Privacy notice

Who we are

PICH LIMITED (“PiCh Ltd”, “we”, “us”) is the controller of personal information described in this notice.

PICH LIMITED is a private limited company registered in England and Wales under company number 15663532. Its registered office is 48-52 Penny Lane Mossley Hill, Liverpool, Merseyside, England, L18 1DG.

For privacy questions, rights requests or data-protection complaints, email info@pierluigichiusolo.com.

Information we collect

Depending on how you contact or use the site, we may collect:

• your name and email address;
• the engagement type you select;
• the message or other information you choose to provide;
• correspondence and meeting details;
• booking information requested on Cal.com, including your required name and email address, optional additional notes and guest email addresses, and the selected date, time, duration and timezone;
• technical information needed to deliver and protect the site or process a form, such as IP address, request date and time, requested page, browser/user-agent information, referrer, routing information and security events; and
• information needed to handle a privacy request or complaint, including reasonable identity-verification information and our response record.

Please do not send special-category information, criminal-offence information, financial-account details or other highly sensitive information through the contact form. Please also avoid including personal information about someone else unless it is necessary and you are entitled to provide it.

How we obtain information

We obtain information:

• directly from you when you submit the contact form, email us, book a meeting, communicate with us, or make a privacy request or complaint; and
• automatically from ordinary website and service requests handled by Cloudflare and, when you submit the form, by Web3Forms and its security or spam providers.

The LinkedIn and Cal.com pages are external services. Their own collection starts when you choose to follow those links.

Why we use information and our lawful bases

We use enquiry, email and booking information to:

• receive, assess and reply to enquiries;
• arrange requested calls;
• discuss and take steps towards a possible engagement;
• manage any resulting business relationship;
• keep the website, forms, email and booking services secure and working;
• prevent spam, fraud and misuse;
• comply with legal obligations and respond to rights requests or complaints; and
• establish, exercise or defend legal claims where necessary.

Where you ask us to take steps before entering a possible contract with you, we rely on the lawful basis that the processing is necessary to take those steps.

For general enquiries, business-to-business contacts, website operation, security, spam prevention and proportionate recordkeeping, we rely on our legitimate interests in communicating with prospective clients and professional contacts, operating and protecting our website and services, and maintaining appropriate business records. We balance those interests against your rights and reasonable expectations.

Where we must process information to meet a legal requirement, we rely on legal obligation. We do not use enquiry information to send marketing emails.

Providing information is voluntary, but we need your name, email address and enough information about your enquiry to respond. If you do not provide those details, we may be unable to deal with your enquiry.

We do not use this information for solely automated decisions that produce legal or similarly significant effects.

Contact form and Web3Forms

The contact form sends the information you enter to Web3Forms, a service operated by Web3Creative. Web3Forms processes the submission on our behalf before forwarding a notification to our Microsoft 365 mailbox.

Web3Forms may process the form contents and technical metadata such as IP address, timestamp and referrer. It uses infrastructure and subprocessors that include Amazon Web Services, Cloudflare, Hetzner, CleanTalk and Automattic/Akismet for hosting, delivery, security and spam screening.

The “Contact me” form uses Web3Forms’ free plan. Submission storage is enabled and configured to delete submissions after 365 days. Basic server-side spam filtering is enabled. CleanTalk or Automattic/Akismet may receive the submitter’s IP address and email address for spam assessment. Autoresponses, file uploads, CAPTCHA and optional integrations are not enabled.

Direct email and booking a meeting

If you email us, your email address, message, attachments and related delivery information are processed through Microsoft 365.

If you follow our booking link, you leave this website and use Cal.com, a service operated by Cal.com, Inc. Cal.com asks for your name and email address and allows you to provide additional notes and guest email addresses. It also processes booking details and technical or usage information according to its own privacy policy. PiCh Ltd receives the information needed to arrange and manage the meeting. Please do not include special-category, criminal-offence, financial-account or similarly sensitive information in the additional-notes field. Cal.com may process information outside the UK under the safeguards in its applicable terms. Its external pages may use cookies or similar technologies under Cal.com’s policies.

Website hosting and security

Cloudflare hosts and delivers this static website through its global network. To provide, protect and troubleshoot the service, Cloudflare processes request and security information such as IP addresses, traffic-routing data, request details, device/browser information and security signals. Cloudflare may produce operational network and security data under its terms.

LinkedIn and other external sites

The site contains ordinary links to LinkedIn. It does not embed a LinkedIn plugin, pixel or Insight Tag. If you follow a LinkedIn link, LinkedIn processes your information as an independent controller under its own privacy and cookie policies.

