Last updated: 30 August 2026

This Privacy Policy explains how the personal data of users who visit https://side-b.eu or contact Side-B through the contact details and services displayed on the website are processed.

This notice is provided in accordance with Articles 12, 13 and 14 of Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applicable Italian data protection law.

1. Data Controller

The Data Controller is:

Andrea Cutispoto, trading as “Side-B”
Viale dei Quattro Venti 246
00152 Rome (RM), Italy
Email: a.cutispoto@side-b.eu
Telephone: +39 348 644 1439

Hereinafter, the “Controller”.

A Data Protection Officer has not been appointed because such an appointment does not appear to be mandatory in relation to the activities currently carried out by the Controller.

2. Categories of personal data processed

2.1 Browsing data

During normal operation, the IT systems and software procedures used to make the website available may collect data whose transmission is inherent in the use of Internet protocols.

This information may include:

  • IP address;
  • date and time of the request;
  • requested page and referring page;
  • browser, device and operating-system information;
  • Internet service provider;
  • server response status;
  • technical information relating to the browsing session;
  • logs required for the security and proper operation of the website.

This information is not normally collected to identify users directly, although identification may be possible when it is combined with other information.

2.2 Data voluntarily provided by users

Sending an email, making a telephone call or communicating through the contact details published on the website results in the processing of the information voluntarily supplied by the user.

This may include:

  • first and last name;
  • email address;
  • telephone number;
  • company, role or professional activity;
  • information about a project or opportunity;
  • the content of communications;
  • documents or materials supplied by the user.

Users should not provide special-category data under Article 9 GDPR, such as health, biometric, ethnic-origin, religious or political information, unless this is strictly necessary and has been agreed with the Controller in advance.

2.3 Call-booking data

The website contains links to the external Cal.eu service, through which users can book a call.

When users use this service, the following information may be collected:

  • first and last name;
  • email address;
  • appointment date and time;
  • time zone;
  • professional information;
  • answers provided during the booking process;
  • notes or additional information;
  • technical information relating to access to the service.

The booking form is completed and submitted on the Cal.eu website. Processing carried out directly by the platform is also governed by Cal.eu’s own privacy policy.

2.4 Cookies and similar technologies

The website may use technical cookies required for its operation.

Further information about the cookies used, their purposes, duration and available controls is provided in the Cookie Policy.

3. Purposes and legal bases

3.1 Website operation and security

Technical and browsing data may be processed to:

  • make the website and its features available;
  • maintain the security of the IT systems;
  • prevent unauthorised access, abuse, attacks and fraudulent activities;
  • diagnose technical issues;
  • carry out maintenance;
  • comply with lawful requests from public authorities.

The legal basis is the Controller’s legitimate interest in ensuring the operation and security of the website under Article 6(1)(f) GDPR, as well as compliance with applicable legal obligations.

3.2 Managing enquiries

Information communicated by email, telephone or other channels is processed to:

  • respond to enquiries;
  • provide information about the services;
  • assess projects and opportunities;
  • arrange calls and meetings;
  • prepare possible professional proposals.

The legal basis is taking steps at the user’s request before entering into a contract, under Article 6(1)(b) GDPR.

3.3 Appointment management

Booking information is processed to:

  • arrange the requested call;
  • send confirmations and reminders;
  • manage changes or cancellations;
  • contact the user in connection with the appointment.

The legal basis is taking pre-contractual steps at the user’s request.

3.4 Professional relationships

If communications lead to a professional or contractual relationship, personal data may be processed to:

  • prepare and perform the contract;
  • provide the requested services;
  • manage administrative, accounting and tax requirements;
  • coordinate professionals and suppliers involved in a transaction;
  • comply with legal obligations;
  • establish, exercise or defend legal claims.

The legal bases are performance of a contract, compliance with legal obligations and the Controller’s legitimate interest in protecting their rights.

3.5 Marketing communications

The website does not currently offer newsletter subscriptions or automated marketing communications.

If such activities are introduced, personal data will be processed on the basis of the user’s consent where required, and this Privacy Policy will be updated.

Consent may be withdrawn at any time.

4. Requirement to provide personal data

Technical data necessary for the operation of the website are collected automatically during browsing.

