Privacy policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

Last updated: 16 October 2026

1. Data controller

The controller is also the point of contact for data protection. No Data Protection Officer (DPO) has been appointed, as the conditions set out in Article 37 GDPR do not apply.

2. Types of data collected

We collect and process the following personal data:

• Identification and contact data: first name, surname, email address, telephone number, address of the property (provided through the website's contact form).
• Data about the service requested: type of work (garden maintenance, pruning, tree felling, design, etc.), contact preferences, any free-text notes.
• Communication data: content of the messages exchanged via WhatsApp (including with the automated assistant described in section 3), email or telephone while handling the request.
• Technical data of the request: the IP address and browser at the time the form is sent, which are recorded with the request and kept with it; they are not passed on to other companies of the network.
• Website access logs: IP address, page requested and browser, kept for security purposes according to the default rotation of the runtime environment.
• Review data: rating, text, the name and town you choose to give, opening of your personal link and moving on to Google (see "Reviews" in section 3).

Website usage statistics

To know how many people visit the site and which pages they read, we collect a few browsing statistics ourselves, without cookies or any other identifier stored on the device and without third-party tools. For each page viewed we record: the page, the referring page, the browser language, the browser, operating-system and device family (e.g. "Safari", "smartphone"), any campaign parameters in the address, time spent on the page and clicks on phone, e-mail, WhatsApp and map links and on contact buttons. The IP address is used at the time of the visit to derive an approximate location (country, region, city) and a pseudonymous identifier that changes every day, and is not saved in the statistics store; as for any web page, it appears in the server's technical logs listed above. The data are therefore pseudonymous, not anonymous: the daily identifier can no longer be linked to a person after two days, when the key used to compute it is deleted.

3. Purposes and legal basis of the processing

The data are processed for the following purposes:

• Replying to quote requests and managing the service — legal basis: performance of pre-contractual and contractual measures (Art. 6(1)(b) GDPR).
• Service communications (e.g. proposed appointments for the site visit, confirmations, reminders) — via WhatsApp, legal basis: explicit consent given when the form is submitted (Art. 6(1)(a) GDPR); via email, legal basis: performance of pre-contractual measures (Art. 6(1)(b) GDPR).
• Replies to WhatsApp messages by an automated assistant — the messages you send to the controller's WhatsApp number are answered by an automated assistant based on artificial intelligence, which replies on the controller's behalf and collects the information needed for the request; its first reply says so and links to this policy. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• Handing the request over to another company of the AVMG network, an independent controller, when the area or the service requested is covered by that company — legal basis: express consent (Art. 6(1)(a) GDPR), asked for through a dedicated personal link. On the same page you are asked separately for a fresh consent to receive WhatsApp messages from the company receiving the request: the consent given to the controller is not passed on to it. Consent may be withdrawn at any time; withdrawal does not affect a hand-off that has already taken place.
• Review requests after a job — legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR); publication of the review — legal basis: consent (Art. 6(1)(a) GDPR). See "Reviews" below.
• Accounting and tax obligations (issuing invoices, bookkeeping) — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Establishing or defending legal claims — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Website usage statistics: the Controller's legitimate interest (art. 6(1)(f) GDPR) in knowing how its own website performs; no profiling.

Reviews

After a job, the controller may ask you for a review with a personal link: by email, on the basis of its legitimate interest in hearing its customers' opinion (Art. 6(1)(f) GDPR), or by WhatsApp, only if you have consented to WhatsApp messages. On the same legitimate-interest basis we record when you open the link (date of the first opening and number of openings) and whether you choose to move on to Google to leave the review there; on Google, Google's privacy policy applies. Every request leads to the review page, where one click lets you ask not to receive any more; you can also do so by writing to [email protected].

If you leave the review on our website, we keep the rating and text and, only if you expressly allow it, publish it on the website with the name and town you choose to give — legal basis: consent (Art. 6(1)(a) GDPR). You may withdraw your consent to publication at any time, with the link on the review page or by writing to [email protected]: the review then no longer appears on the website.

4. How the data are processed

The data are processed electronically and on paper, in compliance with the technical and organisational security measures required by Article 32 GDPR. Access to the data is limited to the controller, to collaborators who have been expressly authorised and instructed and, within the limits set out in section 6, to the provider of the management platform.

The main IT systems (database, management application, email) are hosted by providers with data centres located in the European Union. CDN, DNS management, TLS termination and DDoS protection for the website verdevercelli.it are provided by Cloudflare; given the global nature of the service, some traffic metadata (IP addresses, HTTP headers, access logs) may pass through nodes located in non-EU countries, on the basis of the safeguards set out in section 6.

