Privacy notice

The controller is Plumma S.r.l., a company incorporated in Italy, with its registered office at Via Corsini 21, Fellicarolo, 41021 Fanano (MO) and its operational office at Via Provinciale 175/B, Crespellano, 40056 Valsamoggia (BO). VAT number IT04209450362, registered with the Modena company register under REA MO-451932.

Write to legal@plumma.it about anything in this notice, including a request to exercise the rights set out in section 8. We have not appointed a Data Protection Officer, because the processing described here does not meet the thresholds in article 37 of the GDPR. That position is reviewed as the service grows.

This notice covers this website: the pages you are reading and the enquiry form on the contact page.

It does not cover the Plumma Connect service. When an organisation registers for an account, signs an agreement and begins sending network commands, a separate set of documents applies, including the service agreement and the data processing agreement. In that relationship the client is the controller and Plumma is a processor acting on the client's instructions, which is the reverse of the position on this website. Those documents are published with the service at connect.plumma.it and are provided before any contract is signed.

It also does not cover the sites we link to. Section 8 of the terms of use says more about that.

This site is a set of static files. It sets no cookies, runs no analytics, embeds no tracking pixels and stores nothing in your browser. There is no consent banner because there is nothing to consent to, and that is a deliberate decision rather than an oversight.

Every font, image, stylesheet and video is served from our own domain, so reading a page sends a request to nobody but us.

The content delivery network that serves the site records the standard information any web server records in order to deliver a page and to defend itself: the IP address the request came from, the time, the page requested, the response, and the browser's user-agent string. We use this to keep the site available and to investigate abuse, which is our legitimate interest under article 6.1.f of the GDPR. We do not use it to build a profile of you and we do not combine it with anything else.

The contact page offers one form. What happens when you submit it depends on how the form is configured at the time, and the page tells you which it is doing.

When the form opens your mail client

Nothing is sent to us by the website. Your own mail program opens with the message prepared, and you decide whether to send it. At that point it is an ordinary email and nothing about it is different from writing to us directly.

When the form submits to us

The fields you filled in are sent to the address or service named in section 5 and reach us as a message. Those fields are your name, your company, your work email address, optionally your role, the market and motion you selected, your message, and optionally the name of the person who will read the coverage report. Nothing else is collected, and the form does not read anything from your browser beyond what you typed.

Why we are allowed to hold it

You asked us to get in touch about a commercial relationship, so the basis is article 6.1.b of the GDPR, steps taken at your request before entering into a contract. Where the exchange does not lead anywhere, our basis for keeping the correspondence for the period in section 7 is article 6.1.f, our legitimate interest in a record of who approached us and what we answered.

Please do not put special category data, or anyone's personal data other than your own and your colleagues' business contact details, into that form. It is a business enquiry form and nothing about it is designed for anything else.

We use Amazon Web Services EMEA SARL to host and deliver this site. The files live in the Milan region and are served from Amazon CloudFront. AWS acts as our processor under a data processing agreement.

If and when the enquiry form submits to an external service rather than opening your mail client, that provider is also a processor and is named here before the change goes live. At the date of this notice, the form opens your mail client, so no such provider is engaged.

Our business email is handled by Microsoft as part of Microsoft 365. A message you send us is stored in that mailbox.

We do not sell personal data, we do not share it for advertising, and we pay nobody for access to it.

The site is stored in the European Union. A content delivery network works by answering from the location nearest the person asking, so a page requested from outside the EEA is served from an edge location outside the EEA, and the request log for it is created there before being consolidated.

Where that happens, the transfer relies on the European Commission's standard contractual clauses together with the supplementary measures described in the relevant provider's documentation. The same applies to our business email.

Request logs are kept for a short operational period and then discarded. They are not archived.

Enquiries and the correspondence that follows are kept for twenty-four months from the last message, after which they are deleted unless the exchange has become a contract, in which case the records are kept for the period the contract and Italian tax and civil law require.

If you ask us to delete your enquiry before then, we will, unless we are required to keep it.

Under the GDPR you may ask us to:

• give you a copy of the personal data we hold about you
• correct it where it is wrong
• delete it
• restrict what we do with it while a question about it is resolved
• give you, or another provider, a portable copy of what you gave us
• stop processing it where we rely on legitimate interest, by objecting

Write to legal@plumma.it. We answer within one month, and we will say so if a request is complex enough to need the extension article 12 allows.

We take no automated decisions about visitors to this website and we do not profile you.

Tell us first, at legal@plumma.it, and we would rather hear it than not.

You also have the right to complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it. If you live or work in another EEA country, you may complain to your own authority instead.

This notice carries the date it was last reviewed, at the top of the page. When something material changes, the date changes with it and the previous version is available on request.

We will not quietly broaden what we do with your data under an unchanged notice.