Providing information by email, telephone or Cal.eu is optional. However, failure to provide the necessary information may prevent the Controller from:

  • responding to the enquiry;
  • assessing the proposed project;
  • preparing a proposal;
  • arranging an appointment;
  • entering into or performing a professional relationship.

5. Processing methods and security

Personal data are processed electronically and, where necessary, manually.

The Controller adopts appropriate technical and organisational measures designed to protect personal data against:

  • loss;
  • destruction;
  • alteration;
  • unauthorised access;
  • unauthorised disclosure;
  • unlawful processing or processing incompatible with the stated purposes.

Access is restricted to persons who need the information to perform their duties.

6. Retention periods

Unless longer retention is required by law, a dispute or the need to protect a legal right:

  • technical and security logs are normally retained for no longer than 30 days, except where a security incident requires longer retention;
  • enquiries that do not result in a professional relationship are retained for up to 12 months from the last communication;
  • appointment information is retained for up to 12 months after the call, unless further communications take place;
  • pre-contractual and contractual information is retained for the duration of the relationship and for up to 10 years thereafter;
  • information required to protect a legal right may be retained for the duration of the relevant dispute;
  • information processed on the basis of consent is retained until consent is withdrawn or the relevant purpose ceases to apply.

At the end of the applicable retention period, the information is deleted or irreversibly anonymised.

7. Recipients and data processors

Where necessary, personal data may be processed by:

  • Aruba S.p.A., with registered office at Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, as the provider of the website hosting and email services;
  • Cal.eu, for appointment management;
  • providers responsible for the maintenance, security and technical management of the website;
  • legal, tax, administrative and technical advisers;
  • professionals and suppliers involved in assessing or carrying out a transaction;
  • financial institutions and administrative-service providers where required in connection with a contractual relationship;
  • public authorities where disclosure is required by law or by a lawful order.

Providers processing personal data on behalf of the Controller act, where applicable, as data processors under Article 28 GDPR.

Certain recipients may act as independent data controllers where they independently determine the purposes and methods of processing.

Personal data are not sold or made publicly available.

8. Place of processing and international transfers

Personal data processed through the hosting and email services supplied by Aruba are handled using infrastructure located in Italy.

The Controller gives preference to providers that process personal data within the European Economic Area.

If the use of a service involves transferring personal data to a country outside the European Economic Area, the transfer will take place in accordance with Articles 44 and following of the GDPR, on the basis of:

  • an adequacy decision adopted by the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • Binding Corporate Rules, where applicable;
  • or another safeguard recognised under applicable law.

Data subjects may request further information about the safeguards applied by contacting the Controller.

9. Links to external services

The website contains links to third-party websites and services, including:

  • Cal.eu, for booking calls;
  • LinkedIn, for accessing Side-B’s professional page.

The mere presence of a link does not necessarily result in information being transmitted to the external service.

When users select a link and visit a third-party website, processing by the destination website is governed by that provider’s privacy policy.

The Controller does not control and is not responsible for the way external websites process personal data.

10. Cookies

The website may use technical cookies required for browsing, security and preference management.

Any cookies or tracking technologies that are not strictly necessary will only be activated after obtaining the user’s consent where required by law.

Closing the banner or refusing non-essential cookies will not prevent ordinary use of the website.

Complete information is available in the Cookie Policy.

11. Data-subject rights

Where the conditions established by the GDPR are met, data subjects have the right to:

  • obtain confirmation as to whether their personal data are being processed;
  • access their personal data;
  • request rectification or updating;
  • request erasure;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • receive their data in a structured, commonly used and machine-readable format where the right to data portability applies;
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
  • not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Requests may be submitted to:

a.cutispoto@side-b.eu

The Controller will normally respond within one month. For particularly complex requests, this period may be extended within the limits allowed by the GDPR.

12. Right to lodge a complaint

Data subjects have the right to lodge a complaint with the Italian Data Protection Authority:

Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy
Website: www.garanteprivacy.it

Data subjects may alternatively contact the supervisory authority of the European country in which they live or work or in which the alleged infringement occurred.

13. Changes to this Privacy Policy

This Privacy Policy may be updated following legal, technical or organisational changes.

The current version will be published on this page together with its last-updated date.