Personal data processing notice.

Data controller

The Iurance brand is operated by an Italian-law company based in Italy. The full identity of the data controller is communicated on request at privacy@iurance.com and, in any event, when responding to requests for the exercise of rights under Articles 15-22 GDPR. No Data Protection Officer has been designated, as the conditions of Article 37 GDPR do not apply; an internal privacy contact is reachable at the same address.

Personal data collected

The Site collects only the data voluntarily provided through the contact form: firm or company name, role of the contact person, nature of the search, city, email address, and language preference. The visitor's IP address is transiently processed by the delivery infrastructure (Cloudflare) solely for security, bot mitigation, and service integrity purposes.

Purposes and legal bases

Data submitted through the form is processed to respond to the enquiry, qualify the nature of the mandate, and, where relevant, initiate the professional relationship. The legal basis is the performance of pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR) and, concurrently, the controller's legitimate interest in replying to communications concerning its professional activity (Art. 6(1)(f) GDPR). Traffic data processed by the delivery infrastructure relies on the legitimate interest in network and information security (recital 49 GDPR).

Recipients

Data is processed by suppliers appointed as data processors pursuant to Article 28 GDPR:

• Cloudflare, Inc. — CDN, DDoS mitigation, bot protection (Turnstile), and hosting of the Site via Cloudflare Pages.
• Resend, Inc. — delivery of transactional messages generated by the contact form.
• Self-hosted CRM running on the controller's infrastructure located within the European Union, used to manage incoming enquiries.

An updated list of processors is available on request at privacy@iurance.com.

Transfers outside the EEA

Cloudflare and Resend are companies based in the United States of America and may process data outside the European Economic Area. Transfers take place on the basis of the Standard Contractual Clauses adopted by the European Commission with Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented by the technical and organisational measures documented by each supplier. A copy of the safeguards can be obtained by writing to privacy@iurance.com.

Retention

Enquiries received through the form are retained in the CRM for the duration of the professional relationship and, absent continuation, for a period not exceeding twenty-four months from the last interaction. Data necessary to assert or defend a legal claim is retained for the ordinary statutory limitation periods (Art. 2946 of the Italian Civil Code). Security logs held by the delivery infrastructure follow that supplier's retention policy, typically ranging from a few days to several weeks.

Data subject rights

Data subjects may exercise the rights of access, rectification, erasure, restriction, portability, and objection set out in Articles 15-22 GDPR by writing to privacy@iurance.com. They also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.gpdp.it), under Article 77 GDPR and Article 141 of the Codice Privacy.

Cookies

The Site uses only technical cookies. Details are set out in the Cookie Policy.

Updates

This notice may be updated to reflect regulatory or organisational changes. The version in force is the one published on this page, with the date set out at the top.