Privacy Policy

Controller: Riccardo Bozzato, based in Legnaro (PD), Italy.

Contact for any data-related question: [email protected].

The site is hosted on Netlify and distributed through Cloudflare (CDN and DNS). Both process technical data such as IP address and user agent to serve the site.

General contact form: name, email and message. Used for job applications, project enquiries or consulting.

Consulting services (Operational Audit, Operations Overhaul, Fractional Head of Operations): name, email, company, description of the operational problem, team and process details. For the Overhaul we may need platform details (Magento, Shopware, Pimcore) and temporary access credentials, destroyed at the end of the engagement. Prices are agreed on a call and in the written proposal: no rate is published on the site.

Free resource downloads (playbook): name and email address, used to deliver the PDF and send the email sequence (maximum 6 emails in 30 days). Double opt-in applies: without address confirmation the sequence does not start.

CV download: no data collected, the download is anonymous.

ShipKit purchase: name, email and billing address, handled by Stripe. I never receive or store your card details.

I use data to answer enquiries, deliver agreed services and, only if you requested the playbook, send you the operations email sequence. I do not sell your data, do not share it with third parties for marketing and do not use it to train models.

Playbook leads are stored on Netlify Blobs, a store located in the United States.

The site separates three categories and you choose which to accept.

Necessary: always active. They make the site work (session language, rate limiting, double opt-in and unsubscribe tokens) and cannot be disabled.

Analytics: Google Analytics 4, loaded only after your explicit consent. It runs with IP anonymization and with Google's advertising signals disabled unless you also accepted the advertising category. It tells me which pages get read.

Advertising: Google AdSense and its partners may set cookies to serve relevant ads and measure campaigns. These are also loaded only with your consent. The site may also host directly sold sponsored content, always labelled as such.

If you decline, neither GA4 nor AdSense is requested: the site works normally, without measurement or ads.

One exception I have to disclose: this site's Google Tag Manager container also contains a Hotjar tag, loaded on every visit without going through your consent. In practice it has never started a recording session — it sets no Hotjar cookies and transmits no page content — but the script is requested from Hotjar (Mitribes Inc., Malta and United States), which receives your IP address and user agent. Section 12 explains how to remove it.

The legal basis is your consent, given through an affirmative action. The email sequence uses double opt-in: you receive a confirmation email and the sequence starts only after you click the confirmation link.

Every email in the sequence contains an unsubscribe link that acts immediately. You can also change your cookie choices at any time, via the 'Cookie settings' link in the site footer.

Consent is never a condition of purchase.

Art. 6.1.a Consent: non-essential cookies, email sequence.

Art. 6.1.b Performance of a contract: replies to contact requests and services in progress.

Art. 6.1.c Legal obligation: billing data, retained for 10 years as required by tax law.

Art. 6.1.f Legitimate interest: site security (rate limiting, technical logs) and defence against abuse.

Contact requests and applications: 24 months from last contact, unless longer retention is legally required.

Billing data: 10 years (tax obligation).

Playbook sequence leads: 30 days after the last email, then deleted. If you unsubscribe, they are deleted immediately.

Technical security logs: 90 days.

Technical credentials provided for an Overhaul engagement: destroyed at the end of the engagement.

You can ask at any time for access, rectification, erasure, restriction, portability and objection, and you can withdraw consent.

To exercise them write to [email protected]. I reply within 30 days.

I apply no automated decision-making and no profiling. You can request your data in JSON format.

Only strictly necessary services, with the related processing:

Netlify (Netlify Inc., USA): hosting, Netlify Identity for admin area authentication, and Netlify Blobs for playbook lead storage.

Cloudflare (Cloudflare Inc., USA): CDN, DNS, attack mitigation and edge content delivery.

Google Ireland Limited (Ireland, with transfers to the USA): Google Analytics 4 and, if you accepted, Google AdSense.

Mitribes Inc. (trading as Hotjar, Malta and United States): the Hotjar script is requested on every visit through the Google Tag Manager container and receives IP address and user agent. It has not started recording sessions on the site.

Resend Inc. (USA): transactional and sequence email delivery.

Stripe Inc. (USA): payments, for the ShipKit purchase only.

Amazon EU S.a.r.l.: affiliate programme. Some outbound links are affiliate links and earn a commission. No additional tracking cookies are used for the affiliation.

Netlify, Cloudflare, Resend, Stripe, Google and Mitribes (Hotjar) process data outside the European Economic Area. These transfers rely on the European Commission's Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914, plus supplementary measures such as IP anonymization in Google Analytics.

You can request a copy of the applicable SCCs by writing to [email protected].

HTTPS with TLS sitewide, HSTS with a two-year max-age, a restrictive CSP, rate limiting on every API and fail-closed behaviour on all protected endpoints. Secrets are never committed to the repository and admin passwords are never hardcoded in source.

No system is breach-proof: in the event of a data breach I will notify you by email without undue delay and with the information required by the GDPR.

Netlify Identity: the authentication script is loaded on every page of the site, even though it is only used in the /login reserved area. It handles the session and may set technical cookies. No profiling cookies are set.

Google Tag Manager: the GTM-5XPLS93 container is injected by the Cloudflare CDN, not by this site's code, and is requested on every visit. I can disclose this but not directly control it: whoever manages that configuration can either remove it or make it respect consent.

Hotjar: the GTM-5XPLS93 container contains a Hotjar tag (site id 1792073) whose only trigger is page load, with no consent condition. The static.hotjar.com script is therefore requested on every visit, even if you decline every category, and Hotjar (Mitribes Inc.) receives your IP address and user agent. Checking the site I found no active recording sessions: no Hotjar cookies are set and no recording stream starts, so no page content is transmitted. If you would rather the script were not requested at all, the fix is to remove the tag from the GTM container, which I can do on request.

Google Fonts: fonts are served from fonts.gstatic.com, with the implied consequence that your IP address is sent to Google when the page loads. Fonts are served even if you refuse the analytics and advertising categories, because the page needs them to render.

Applications you send are processed to assess the role and, if successful, to manage the employment relationship. I do not share your application data with third parties and do not use it for marketing. You can request erasure at any time.

Site content, including estimates, metrics and case study results, is for information only and does not constitute legal, tax or financial advice. The user is responsible for decisions taken on the basis of the published information.

This notice may be updated, for example when new services, new technical partners or regulatory changes require it. The date at the top always reflects the latest revision. Substantial changes are notified by email to anyone who requested the playbook.

If you believe processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country of residence. You can always write to [email protected] first: I reply within 30 days.