External services control their own pages. This notice describes PiCh Ltd’s processing and does not replace the privacy information shown by Cal.com, LinkedIn or another external site.

Who receives information

We use these service providers where relevant:

• Cloudflare, for website hosting, delivery and security;
• Web3Creative/Web3Forms and its subprocessors, for contact-form processing, delivery and spam prevention;
• Microsoft, for Microsoft 365 email; and
• Cal.com, for meeting bookings after you follow its external link.

We do not routinely share enquiry information with other recipients. We may disclose information where required by law, to a regulator or authority, or where necessary to obtain professional advice or establish, exercise or defend legal claims.

We do not sell personal information.

International transfers

Cloudflare operates a global network. Web3Creative operates from India and uses infrastructure and subprocessors in the EU, United States and other locations. Cal.com and LinkedIn may also process information internationally under their applicable terms.

Web3Forms’ DPA incorporates the 2021 EU Standard Contractual Clauses and the UK Addendum. We apply data minimisation, access restrictions, encryption in transit, provider encryption at rest, limited retention and a prohibition on submitting sensitive information. PiCh Ltd has documented a medium residual transfer risk and accepted it, while the formal completion of the incorporated UK Addendum remains subject to qualified review.

You may ask us for more information about the relevant safeguards by emailing info@pierluigichiusolo.com.

How long we keep information

We use the following rules:

• unsuccessful or inactive enquiries: up to 12 months after the last meaningful contact;
• booking records that do not become part of an ongoing relationship: up to 12 months after the meeting;
• enquiries that become client relationships: for the relationship and then for applicable legal, tax, insurance and claims periods;
• privacy requests and data-protection complaints: normally three years after closure; and
• security and operational information: for the shorter period set by the relevant provider or reasonably needed for security, troubleshooting and legal obligations.

We may keep information longer where required by law, a dispute or a legal hold, and may delete it sooner when it is no longer needed.

We normally delete unsuccessful enquiries from our active systems within 12 months. Web3Forms is configured to delete stored submissions after 365 days. Web3Forms does not publish a maximum period for overwriting every residual backup copy following dashboard deletion; PiCh Ltd has documented and accepted this residual risk while keeping the provider under review.

Security

We use proportionate technical and organisational measures intended to protect personal information. These include HTTPS/TLS in transit, self-hosted website assets, restrictive browser security headers, access controls in provider accounts, provider encryption at rest where offered, spam or abuse controls, and limiting access to people who need it.

No internet transmission or storage system is completely secure. Please do not use the contact form for highly sensitive information.

Your rights

Depending on the circumstances and applicable law, you may have rights to:

• receive information about our use of your information;
• access your information;
• correct inaccurate or incomplete information;
• have information erased;
• restrict its use;
• object to processing based on legitimate interests;
• receive or transfer information in a portable format where the legal conditions apply; and
• complain about our handling of your information.

You have the right to object to processing based on our legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

These rights are not absolute and differ according to the lawful basis and circumstances.

To exercise a right, email info@pierluigichiusolo.com. Tell us what you are asking for and provide enough information for us to locate the relevant records. We may request proportionate information to verify identity. We normally respond to rights requests within one month.

PiCh Ltd currently relies on the occasional, low-risk processing exemption from appointing an EU GDPR Article 27 representative. We will reassess this before regular EEA-facing consultancy begins and will publish representative details if an appointment becomes required.

Data-protection complaints

To make a data-protection complaint, email info@pierluigichiusolo.com. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you appropriately informed and tell you the outcome. You may also complain to the Information Commissioner’s Office.

The ICO is the UK data-protection regulator. Visit ico.org.uk/make-a-complaint/ or call 0303 123 1113. If EU GDPR applies, you may also have the right to complain to the supervisory authority where you live or work, or where the alleged infringement occurred.

ICO data-protection fee

PiCh Ltd presently relies on the ICO’s not-yet-trading and applicable core-business-purpose fee exemptions. This position will be reassessed before substantive consultancy involving personal information begins and at least every six months while the company remains pre-trading.

Cookies, analytics and tracking

The website does not currently use advertising pixels, behavioural analytics, third-party font services, or intentionally configured non-essential cookies or browser storage. Cloudflare still processes ordinary network requests and operational or security data to deliver the site.

Cloudflare can set strictly necessary security cookies when particular security or challenge features are used. PiCh Ltd has not enabled those features at the date of this notice.

External Cal.com and LinkedIn pages may use cookies or similar technologies under their own policies after you follow their links.

Changes to this notice

We may update this notice when our services, providers or legal obligations change. We will publish the revised version here and change the “last updated” date. Material changes should be brought to affected people’s attention where appropriate.