Last updated: 10/10/2026
1. Who is the controller
The controller (titolare del trattamento) is [razão social], trading as Rotta Italia, with registered office at Via Cortelonga, 20900 Monza (MB), Italy, VAT no. (P.IVA) 000-000-00.
Privacy contact: contact@rottaitaliarelocation.com [confirmar e-mail].
Data Protection Officer (DPO). We have not appointed a DPO, because we are not a public authority and our core activities do not involve regular and systematic monitoring on a large scale or large-scale processing of special categories of data (Art. 37 GDPR). For any request, write to the address above.
2. In short
- The website is static. There is no sign-up area and no user database on our server.
- The pre-assessment form for doctors does not send your data to us: it only composes a message that opens in your WhatsApp. We receive the data only if you decide to send that message.
- The tools on the site (calculators, quiz, checklist, etc.) run their calculations in your browser. Nothing is sent to us.
- Analytics and advertising cookies (Google Analytics 4, Google Ads, Meta Pixel) are only activated if you accept. Rejecting is as easy as accepting. Details in the cookie policy.
- We do not sell personal data and we do not make automated decisions about you.
3. What data we process, why and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Replying to contacts via WhatsApp or e-mail and assessing your case before a contract (including the pre-assessment for doctors) | Name, WhatsApp number, country, medical specialty, citizenship, Italian level, message content and any documents you send us | Pre-contractual steps at your request (Art. 6(1)(b)) | Up to 24 months after the last contact if no contract follows [confirmar prazo] |
| Providing the services purchased (pre-analysis, consultations, relocation, concierge) | Identification and contact data, information on education, work, family and immigration status needed for the service, documents provided | Performance of a contract (Art. 6(1)(b)) | For the duration of the contract and then up to 10 years to defend legal claims (ordinary limitation period, Art. 2946 Italian Civil Code) |
| Invoicing and tax and accounting obligations | Billing data, payments, tax documents | Legal obligation (Art. 6(1)(c)) | 10 years (Art. 2220 Italian Civil Code) |
| Newsletter | E-mail, language, date and proof of consent, e-mail opens and clicks | Consent (Art. 6(1)(a)), which you can withdraw at any time | Until you unsubscribe; afterwards only a record of the unsubscription, so we do not write to you again, for up to 24 months [confirmar prazo] |
| Website usage statistics (Google Analytics 4) | Online identifiers (cookies), device and browser data, pages visited, approximate location; IP address not stored by GA4 | Consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code) | GA4 event data: 14 months [confirmar configuração]; cookies: see cookie policy |
| Advertising and campaign measurement (Google Ads, Meta Pixel) | Online identifiers (cookies), interaction data with ads and pages, device data | Consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code) | Cookies: up to 90 days (see cookie policy); data on the platforms: according to each account's settings [confirmar] |
| Remembering your language and cookie choice | Language and consent preference, stored in your browser (localStorage) | Legitimate interest in making the site work as you asked (Art. 6(1)(f)); strictly necessary storage, exempt from consent (Art. 122 Italian Privacy Code) | Until you clear your browser data; the cookie choice is asked again after 6 months |
| Delivery and security of the site (CDN and abuse protection) | IP address, date and time, page requested, browser (technical logs) | Legitimate interest in the security and operation of the site (Art. 6(1)(f)) | For the period set by Cloudflare for its technical logs, usually a few days [confirmar] |
| Defending legal claims in case of dispute | Any of the data above, as needed | Legitimate interest (Art. 6(1)(f)) | For the duration of the dispute and any appeal periods |
We do not ask for special categories of data (for example, health data). If you spontaneously send us documents containing such data, we process them only as far as necessary for the service you requested, based on your explicit consent (Art. 9(2)(a) GDPR) or to establish or defend legal claims (Art. 9(2)(f)).
4. Where the data comes from
In most cases, from you. When you purchase a service, we may receive data from partners working on your case (for example, the partner lawyer or partner commercialista) or from public bodies, always in connection with the service. Analytics and advertising cookies collect data from your device only after your consent.
5. Do you have to provide the data?
No. However, without the data needed to assess or perform a service, we cannot provide it. Consent to the newsletter and cookies is free: refusing does not limit your use of the site.
