Privacy Notice
How we process your personal data, pursuant to Regulation (EU) 2016/679.
Last updated: June 2026
This notice describes how the personal data of users who browse the website gcompassrl.info and use the contact, subscription and application forms on the site is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and applicable national legislation.
1. Data Controller
The Data Controller is GCompass & Partners. Updated references and contact details are published on www.gcompassrl.info.
For any matter relating to the processing of your data and to exercise your rights, you can contact us through the site’s contact form.
2. What data we process and for what purposes
We process only the data you voluntarily provide by filling in the site’s forms, together with certain technical data collected automatically for security and operational reasons.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Responding to requests sent via the Contact form (information, Diagnosis booking, call request) | First and last name, email, telephone, company, subject and content of the message | Performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b)) and consent (Art. 6(1)(a)) | 24 months from the last contact, unless a professional relationship is established |
| Preliminary assessment of the request through any company documents uploaded (e.g. business registry extract, financial statements) | Company documents voluntarily uploaded by the user and their content | Performance of pre-contractual measures (Art. 6(1)(b)) and consent (Art. 6(1)(a)) | 24 months from the last contact, unless a professional relationship is established |
| Newsletter / observatory subscription | Email address | Consent of the data subject (Art. 6(1)(a)) | Until consent is withdrawn (unsubscribe) |
| Management of applications as an occasional business associate / introducer | First and last name, email, telephone, content of the application | Performance of pre-contractual measures (Art. 6(1)(b)) and consent (Art. 6(1)(a)) | 24 months, unless the collaboration begins |
| Site security and prevention of abuse/spam | IP address, browser type (user-agent), date and time of submission | Legitimate interest of the Controller in security (Art. 6(1)(f)) | 12 months |
Providing the data marked as mandatory in the forms is necessary to act on your request: failure to provide it makes a response impossible. Providing the optional data (in particular company documents) is free and serves only to enable a more precise response.
3. How we process data
Data is processed using IT tools and with security measures adequate to protect it against unauthorised access, loss or disclosure. Requests sent through the site are stored in the Controller’s protected archives and transmitted by email to the institutional address. Any uploaded documents are kept in a restricted-access area, not publicly reachable from the web. We do not use your data for automated decision-making or profiling.
4. Who we share data with
Your data is not transferred or sold to third parties. It may be processed, on our behalf and under specific contractual safeguards, by the parties that provide us with strictly necessary technical services, acting as data processors:
- Aruba S.p.A. — hosting and email provider, with servers located in the European Union.
- Any consultants and collaborators of the Controller, bound by confidentiality, where necessary to handle the request.
Data may also be disclosed to public authorities where required by law.
5. Transfer of data outside the European Union
Data is stored and processed within the European Union. We do not transfer your data to third countries outside the EU.
6. Your rights
As a data subject, you may exercise at any time the rights set out in Articles 15-22 of the GDPR:
- access your data and obtain a copy of it;
- request its rectification or updating;
- request its erasure;
- request the restriction of processing;
- object to the processing and request data portability;
- withdraw the consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise these rights, simply write to info@gcompassrl.info. You also have the right to lodge a complaint with the supervisory authority, the Italian Data Protection Authority (Garante per la protezione dei dati personali).
7. Changes to this notice
The Controller may update this notice to reflect regulatory or organisational changes. The version in force is always the one published on this page, with the date of last update indicated.
For information on the cookies used by the site, see the Cookie Policy.