- The controller is Marco Abbattista, a self-employed professional (VAT number IT08715670728), based at Strada Esterna Monte Cotugno 2/a, 70033 Corato (BA), Italy. Contact: info@nucleowp.dev, certified email (PEC) abbattista.marco@pec.it.
- We process data to manage your licence, the client area, invoicing and website security and, with your consent, for visit statistics. We do not profile you.
- You can exercise the rights provided by articles 15-22 of the GDPR and lodge a complaint with the Garante, the Italian data protection authority.
01Controller and providers
The data controller is Marco Abbattista, a self-employed professional (VAT number IT08715670728), based at Strada Esterna Monte Cotugno 2/a, 70033 Corato (BA), Italy. Email info@nucleowp.dev, certified email (PEC) abbattista.marco@pec.it.
The controller has not appointed a data protection officer (DPO), as this is not mandatory for this processing.
Some processing is entrusted to providers acting as processors under art. 28 of the GDPR. Stripe also processes payment data as an independent controller, under its own privacy notice.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare | Website hosting and form protection with Turnstile | IP address, technical browsing data, data entered in forms | United States, with GDPR safeguards |
| Stripe | Licence payment processing | Purchase, billing and payment data | Ireland (EU) |
| Brevo | Sending service emails, such as the client area sign-in link | Email address, name, content of the service email | France (EU) |
| Google Ireland (Google Analytics 4) | Visit and usage statistics | Pseudonymous browser identifier, pages viewed, interactions, technical device data | Ireland (EU), with transfers to the United States under the Data Privacy Framework |
02Data processed
We process the following data:
- account data: email address, name, preferred language and licence details;
- purchase and billing data;
- technical data: IP address and access logs for the website and the client area;
- data you enter in contact forms;
- browsing statistics, collected with Google Analytics as described on the cookie page.
03Purposes and legal bases
We rely on these legal bases:
- performance of the contract (art. 6, paragraph 1, letter b, GDPR): licence activation, client area, updates, support and renewal reminders;
- legal obligation (art. 6, paragraph 1, letter c, GDPR): issuing invoices and keeping accounting records;
- legitimate interest (art. 6, paragraph 1, letter f, GDPR): website security, abuse prevention, defence of the controller's rights and aggregate counting of visits without cookies;
- consent (art. 6, paragraph 1, letter a, GDPR): Google Analytics cookies, which you can withdraw at any time from the cookie preferences.
04Provision of data
Providing purchase data is necessary to activate the licence. Without this data, the licence cannot be issued.
05Client area
Access to the client area is by a link sent to your email address. No password is used. For the second factor we store the passkey public key or the encrypted authenticator app secret, and the recovery codes in hashed form.
The technical cookies needed for access are described on the cookie policy page.
06Retention
We keep account and licence data for the duration of the licence and for 12 months after it expires.
We keep purchase and billing data for ten years, as required by art. 2220 of the Italian Civil Code.
We keep technical logs for 30 days. An automatic job deletes them every night.
We anonymise accounts without an active licence 12 months after the last expiry: we delete email, name, sign-in factors and logs. Orders remain for tax purposes.
We keep the cookie consent record for 13 months. Google Analytics keeps analytics data for 14 months.
We keep completed privacy requests for 24 months, as proof of the reply.
07Transfers outside the EU
Cloudflare is based in the United States. Data transfers to the United States take place with the safeguards provided by the GDPR for providers operating there.
08Data subject rights
You can exercise these rights:
- access to your data (art. 15 GDPR);
- rectification (art. 16);
- erasure (art. 17);
- restriction of processing (art. 18);
- portability (art. 20);
- objection (art. 21).
09Requests and complaints
To exercise your rights, write to info@nucleowp.dev or to the certified email (PEC) abbattista.marco@pec.it. The controller replies within one month, extendable in the cases provided by law.
If you have an account, you can download your data and request erasure from the «Privacy and data» section of the client area. Without an account, use the form at nucleowp.dev/en/privacy/request and confirm the request with the link sent by email.
Erasure deletes your account, sign-in factors, logs and the related analytics data in Google Analytics. Orders and billing data remain for ten years, limited to tax obligations.
If you believe your rights have been infringed, you may lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
10Profiling
The website does not carry out profiling and does not use analytics or marketing cookies. See the cookie policy page.