Legal
Privacy Policy.
Information on the processing of personal data under Article 13 of EU Regulation 2016/679 (GDPR). Last updated: October 2026.
This is an English translation of our Italian privacy policy. In case of doubt or discrepancy, the Italian version prevails.
01Introduction
This policy describes how CASTE Strategy (the "Controller") collects, uses and protects the personal data of users who visit the website castestrategy.com, in accordance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
02Data we collect and how we collect it
2.1 Browsing data
Our IT systems automatically collect some technical data whose transmission is implicit in the use of Internet protocols: IP address, browser type, operating system, pages visited and time of access. This data is used only to make the site work properly and is deleted automatically after 7 days.
2.2 Data you provide through the contact form
When you fill in the contact form, we collect:
- Name (required)
- Email address (required)
- Phone number (optional)
- Service of interest and rough budget (optional)
- Project description (required)
The required fields are needed to reply to your request; if you do not provide them, we cannot handle your contact request.
2.3 Direct email
If you contact us by email at info@castestrategy.com, we collect the data contained in your message for the sole purpose of replying to it.
03Purposes and legal basis of processing
- Handling contact and quote requests. Legal basis: pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR)
- Performance of the services contract. Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
- Compliance with legal, tax and accounting obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR)
- Measuring the effectiveness of advertising campaigns through the Meta Pixel (see section 07). Legal basis: consent (Art. 6(1)(a) GDPR)
- Establishing, exercising or defending legal claims. Legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR)
We do not use your data for newsletters or marketing communications without your specific, separate consent.
04Data retention
- Contact requests that do not lead to a contract: 12 months from receipt, then deleted
- Data relating to contracts: 10 years from the end of the relationship (Article 2220 of the Italian Civil Code and tax obligations)
- Browsing data: 7 days
- Email communications: 2 years, unless they must be kept to protect legal rights
When these periods end, the data is deleted or irreversibly anonymised.
05Recipients and data transfers
Your data is not sold or passed on to third parties, except in the following cases:
- Netlify, Inc. (San Francisco, CA, USA): provider of the hosting infrastructure and of the contact form service, acting as Processor (Art. 28 GDPR). The transfer takes place under the EU-U.S. Data Privacy Framework. Privacy policy: netlify.com/privacy
- Meta Platforms Ireland Ltd. (Dublin, Ireland): provider of the Meta Pixel advertising measurement tool (see section 07). Privacy policy: facebook.com/privacy/policy
- Cloudflare, Inc.: content delivery network (CDN) from which the graphics library used on the home page is loaded; it receives only the technical data needed to serve the file (including the IP address).
- The Controller's professional advisers (accountants, legal advisers), only for the data needed to meet legal obligations, bound by professional confidentiality
- Competent authorities, when required by applicable law
06Data security
We take appropriate technical and organisational measures to protect your data from unauthorised access, including: encrypted HTTPS/TLS connection, anti-spam protection on the contact form (honeypot, time check), and access to data restricted to the Controller only.
07Cookies and tracking tools
The site uses technical cookies that are strictly necessary for it to work properly. Under Article 122 of Legislative Decree 196/2003 and the Guidelines of the Italian Data Protection Authority (Garante Privacy) of 10 June 2021, these do not require consent.
The site also uses the Meta Pixel, a Meta Platforms tool that measures the effectiveness of advertising campaigns and shows relevant ads to users who have visited the site. The Meta Pixel may collect browsing data and events (for example a page visit or a contact form submission). The Meta Pixel is activated only if you give your consent in the banner shown on your first visit; if you reject, it is not loaded. Your choice is saved in your browser for 6 months and you can change it at any time from , also available at the bottom of every page. You can also manage your ad preferences in Meta's ad settings, or disable cookies in your browser settings.
We do not use Google Analytics or any other behavioural analytics tools.
08Your rights (Articles 15-22 GDPR)
You have the right to:
- Access (Art. 15): get confirmation of whether your data is being processed and receive a copy
- Rectification (Art. 16): have inaccurate or incomplete data corrected
- Erasure / "right to be forgotten" (Art. 17): have your data deleted, where there is no obligation to keep it
- Restriction of processing (Art. 18): ask for processing to be restricted in certain cases
- Data portability (Art. 20): receive your data in a structured, machine-readable format
- Objection (Art. 21): object to processing based on legitimate interest
- Withdrawal of consent (Art. 7(3)): withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal
To exercise your rights, write to info@castestrategy.com. We will reply within 30 days of receipt, as required by Article 12 GDPR.
09Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (the Italian Data Protection Authority) if you believe the processing of your data breaches the GDPR.
Garante Privacy: www.garanteprivacy.it · garante@gpdp.it
10Changes to this policy
We may update this policy at any time, in particular following changes in the law. The updated version will be published on this page with a new date. Please check it from time to time.
This document was drafted in accordance with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree 196/2003 as amended, and the Guidelines of the Italian Data Protection Authority.