Privacy policy
Put plainly, this page sets out which personal data reaches Variazione Civica Lab once you get in touch through this site, the purpose it serves, the way we handle it and the protections the law affords you. Variazione Civica Lab is run by a compact team of four researchers and has no marketing function.
Who is responsible
Variazione Civica Lab is a modest research outfit looking into the ways generative AI systems pull up, cite and wrongly attribute Italian firms, brands and places. Where the General Data Protection Regulation (GDPR) and Legislative Decree 196/2003 (the Italian Personal Data Protection Code, in its amended form) are concerned, whoever operates the site italia-gpt.com acts as the controller of the personal data set out below. With any privacy query, or to put a right into effect, simply write to hello@italia-gpt.com.
What is collected
Once you submit the contact form, the following reaches Variazione Civica Lab:
- Your name together with your email address — the bare minimum needed to write back to you.
- Whatever you type in the message: an account of the case, a sample prompt, which company or location is at stake and, should you wish, any public references you decide to attach — strictly the material you opt to pass along, nothing more.
The sole purpose of this information is to get back to you. There is no addition to any mailing list and no sharing with outside parties, the sole exception being the payment processor covered further down where it applies. On top of that, Variazione Civica Lab keeps a record of when the form went out (date and time) alongside a SHA-256 digest computed from your IP address with a salt added — a safeguard that keeps automated submissions at bay. The IP address as such is at no point retained, and the same goes for browser fingerprints and device metadata.
What is not collected
- No tracking cookies whatsoever: the analytics tool in use runs cookie-free and retains no identifier tied to an individual user.
- No remarketing pixels are running, and neither are marketing-automation tags or ad-network trackers.
- Nothing in the way of automated profiling, and no automated decision capable of producing legal effects on you.
- Personal data is put up neither for sale nor for transfer to commercial partners: that is simply not where the income comes from.
Legal basis for processing
Whatever you send through the form is processed under Article 6(1)(b) GDPR (pre-contractual steps taken at your own request). The IP digest, there to shield the form from abuse, instead rests on Article 6(1)(f) GDPR (legitimate interest). Any payment-status data that arises is handled on the contractual basis.
How long data is kept
- Form messages: retained throughout the work they relate to and for a further 24 months, so the thread of the exchange is not lost, after which they are removed. Those that lead nowhere are held for 12 months and then deleted.
- Payment traces: held for as long as the relevant tax and accounting rules demand, then erased.
- IP digests: kept on file for 90 days — ample for abuse protection — and subsequently removed.
- Email correspondence: retained for the whole of an active relationship or for 24 months counting from the last contact, taking whichever of the two spans is the longer.
Your rights
By virtue of the GDPR and the Italian Personal Data Protection Code, you are entitled to ask for access to your data, to have it corrected, to have it erased, to receive it in portable form, to have its processing restricted, or to object to that processing. To lodge any such request, just write to hello@italia-gpt.com; an answer follows inside one month. Should you take the view that the processing falls short of the law, the door remains open to a complaint before the Garante per la protezione dei dati personali (the Italian supervisory authority) or before the supervisory authority of the country where you live.
International transfers
The infrastructure that powers this site sits in European Union (Germany). In the event that further processors (email provider) happen to operate beyond the borders of the European Union, the transfers involved rest on standard contractual clauses and on the safeguards the recipient has made public.
Changes to this notice
Each time data-processing practices shift in any meaningful way, this notice is revised. The version currently in force is the one marked by the "Updated" date sitting at the top of the page. Changes of real substance stay prominent on the site home page for 30 days, so that visitors who come back are able to notice them.