistant) and the technical data strictly needed for the site to work. I do not obtain data from other sources and do not use data for commercial profiling or advertising.
Browsing and cookies
The site sets no cookies on your device and uses no analytics tools, pixels or third-party tracking services; its fonts are hosted on the site itself. The interactive features (assistant, Decision Lab, booking) use your browser's session storage, which is cleared when you close the tab. The server records the technical data needed for operation and security (IP address, date and time, page requested). To limit abuse, the site keeps a non-reversible fingerprint of the IP address for about an hour. Usage statistics are aggregate counters only, with no identifiers.
Contact form
When you write to me I process your name, email, company, role and message, in order to reply and assess your request. An automatic anti-spam check is computed in your browser: it collects no personal data and involves no external services.
Booking a call
To arrange a meeting I process your name, email, company, role, the summary you choose to share and the time you pick. The appointment is created in my Google calendar with a Google Meet link; you receive the calendar invitation and a confirmation email with a link to cancel.
Decision Lab
Your answers to the transformation map stay in your browser, for the duration of the session only. If you request the full report, I process the email, name and company you provide, together with your answers and results, in order to send it to you. If you allow it with the relevant checkbox, I may contact you about the report; you can withdraw consent at any time.
Assistant and artificial intelligence
The site's assistant and the Decision Lab use an artificial intelligence model from Anthropic. The messages you write to the assistant and your answers to the map are sent to Anthropic only to generate the reply, the next question or the report commentary. The site does not store conversations with the assistant, which stay in your browser tab. Please do not enter confidential data or unnecessary personal information.
Automated decisions
The Decision Lab profile is calculated with automatic rules and is indicative only: it has no legal effects on you and does not similarly significantly affect you. It is therefore not an automated decision within the meaning of Art. 22 GDPR, and any further assessment is made by a person.
Why your data is processed and on what basis
Replying to requests, arranging meetings and sending the report you asked for are carried out at your request, before any engagement (Art. 6(1)(b) GDPR). Contacting you after the report is based on your consent (Art. 6(1)(a)). Site security and abuse prevention are based on the controller's legitimate interest in protecting the site and the data it holds (Art. 6(1)(f)). If you become a client, some data is kept to meet legal obligations, such as tax requirements (Art. 6(1)(c)).
For how long
Requests received through the site (contacts, bookings, reports) are kept for 12 months and then deleted automatically. Emails and appointments remain in my mailbox and calendar for as long as needed to manage the relationship. Data relating to an engagement is kept for the period required by law (generally 10 years for tax records). The IP fingerprint is kept for about an hour; site backups are rotated and overwritten within two months.
Who processes data on my behalf
I do not sell or share your data. I use providers that process it on my behalf as data processors, under a written agreement: Newfold Digital (HostGator) for hosting, Google (Google Workspace: email, calendar, Meet) for email and appointments, and Anthropic for the artificial intelligence model.
Transfers outside the European Union
The site's server is located in the United States, and Google and Anthropic may also process data in the United States. Transfers rely on the European Commission's standard contractual clauses, included in the agreements with the providers, and, for providers that participate in it, on the EU-US adequacy decision (Data Privacy Framework). You can ask for information about these safeguards, or a copy of them, by writing to alessandro@sposito.eu.
Security
The site uses an encrypted connection (HTTPS), restricted and protected access, anti-spam and anti-abuse protections, and automatic deletion of requests when they expire. Keys to external services are stored outside the public areas of the server.
Providing your data
Providing data is optional. Without the data marked as necessary, however, I cannot reply to your request, arrange the appointment or send the report. The site is aimed at businesses and professionals and is not intended for anyone under 18.
Your rights
You can request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. You can withdraw any consent at any time, without affecting earlier processing. To do so, write to alessandro@sposito.eu: I reply within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Updates
Last updated: 2 November 2026. Any changes will be published on this page.