Last updated: 13 October 2026
This notice describes how we process the personal data of visitors to bureau39.it and, in particular, of anyone who uses the contact form on this site.
Data Controller
The data controller is Bureau 39, reachable at the email address [email protected]. For any request regarding the processing of your personal data, including requests to exercise the rights provided by the GDPR (see the "Your rights" section below), you can write to this address.
What data we collect
The site collects personal data through the contact form on the "Contact" page (name, company, country, website and area of interest) and, in aggregated and anonymised form, through Google Analytics (see "Cookies and measurement tools" below). Submitting the contact form requires accepting this notice.
The site does not use user registration, does not offer online purchases, and does not collect data through comments (comments are disabled on all published pages).
Purpose and legal basis of processing
Data collected through the contact form is processed solely to respond to the request received and, where applicable, to initiate a business relationship. The legal basis for processing is the data subject's consent (Art. 6(1)(a) of Regulation (EU) 2016/679 — GDPR), given when the form is submitted, or — for stages following an initial contact — the performance of pre-contractual measures requested by the data subject (Art. 6(1)(b)).
Data collected through Google Analytics is processed for statistical purposes (aggregated traffic and browsing behaviour analysis), based on the data subject's consent given through the cookie banner.
How data is processed and retained
Data submitted through the contact form is sent by email to the site's management address and is not stored in a database on the site itself. It is retained for as long as needed to handle the request and any resulting business relationship, and in any case no longer than 24 months from the last contact, unless a longer period is required by law.
Data collected through Google Analytics is retained according to Google's default retention periods (see Google's Privacy Policy for details).
Cookies and measurement tools
The site uses technical cookies necessary for its operation (including language and consent management) and, subject to consent, Google Analytics for statistical traffic measurement. Consent is requested through a banner compliant with Regulation (EU) 2016/679 (GDPR): no measurement cookie is set and no data is sent to Google before the user has given explicit consent (“Google Consent Mode” technology). For full details on the cookies used, their purpose and duration, see our Cookie Policy.
Subject to consent to statistics tools, the site also uses Microsoft Clarity, which records in pseudonymised form how pages are used (cursor movements, clicks, scrolling) and produces heatmaps, in order to improve their readability. Text typed into form fields is not recorded. Recordings are kept by Microsoft for 30 days.
Private documents (proposals)
Some pages of the site, reachable only through a private link and an access code, contain proposals addressed to individual clients or prospective clients. These pages are not indexed by search engines.
When a recipient opens one of these documents we record date and time, country and type of device (derived from the connection), referring site, reading time and the part of the document viewed. We also record, in pseudonymised form, how the document is viewed (cursor movements, clicks, scrolling), on our own server and through Microsoft Clarity. The notice is shown on the access page and recording starts only after the code has been entered.
The legal basis is the consent given by opening the document after reading the notice (Art. 6(1)(a) GDPR) and Bureau 39’s legitimate interest in understanding how its proposals are read in the context of pre-contractual negotiations (Art. 6(1)(f)). These data are used only to improve the documents and the relationship with the recipient, are not shared with third parties and are kept for the duration of the negotiation and in any case no longer than 24 months from the last opening.
Third-party providers and data recipients
To operate the site we rely on the following third-party providers, which may process technical data related to browsing:
- Keliweb — hosting and email service provider (Italy)
- Cloudflare, Inc. — content delivery network (CDN) and protection against cyberattacks
- Google Ireland Limited (Google Analytics) — statistical traffic analysis service, active only with the user's consent
- Microsoft Ireland Operations Limited (Microsoft Clarity) — service for analysing the browsing experience (pseudonymised recordings and heatmaps), active on public pages only with consent and on private documents as described above
Data transfers outside the European Economic Area
Some of the providers listed above (e.g. Cloudflare, Google, Microsoft) may also process data outside the European Economic Area. In such cases the transfer takes place on the basis of adequate safeguards provided for by the GDPR, such as the Standard Contractual Clauses approved by the European Commission.
Your rights
As a data subject, you have the right to:
- confirm whether processing is taking place and access your personal data;
- obtain rectification of inaccurate data or completion of incomplete data;
- obtain erasure of your data, where no longer necessary or in other cases provided by law;
- obtain restriction of processing;
- obtain data portability, where technically feasible;
- object to processing and withdraw consent at any time (including for measurement cookies, via the cookie banner settings), without affecting the lawfulness of processing based on consent given before withdrawal;
- lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali —www.garanteprivacy.it).
To exercise these rights, you can write to [email protected].
Changes to this notice
This notice may be updated from time to time, in particular when new services are activated or when data processing practices change. The date of the last update is shown at the top of this page.