5. Retention period

• Archived or completed requests: 6 months from receipt; if you have become a customer, your data stay in the customer record (see "Active customers").
• Open requests that did not go ahead (quotes not accepted): 24 months from receipt.
• Hand-off to another company of the network: after the hand-off the controller no longer keeps the identifying data of the original request, only the record of the hand-off (date, channel, outcome, IP address and browser at the time of the reply, version of the text shown), together with the anonymous summary of the request (municipality, postcode, service, type of customer, role in the condominium, preferences, date, note from the sending company), as proof of consent, for 24 months from the closure of the hand-off (outcome or expiry).
• WhatsApp conversations: deleted after 6 months without new messages; the technical log of the individual messages is deleted after 12 months.
• Active customers: for the whole duration of the contractual relationship.
• Reviews and review requests: no automatic term; they are kept until you ask for your data as a customer to be deleted.
• Accounting and tax data: 10 years from the last entry, as required by tax law.
• Consent to be contacted on WhatsApp: until withdrawn by the data subject.
• Technical access logs: according to the default rotation of the runtime environment.
• Website usage statistics: about 13 months, in pseudonymous form.

6. Disclosure and transfer of data to third parties

Personal data may be disclosed to the following parties, solely for the purposes set out above:

• Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) — provider of the WhatsApp Business API used to send the messages the user has asked for. The controller uses its own WhatsApp Business number, connected to the management platform described below. Meta acts as a processor for the content and metadata of the messages exchanged. Privacy policy: whatsapp.com/legal/business-policy.
• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA — European office: Lisbon, Portugal) — provider of CDN, DNS management, TLS termination and DDoS protection for the website verdevercelli.it. Cloudflare processes IP addresses, HTTP headers and access logs solely for security and technical-functionality purposes. Privacy policy: cloudflare.com/privacypolicy.
• Anthropic Ireland, Limited (Dublin, Ireland) — provider of the artificial-intelligence model used by the WhatsApp automated assistant, sub-processor. It receives the text of the messages, in which your name and your telephone number, if known, are replaced by placeholders; any other data you write in the message are sent as they are. Processing takes place in the United States, on the basis of the Standard Contractual Clauses.
• Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — when a page of the website shows the controller's Google rating, your browser asks Google's servers for it directly (Google Places API), which receive your IP address and browser information (user agent). The website sends Google no other data and the request uses no cookies. Google processes these data under its own privacy policy: policies.google.com/privacy.
• Other companies of the AVMG network, independent controllers, only with your express consent and to handle the request you chose to transfer. Before consent the other company receives only an anonymous summary: municipality, postcode, service, type of customer, role in the condominium, appointment preferences, date of the request, a short note from the controller and, if the controller chooses to include it, the text of your request, which may contain data that identify you. With your consent it receives your name, contact details, address, service, preferences and the text of the request; it does not receive your IP address.
• The provider of the AVMG management platform, LEONARDO RICCARDO RAVOT, processor under Article 28 GDPR, which on the controller's behalf receives, routes and stores the requests and messages and runs the systems they are hosted on (EU data centres). Its staff may consult the controller's requests and technical logs to operate the service and provide support; these consultations are logged and the controller can check them. If a request arrives when no company of the network is assigned to the area, the platform provider holds it, as controller and only in order to assign it, until a company of the network takes it on. The list of sub-processors is available on request by writing to [email protected].
• Accountants and tax advisers, professionals engaged for the legal obligations and bound by professional secrecy.
• Competent authorities, only where required by law.

The data are not disseminated. Transfers to non-EU countries needed for the services listed above to work (WhatsApp/Meta, Cloudflare, Anthropic, Google) take place on the basis of the EU-US Data Privacy Framework (for certified providers) and/or the Standard Contractual Clauses approved by the European Commission, together with the other appropriate safeguards provided for in Chapter V GDPR.

7. Your rights as a data subject

You may exercise the following rights at any time, under Articles 15–22 GDPR:

• Access to your personal data and to information about how they are processed.
• Rectification of inaccurate data or completion of incomplete data.
• Erasure of the data ("right to be forgotten") in the cases provided for by law — see also Data deletion.
• Restriction of processing.
• Portability of the data in a structured, machine-readable format.
• Objection to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

To exercise these rights, write to [email protected]. We will reply within 30 days of receiving the request.

Complaint to the supervisory authority

You also have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali, the Italian data protection authority (Piazza Venezia 11, 00187 Rome — garanteprivacy.it), if you believe that the processing of your data infringes the applicable law.

8. Changes to this policy

This policy may be updated at any time; the date of the last update is shown at the top of the page. For the consent to a hand-off to another company of the network, the version of the text shown is kept. Any substantial change will be communicated to data subjects through the available contact channels.