6. Form, tools and exchange rates
- Pre-assessment form for doctors. The fields you fill in are only used in your browser to compose a text. When you click the button, WhatsApp opens with the message ready. Nothing is sent until you tap "send" in WhatsApp.
- Site tools. Calculations happen in your browser. We do not store or receive the values you enter.
- Exchange rates. Some tools request the daily exchange rate from the public Frankfurter service (European Central Bank data). The request is made by your browser, so your IP address reaches Frankfurter's server, as with any internet access. No other data is sent and we receive nothing. Frankfurter is an independent project [confirmar operador e local de hospedagem].
- Fonts. Fonts are hosted on our own site. We do not use Google Fonts, so no data goes to Google because of them.
7. Who we share data with
We do not sell or rent data. It may be accessed by:
| Recipient | Role | Purpose |
|---|---|---|
| Cloudflare, Inc. (USA) and affiliates | Processor | Hosting (Cloudflare Pages), CDN and site security |
| Sendinblue SAS – Brevo (France, EU) | Processor | Sending the newsletter and managing subscriptions |
| Google Ireland Limited / Google LLC (USA) | Processor for analytics; for advertising, also an independent controller for certain operations under Google's terms | Google Analytics 4 and Google Ads, only with consent |
| Meta Platforms Ireland Limited / Meta Platforms, Inc. (USA) | Joint controller for collection via Meta Pixel (Art. 26 GDPR); independent controller for further processing | Meta Pixel, only with consent |
| WhatsApp Ireland Limited | Independent controller of the messaging service | WhatsApp communications you start |
| Partner lawyer, partner commercialista and other partner professionals | Independent controllers (licensed professionals) | Legal, tax or accounting acts in your case, only with your agreement |
| Accountant, banks and payment providers | Independent controllers or processors | Payments and tax obligations [indicar meio de pagamento] |
| Public authorities | Independent controllers | Where required by law or where, at your request, we file documents on your behalf |
We have agreements with our processors under Art. 28 GDPR. The current list is available on request at the contact address.
8. Transfers outside the European Union
Some providers (Cloudflare, Google, Meta) may process data in the United States. These transfers rely on the European Commission's adequacy decision on the EU–US Data Privacy Framework (10 July 2023), for certified companies, and additionally on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR). You can check certification on the official Data Privacy Framework website.
If you live in Brazil or another country outside the EU and communicate with us, data also moves between Italy and your country, as necessary to handle your request (Art. 49(1)(b) GDPR).
9. Security
We use encrypted connections (HTTPS), access limited to those who need the data, strong passwords and two-factor authentication on the accounts we use. No system is perfect; if a data breach poses a risk to you, we will inform you under Articles 33 and 34 GDPR.
10. Your rights
You may, at any time and free of charge:
- find out whether we process your data and get a copy (Art. 15);
- correct inaccurate or incomplete data (Art. 16);
- request erasure (Art. 17), unless the law requires us to keep it;
- request restriction of processing (Art. 18);
- receive your data in a structured, commonly used format (portability, Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent, without affecting prior processing (Art. 7(3)): for the newsletter, use the "unsubscribe" link in every e-mail; for cookies, use the button in the cookie policy.
How to exercise them: write to contact@rottaitaliarelocation.com. We reply within one month, extendable by two further months for complex requests (Art. 12(3)). We may ask for information to verify your identity.
11. Complaint to the authority
If you believe we process your data unlawfully, you can lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy) or with the supervisory authority of the EU country where you live or work (Art. 77 GDPR), or go to court.
12. Minors, automated decisions and changes
- Our services are intended for adults (18+). We do not knowingly collect data from minors; data of minor children is processed only when a parent or guardian provides it for a family relocation service.
- We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you (Art. 22).
- We may update this policy. The date at the top shows the latest version. Significant changes will be highlighted on the site.
Sources: Regulation (EU) 2016/679 – GDPR; Legislative Decree 196/2003 (Italian Privacy Code); Garante, Cookie Guidelines (10/06/2021); Implementing Decision (EU) 2023/1795 – Data Privacy Framework (accessed 10/2026).