Last updated: 31 October 2026
The Data Controller is Castaldo Solutions S.R.L., with registered office at Piazza IV Novembre 4, 20124 Milan (MI), Italy. VAT and Tax Code 13859590963, registered with the Milan Monza Brianza Lodi Companies Register, REA MI 2748845, share capital € 10,000.00 fully paid up.
For any privacy-related question you can write to gaetano@castaldosolutions.it or use our contact page.
Data Protection Officer (DPO): not appointed, as none of the cases set out in Art. 37 GDPR applies. Data protection requests are handled directly by the Controller at the address above.
During your visit to our website, we automatically collect:
Purpose: Ensure website functionality, analyze performance, and improve user experience.
Legal basis: Legitimate interest (Art. 6, lett. f GDPR).
When you fill out our contact form, we collect:
Purpose: Respond to your information requests, prepare quotes and provide assistance.
Legal basis: Performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). We do not use the data from the form to send you commercial communications unrelated to your request: should we want to in future, we would first ask for your specific, separate consent.
Pages and campaign of origin help us understand which content and which campaigns generate requests. They stay with your request in our CRM, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
Nature of the provision: first name, last name and email are required in order to reply to you: without them we cannot follow up on your request. Phone, company and message are optional.
Recipients: data submitted through the contact form passes through our automation server (n8n, hosted on Hostinger infrastructure within the European Union) and is recorded in our CRM. To prepare our reply, the text of your message, the domain of your email address and the public information on your company's website are read by an OpenAI artificial intelligence model, which turns them into an internal brief and a draft reply for the person who will answer you. Your name, full email address and phone number are not sent; OpenAI acts as a data processor on our behalf, does not use this data to train its models and keeps it for no more than 30 days for abuse monitoring. The brief and the draft decide nothing: a person always reads the reply and sends it. The Partner Program and Referral forms follow the same path; for Partner Program applications the artificial intelligence model is not used.
We use different types of cookies on our website:
For detailed information about the cookies we use, their purposes and duration, please refer to our Cookie Policy. You can manage your preferences through the banner or by clicking .
Our forms are protected by Google reCAPTCHA v3, provided by Google Ireland Limited, which distinguishes human submissions from automated ones. The script loads only when you start interacting with a form, not when the page is simply opened.
reCAPTCHA collects your IP address, browser and device information and cursor movements within the page, and processes them to compute a trust score. We do not use this data to profile you or for marketing purposes.
Legal basis: the Controller's legitimate interest in protecting its systems from spam and automated submissions (Art. 6(1)(f) GDPR).
For details see the Google Privacy Policy and the Google Terms of Service.
When you apply by writing to candidature@castaldosolutions.it, we process the data contained in your message and its attachments:
Purpose: Assessing your application, running the selection process and getting back to you at its later stages.
Legal basis: Performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). For CVs sent on your own initiative, Art. 111-bis of the Italian Privacy Code provides that consent is not required: this is why we do not ask for it, and this page is the notice you are entitled to.
Special categories of data: please do not include in your CV any data about health, membership of protected categories, religious beliefs, political opinions or trade union membership. We do not need it to assess you and it plays no part in the selection. If you send it anyway, we process it only where necessary to comply with employment law obligations (Art. 9(2)(b) GDPR) and otherwise delete it.
No automated screening: no CV is discarded, ranked or assessed by an automated system or by artificial intelligence. Every decision on an application is made by a person.
Recipients: the mailbox is hosted on Google Workspace (Google Ireland Limited, acting as data processor) and access is limited to the people involved in the selection. We do not share your CV with other companies, clients or partners.
Retention: 12 months from the last meaningful contact, so we can reach out if a role that fits your profile opens up. Once that period ends, the message and its attachments are deleted. If your application leads to an employment relationship, the data follows the retention rules for that relationship.
You can ask us to delete your application before the 12 months are up at any time, by writing to the same address: we delete it without asking why. The other rights listed under point 7 apply in the same way.
When you complete one of our assessments or calculators, we store an anonymous row with the answers chosen from the lists and the scores on our automation server (n8n, hosted by Hostinger in the European Union), for aggregate statistics. The row contains no name, email, company, IP address or text written by you, and amounts are rounded. Like any visit to the site, the submission remains in the server logs, kept separately for 12 months.
In the Solutions Hub community on Discord you can write to Claira, the AI assistant that guides you through the blog articles, services and free resources. Claira only reads a message when you mention her or write to her privately, and to answer you she processes:
Purpose: to answer your question and point you to the site and community content that relates to it.
Legal basis: the service you ask us for when you write to Claira, as part of your participation in the community governed by the Terms of Service (Art. 6(1)(b) GDPR). For other members' messages read as context, our legitimate interest in giving an answer that fits the ongoing conversation (Art. 6(1)(f) GDPR).
Who generates the answer: the data listed above is sent to an OpenAI artificial intelligence model, on the same terms described in section 2.2: OpenAI acts as a data processor on our behalf, does not use this data to train its models and keeps it for no more than 30 days for abuse monitoring.
