Privacy Policy

The data controller is TERLIZZI SOCIETA' A RESPONSABILITA' LIMITATA · Via Pietro Colletta 133, 70022 Altamura (BA) · Italy · VAT 09088100723 · Tax code 09088100723 · REA BA-670903.

For privacy requests: PEC / certified email (official privacy channel; not a commercial inbox): terlizzisrl@pecaruba.it.

Depending on how you use the site, we may process:

• Identification and contact data (name, surname, email, phone) provided via forms or direct communications.
• Professional data you voluntarily include (e.g. company, role, project details).
• Technical browsing data (IP address, device/browser information, timestamps) needed for security and operation of the site.
• Cookie and similar technology data, as described in the Cookie Policy, only where required after consent.

We do not intentionally collect special categories of data (Art. 9 GDPR). Please do not include sensitive data in free-text fields.

• Responding to information and quote requests — Art. 6(1)(b) GDPR (pre-contractual measures at the user’s request).
• Managing Professionals Area accounts (including optional Google sign-in when configured) — Art. 6(1)(b) and (f).
• Operating and securing the website (strictly necessary technical processing, theme preference, consent storage) — Art. 6(1)(f) (legitimate interest).
• Loading optional map tiles (Mapbox dark tiles via Leaflet) — Art. 6(1)(a) (consent), withdrawable at any time.
• Compliance with legal obligations — Art. 6(1)(c).

• Contact/quote requests (leads): LEGAL_DATA_REQUIRED — retention period not yet defined by the controller; data are kept only as long as needed to handle the request and any related legal obligations once the period is set.
• Contractual/administrative records: for the periods required by civil, tax and accounting law.
• Technical logs: for the short period needed for security and diagnostics.
• Cookie consent preferences: until withdrawn, updated, or consent version changes.

Data may be accessed by authorised Terlizzi staff and by providers acting as processors under Art. 28 GDPR, limited to services actually configured:

• Application hosting / runtime: the project is prepared for Railway (Docker) as the primary production path; Vercel (region fra1) is documented as an alternative. LEGAL_DATA_REQUIRED: confirm which host is live in production and the related DPA.
• Database / leads & professionals store: Railway PostgreSQL when DATABASE_URL is set; otherwise JSON files on the same host volume.
• Transactional email for the contact form: Resend, only if RESEND_API_KEY and CONTACT_TO_EMAIL are configured in the environment.
• Professionals Area authentication: Auth.js session cookies on Terlizzi infrastructure; optional Google sign-in (Google LLC) only when OAuth credentials are configured.
• Optional interactive map tiles (Mapbox dark tiles via Leaflet): only after functional consent and only when verified coordinates are published — currently inactive.

Data are not sold. Where a provider may process data outside the EEA (e.g. certain cloud or OAuth providers), transfers rely on adequacy decisions or appropriate safeguards (e.g. Standard Contractual Clauses), subject to the agreements in force with that provider. LEGAL_DATA_REQUIRED: confirm transfer mechanisms in the signed DPAs for the live stack.

You may exercise the rights under Arts. 15–22 GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali — www.garanteprivacy.it).

To exercise your rights, contact PEC / certified email (official privacy channel; not a commercial inbox): terlizzisrl@pecaruba.it. We will reply without undue delay and in any event within one month, extendable as permitted by law.

We apply technical and organisational measures appropriate to the risk (access control, encrypted transport where applicable, least privilege). No system is risk-free; please use secure channels for particularly confidential information.

The site is aimed at adults and professionals. We do not knowingly collect data from minors under 14. If you believe a minor has provided data, contact us for deletion.

This notice may be updated to reflect legal, organisational or technical changes. The “Last updated” date at the top of this page is authoritative.