Privacy Policy

1. Data controller

The data controller is [full legal entity name], with registered office at [full address], email: email@example.com (“SABRE Consulting”).

2. Data we process

The website may process technical browsing data, including IP address, request date and time, requested page, browser type and diagnostic information. If you contact us by email or telephone, we process the details and content you choose to provide.

The initial language is suggested using your browser’s Accept-Language setting without creating a profile. When you select ITA or ENG, the website stores your choice in a technical cookie.

3. Purposes and legal bases

• providing, securing and maintaining the website, based on the controller’s legitimate interests;
• responding to enquiries and taking requested pre-contractual steps;
• complying with applicable legal obligations.

4. Technical cookies

These cookies are first-party and strictly limited to the purposes above. They are not used for profiling, advertising or analytics.

5. Recipients and transfers

Data may be processed by duly authorised technical providers, including [hosting provider and location]. Any transfers outside the European Economic Area and their safeguards must be specified here. Data is not sold.

6. Retention

Data is retained only for as long as necessary for the purposes described above. Technical logs are retained for [log retention period]; communications are retained as required to handle the enquiry and meet applicable legal obligations.

7. Your rights

Where provided by the GDPR, you may request access, rectification, erasure, restriction, portability and objection, and withdraw any consent without affecting earlier processing. To exercise your rights, email email@example.com. You may also lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.

8. Changes

We may update this policy. The current version and its last-updated date will always be available on this page.

9. Contact form and delivery recovery

Contact-form details are used to respond to the enquiry. During delivery, the site may create an encrypted temporary recovery record containing the name, email address, optional company, and message. A record is deleted after confirmed delivery. If delivery fails, it may be retained for up to seven days so an authorised administrator can retry or delete it; expired records are removed automatically. If recovery storage is unavailable, the site does not represent the message as safely preserved.

TODO — legal approval required: confirm the applicable lawful basis and the retention period for correspondence after delivery.

10. Security and request logging

The site processes limited request metadata for security, rate limiting, abuse prevention, diagnostics, and service operation. Depending on approved configuration this may include no client IP, the full address in development, a truncated address, or an HMAC-pseudonymous value. Request bodies, contact fields, cookies, credentials, and authorisation headers are not intentionally logged. Pseudonymised IP values may still be personal data. Local operational logs are configured for seven-day age-based retention.

TODO — production approval required: approve the production IP mode, log access controls, and any operational retention changes before enabling them.

11. Cookies and optional technologies

Strictly necessary storage supports security, language selection, administration, and consent preferences. Preferences, analytics, and marketing are separate optional categories and are disabled by default. The current site inventory contains no enabled optional provider. If an optional provider is configured, it is not loaded before the relevant choice. Choices are versioned, normally expire after six months, and can be changed or withdrawn through Cookie Settings. Closing a notice, scrolling, or continuing to browse is not consent.

12. Recipients, security, and transfers

Access to recovery records is restricted to authorised administrators and protected fields are encrypted at rest using application data-protection keys held outside source control. Technical hosting, email delivery, and observability providers may process data only as required to provide their services.

TODO — legal and business confirmation required: identify the actual hosting, email, database, backup, and observability processors; their locations; contractual safeguards; and any international-transfer mechanism before production publication.

13. Rights and related terms

The rights and complaint routes described above also apply to these activities where provided by law. Withdrawing optional cookie consent does not affect the lawfulness of earlier processing and is not required to use the contact form. See also the Terms of Service.