Retention: your question, Claira's answer, your Discord name and the channel are kept in the interaction log on our automation server (n8n, hosted by Hostinger in the European Union) for 12 months, then deleted. You can ask us to delete them sooner by writing to the addresses in section 1.
Claira makes no decisions about you: she points to articles and resources, and she can be wrong. Do not send her personal data about other people or confidential information about your company.
Below are the third-party services that process data collected through this website. Analytics and marketing services are activated only after your consent through the cookie banner.
This site uses Google Analytics 4, a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies to help us analyze how users interact with the site.
Data collected by Google Analytics 4:
IP addresses are anonymized and not stored in full by Google Analytics 4.
Purpose: Understanding user behavior, improving site experience, optimizing content.
Legal basis: Explicit user consent (Art. 6(1)(a) GDPR).
Retention: Data is retained for 14 months by Google Analytics 4.
Data transfer: Data may be transferred and processed on Google servers in the United States. Google is compliant with the EU-US Data Privacy Framework.
You can opt out of Google Analytics by deselecting "Analytics Cookies" in the consent banner or by visiting Google Analytics Opt-out Browser Add-on.
For more information on how Google uses data, see Google Privacy Policy.
This site uses the LinkedIn Insight Tag, an analytics and marketing service provided by LinkedIn Corporation.
Data collected by LinkedIn Insight Tag:
Purpose: Conversion tracking from LinkedIn advertising campaigns, retargeting, audience demographic analysis, marketing campaign optimization.
Legal basis: Explicit user consent (Art. 6(1)(a) GDPR).
Retention: Data is retained for 90 days by LinkedIn.
Data transfer: Data may be transferred and processed on LinkedIn servers in the United States. LinkedIn is compliant with the EU-US Data Privacy Framework.
You can opt out of the LinkedIn Insight Tag by deselecting "Marketing Cookies" in the consent banner or by managing advertising preferences on your LinkedIn account.
For more information on how LinkedIn uses data, see LinkedIn Privacy Policy.
When we advertise in ChatGPT we use the OpenAI measurement pixel and Conversions API, to know how many contact requests come from those ads. Both are activated only if you accept marketing cookies. For the data it receives, OpenAI acts as an independent controller: for people in the European Union this is OpenAI Ireland Limited.
Data shared with OpenAI:
Purpose: for us, measuring the results of our campaigns in ChatGPT and linking a contact request to the ad that generated it. As an independent controller, OpenAI may also use this data to provide and improve its own advertising services, according to its own privacy policy.
Legal basis: Explicit user consent (Art. 6(1)(a) GDPR).
Retention: the __oppref cookie lasts 30 days, __obref 12 months. OpenAI retains the data it receives according to its own privacy policy.
Data transfer: data of people in the European Union is processed by OpenAI Ireland Limited, which uses a valid transfer mechanism for any transfer outside the Union. See also section 6.
You can opt out by deselecting "Marketing" in the consent banner. If you withdraw consent, we delete the __oppref and __obref cookies and stop sending events to OpenAI.
For more information on how OpenAI processes data, see the OpenAI Privacy Policy.
Your data is processed by the Controller's authorised personnel and may be disclosed to the following parties, appointed as data processors under Art. 28 GDPR where they process data on our behalf:
We do not sell your personal data. The marketing providers that also process it for their own purposes (LinkedIn and OpenAI, only if you accept marketing cookies) use it according to their own privacy policies, referenced in sections 3.2 and 3.3.
Some providers (Google, LinkedIn, Calendly, OpenAI, Cloudflare) may also process data on servers located in the United States. These transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the provider is certified under it, or on the basis of the Standard Contractual Clauses adopted by the European Commission, supplemented by additional measures. You may request a copy of the safeguards in place by writing to the addresses in section 1.
In compliance with GDPR, you have the right to:
To exercise these rights write to gaetano@castaldosolutions.it or use our contact page. We reply within one month of the request, a deadline that may be extended by two months for particularly complex requests, in which case we will inform you. Exercising your rights is free of charge.
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The results of the calculators and assessments available on this website are indicative estimates generated from the data you enter: they are neither an automated evaluation of you nor a decision about you.
We apply appropriate technical and organisational measures to protect your data from unauthorised access, alteration, disclosure or destruction: encrypted HTTPS connections across the whole website, access to management tools limited to authorised personnel and protected by multi-factor authentication, periodic backups and regular system updates.
Our services are aimed at businesses and professionals and are not directed to minors under 16 years of age. We do not knowingly collect personal data from minors under 16; if you believe a minor's data has been provided to us, write to us and we will delete it.
We reserve the right to modify this Privacy Policy. Changes will be published on this page together with the update date; in case of substantial changes affecting processing based on consent we will highlight them and, where necessary, ask for your consent again.
You have the right to file a complaint with the Italian Data Protection Authority if you believe that the processing of your data violates GDPR.
Italian Data Protection Authority: www.gpdp.it
If you have questions about this Privacy Policy or data processing, don't hesitate to contact us.
Contact Us