Legal
Privacy notice
How we handle the personal data of people who visit this site or write to us. In short: we collect only what you send through the contact form, we do no profiling, and we sell nothing to anyone.
Last updated: 30 August 2026
1. Who processes your data
Utopys is the name under which three self-employed professionals work together, as joint controllers under Article 26 of Regulation (EU) 2016/679 (GDPR): Alberto Racca (VAT 18682241007), Giorgio Rubino (VAT 04609570710) and Alessandro Certomà (VAT 18682961000).
Contact details: Circonvallazione Clodia 36/B, 00195 Rome, Italy — phone +39 342 376 0360. For anything concerning personal data you can use the same details or the contact form on this site.
We have not appointed a Data Protection Officer: none of the cases that make one mandatory under Article 37 GDPR applies to us.
2. What we collect
Two categories only, and neither comes from any tracking activity.
What you send us. Through the contact form you give us: your name, email address, optionally a company name, the type of project, a rough budget range and the text of your message. Only name, email and message are required; leave the rest blank if you prefer. If you call or email us, we process whatever that communication contains.
Technical browsing data. Like any site reachable on the internet, the server records IP address, date and time of the request, the page requested, browser type and operating system. These keep the site running, protect it from abuse and help diagnose faults: we do not use them to identify you or to build profiles.
We do not process special categories of data (Article 9 GDPR) and we never ask for them: please do not include any in your message.
3. Why, and on what legal basis
| Purpose | Legal basis | How long |
|---|---|---|
| Answering your enquiry and preparing a quote | Pre-contractual steps at your request — Art. 6(1)(b) | 24 months from the last contact, if no engagement follows |
| Running the engagement, if one begins | Performance of a contract — Art. 6(1)(b) | For the duration of the relationship |
| Tax and accounting obligations | Legal obligation — Art. 6(1)(c) | 10 years, as Italian tax law requires |
| Site security and protection from abuse | Legitimate interest — Art. 6(1)(f) | Server logs kept for as long as technically needed |
| Measuring which pages work (Google Analytics) | Consent — Art. 6(1)(a), withdrawable at any time | 14 months, after which Google deletes the detailed data |
The consent you tick in the form covers sending the message and our getting back to you; the banner consent covers statistical measurement only, and the two are independent. We run no automated marketing, add you to no mailing list, and take no automated decisions producing legal effects concerning you (Article 22 GDPR).
4. Who else sees it
Your data is never sold, rented or traded. It is seen only by the three joint controllers and by the technical suppliers that keep the site running, appointed as processors under Article 28 GDPR.
| Supplier | What it does | Where |
|---|---|---|
| Vercel Inc. | Hosts the site and records its technical logs | United States — under standard contractual clauses |
| Formspree Inc. | Receives and delivers the contact form messages | United States — under standard contractual clauses |
| Google Ireland Ltd. | Serves the typefaces (Google Fonts): your browser discloses your IP while downloading them | European Union, with possible transfers to the United States |
| Google Ireland Ltd. — Analytics | Measures site visits, only if you have given consent. Advertising signals and ad personalisation are switched off | European Union, with possible transfers to the United States |
Transfers to the United States rely on the standard contractual clauses approved by the European Commission and, where applicable, on the suppliers' certification under the EU-US Data Privacy Framework. We will provide a copy of the safeguards on request.
Data may also be disclosed to judicial or police authorities where the law requires it.
5. Your rights
At any time, and without any formality, you can ask us to:
- tell you what data about you we hold, and give you a copy (Art. 15);
- correct it, if it is wrong or incomplete (Art. 16);
- erase it (Art. 17);
- restrict its processing (Art. 18);
- give it to you in a machine-readable format, or send it to another controller (Art. 20);
- stop processing based on our legitimate interest (Art. 21);
- withdraw your consent, without affecting what was lawful before (Art. 7(3)).
We answer within one month. If you believe the processing breaches the GDPR you can complain to the Italian supervisory authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or to the authority of the country where you live.
6. Security and retention
The site is served only over an encrypted connection (HTTPS). Access to the mailboxes and tools holding your messages is protected by multi-factor authentication. We keep data for the periods set out in the table in section 3, then delete or anonymise it.
7. Changes
If we change how we handle data we update this page and the date at the bottom. Substantial changes are flagged on the home page.