Privacy Policy

This policy explains how personal data are processed on Build My Startup, under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

1. Data controller

Bigazzi Samuele (sole proprietorship — ditta individuale)
Registered office: Via Pier Capponi 99, Firenze (FI), Italy
VAT no.: IT07176450489
E-mail: amministrazione@leggefaidate.it

2. What data we process

• Sponsor data: company name, logo, website, brand colour, slogan and company description (these are published on the Site), and a contact e-mail address (never published).
• Payment data: handled directly by Stripe. We receive only the payment status, amount, Stripe session and payment identifiers, and the billing details Stripe returns. We never see card numbers.
• Technical data: IP address and request data in server logs, used for security, abuse prevention (rate limiting) and troubleshooting.
• Administrator data: a session cookie for the people who manage the Site.

Visitors can browse the Site without giving any personal data. We do not use advertising or analytics cookies and do not profile visitors.

3. Purposes and legal bases

• Performing the sponsorship contract and pre-contractual steps (reservation, checkout, moderation, installation, refunds): art. 6(1)(b) GDPR.
• Accounting, tax and legal obligations: art. 6(1)(c) GDPR.
• Security of the Site, preventing fraud and abuse, defending legal claims: legitimate interest, art. 6(1)(f) GDPR.
• Answering your messages: art. 6(1)(b) or (f) GDPR.

Providing sponsor data is necessary to buy a sponsorship; without it we cannot perform the contract.

4. Recipients and processors

• Stripe Payments Europe, Ltd. (Ireland): payment processing, as an independent controller for its own purposes.
• Vercel Inc. (USA): hosting, serverless functions and file storage for logos.
• The database provider connected to our Vercel project: storage of orders and sponsor data.

Some providers process data in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. Sponsor branding (company name, logo, website, slogan, description) is public by nature of the service.

5. Retention

• Sponsor branding: for the duration of the sponsorship, then removed from the public office.
• Orders and accounting records: 10 years, as required by Italian law (art. 2220 Civil Code).
• Reservations that never become a payment: up to 12 months, for fraud prevention and dispute handling.
• Server logs: according to our hosting provider’s retention, normally a few days to a few weeks.

6. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (arts. 15–22 GDPR), by writing to amministrazione@leggefaidate.it. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of your country.

7. Cookies

See the Cookie Policy.