Privacy policy

The data controller is HMD Digital S.R.L., Via Lampedusa 37, 04011 Aprilia (LT), Italy, VAT IT03280710595.

For any question about this policy or to exercise your rights, write to [email protected].

Contact form. Your name, work email, company, company size and role, the process you describe, what it costs today in your own words, and an optional referral code. We use it to reply, to check whether there is a fit and to prepare the discovery conversation. Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR). If you enter a referral code, we use it to credit the partner who introduced you, based on our legitimate interest in running the partner program (Art. 6(1)(f)).

Booking a call. The booking calendar on the contact page is a Google Calendar appointment schedule, provided by Google. When you open that page, Google’s embed may load and Google receives the details you enter (such as your name, email, phone and the time you pick) to schedule the call and send the invitation. Legal basis: Art. 6(1)(b).

Partner application. Your name, company, email, role and the kind of businesses you usually work with. We use it to assess your application and, if approved, to set up the partnership. Legal basis: Art. 6(1)(b).

Partner portal. Your account email and name, the introductions you register, their stage, and fee totals we show you. Sign-in uses a one-time link sent to your email. We use it to provide the portal and to calculate and pay referral fees under the partner terms. Legal basis: performance of the partner agreement (Art. 6(1)(b)).

People introduced by a partner. When a partner registers an introduction, we receive the contact person's name, role, company and work contact details, a short description of the process and of the relationship with the partner. The partner confirms that the contact expects our call. We use these details only to reach out about a discovery conversation, based on our legitimate interest (Art. 6(1)(f)), and we tell the person where we got their details when we first contact them.

Emails you send us. The content of your message and your contact details, to reply and follow up. Legal basis: Art. 6(1)(b) or our legitimate interest in answering (Art. 6(1)(f)).

Analytics. We use Umami, which we host ourselves. It is cookieless and records aggregated information such as pages viewed, referring site, browser, device type and approximate country. It does not store your IP address or build a profile of you. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f)).

Server logs. When you load a page, our servers process technical data such as your IP address, the time, the page requested and your browser, to deliver the site and keep it secure. Legal basis: Art. 6(1)(f).

Clients. If we work together, we keep the records that contracts and invoicing require. Legal basis: the contract (Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)).

You are never required to give us personal data, but without contact details we cannot reply to you, and without an account you cannot use the partner portal.

The public site sets no cookies for analytics, advertising or tracking, so there is no cookie banner.

The partner portal sets a strictly necessary authentication cookie when you log in, to keep you signed in. It is used for nothing else and does not require consent.

If you use the "Reduce motion" switch in the footer, your choice is saved in your browser's local storage. It never leaves your device.

• Twenty, an open-source CRM that we host ourselves, stores form submissions, partner records and introductions.
• Hosting and network providers process technical data needed to deliver the site, the portal and the CRM securely.
• Our email provider handles messages sent to and from [email protected].
• Google (Google Calendar appointment schedules) handles bookings when you use the calendar.
• Professional advisers, such as our accountant, where needed for legal and tax obligations, and public authorities where the law requires it.

Providers act on our instructions and only for the purposes described here. We do not sell personal data and we do not use it for advertising.

We keep data in the European Economic Area where we can. If a provider, such as Google, processes data outside it, the transfer relies on safeguards recognised by the GDPR, such as a European Commission adequacy decision or Standard Contractual Clauses.

• Enquiries and bookings: for as long as needed to handle the conversation and follow up. If no work follows, we delete or anonymise them once they are no longer needed.
• Partner accounts and introductions: for as long as the partnership lasts and as long as needed to settle any fees due, then as required by law.
• Contracts and invoices: for the period Italian law requires for accounting records (ten years, art. 2220 of the Civil Code).
• Server logs: for a short period, for security and troubleshooting.
• Analytics: aggregated only, with no personal data to delete.

Under the GDPR you can ask us to:

• give you access to the personal data we hold about you and a copy of it;
• correct data that is wrong or incomplete;
• delete your data, where there is no reason for us to keep it;
• restrict how we use it while a request is being checked;
• send it to you or to another company in a portable format, where it is processed under a contract;
• stop using it where we rely on legitimate interest, including any contact about our services.

Write to [email protected]. We reply within one month, as the GDPR requires, and may ask you to confirm your identity first.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority where you live or work.

Access to personal data is limited to the people who need it for the purposes above. Connections to the site are encrypted, portal access uses short-lived email sign-in links rather than passwords, and the systems that hold the data are kept up to date.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

If the way we handle data changes, we update this page and the date at the top.