Privacy notice

The operator of this website is Altuon, a sole proprietorship registered in Italy. Its legal name, registered office, VAT number and contact details are set out in the operator block at the start of this notice.

For every item of personal data collected through this website, the operator is the controller within the meaning of the General Data Protection Regulation. That means the operator decides what is collected and why, and is the party you address when you want to exercise a right over your data.

Where the operator has appointed a data protection contact, that contact is given at the end of this notice; the general contact details are in the operator block at the start. Either address reaches the person responsible.

This notice applies to altuon.com in all six of its languages and to the requests you send through it. It does not apply to the processing Altuon carries out for a client under an engagement agreement; that processing is governed by the agreement and its data processing terms, and Altuon acts there as a processor on the client's instructions.

It also does not cover other websites you reach by following a link from this one, including the operator's profiles on professional and social networks. Those services have their own notices.

The website is available in English, German, French, Arabic, Turkish and Italian. The language you read is decided by the address you visit. It is never inferred from your browser settings, your IP address or your location, and no record is kept of which language you chose.

Reading this website requires no account and asks for no personal data beyond the technical data every web server receives, described under hosting and server logs below. Personal data is collected only when you fill in one of the four forms, and each form asks only for what is needed to answer the request it serves.

Proposal request: your brief, name, organisation and email address; the selected offer where applicable; and optional telephone, disciplines, region, timing, budget amount and currency, confidentiality preference and attachments. Files may be PDF, PNG or JPEG, up to three files and 3.5 MB in total. These details are used to assess and answer the request.

Meeting request: your name, email address, organisation, region and agenda, with optional preferred times. The request is used to prepare a reply and agree an appointment; it does not book a calendar slot.

Job application. Your name and email address, your CV as a PDF, links you choose to share such as a portfolio or professional profile, a letter explaining why this role and why now, where you would work from and your earliest start date. This is used to assess your application for the role you applied to and to reply to you.

Contact form. Your name, email address, a subject and your message. This is used to route the message to the team for your region and to reply.

Forms use a hidden anti-abuse field and a request-rate limit. There is no minimum completion time. Rejected or undelivered requests do not receive a success receipt. A separate email copy is sent only where email delivery succeeds.

Ordinary business enquiries are processed under Article 6(1)(f) GDPR: the legitimate interest in answering a request addressed to the operator. Where an individual requests steps towards their own contract, Article 6(1)(b) applies to those steps. Neither basis authorises unrelated marketing.

Applications are processed for steps requested before an employment contract under Article 6(1)(b). Keeping an application for unrelated future opportunities requires a separate choice.

Technical security and abuse prevention rely on the legitimate interest in operating a reliable website. The required form checkbox acknowledges this notice; it is not marketing consent.

You may object to processing based on legitimate interest. Where a separate optional activity relies on consent, you may withdraw that consent without affecting earlier lawful processing.

Requests are validated on the website server. The recipients listed above describe the configured onward delivery services. The website does not write form content or attachments to its own persistent storage.

A request with files is accepted only when the email service has delivered the file bytes to the operator. Other notifications may contain filenames and sizes. A confirmation email is separate from delivery to the operator; the page states whether a copy was sent.

If delivery is unavailable, the page keeps your entries and offers an email alternative. Nothing is forwarded through an unconfigured channel. Files must be attached again in your email app.

Public pages are prepared in advance. Forms and some error responses use server processing. Preferences are read in your browser; the maintenance gate reads its access cookie only when active. Hosting is provided by Vercel. CDN delivery location does not establish the processing location of a form submission.

Like every web server, the edge network records each request it serves: the IP address it came from, the browser and operating system announced in the user agent string, the address requested and the time. The hosting provider processes these logs to deliver the site, to balance load, to detect and block abuse and to diagnose faults. The logs are kept for a short period set by the provider and are then discarded. The operator does not export them, does not join them with form submissions and does not use them to identify visitors.

The site does not use a font service, an embedded video player or any other third-party resource that would receive your IP address when a page loads. Fonts are served from the same place as the pages.

Requests for a proposal, a briefing or contact are kept for as long as is needed to answer them and, where a conversation or an engagement follows, for the duration of that relationship. When the relationship ends, or when a request leads nowhere, the data is deleted or anonymised. Records that the operator is required by law to keep, such as invoices and contracts, are kept for the period that law prescribes and are governed by the engagement agreement rather than by this notice.

Job applications are deleted when the recruitment process they were made for has concluded, unless you agree to be kept on file for future roles. If you do agree, you can withdraw that agreement at any time and the application is then deleted.

Copies of submissions that were delivered through a configured channel are subject to the same periods. The operator removes them from each channel when the period ends.

The hosting provider and the delivery providers named above operate globally, and some of them may process data outside the European Economic Area and Switzerland. Where they do, the transfer rests on one of two grounds: an adequacy decision of the European Commission recognising that the destination protects personal data to an equivalent standard, or the standard contractual clauses adopted by the European Commission, entered into between the operator and the provider and supplemented where necessary by additional safeguards.

For visitors in Switzerland, the corresponding instruments recognised by the Federal Data Protection and Information Commissioner apply, and the standard contractual clauses are adapted for Swiss law where a transfer relies on them.

The location in which each provider processes data is stated in the current sub-processor list, provided on request and with every proposal. You may also ask for a copy of the safeguards that apply to a particular transfer.

Under the General Data Protection Regulation and, for residents of Switzerland, the revised Federal Act on Data Protection, you have the right to:

• Access the personal data the operator holds about you and receive a copy of it.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased where there is no longer a lawful reason to keep it.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Object to processing that rests on legitimate interest, which the operator must then stop unless it can show grounds that override yours.
• Receive the data you provided in a structured, commonly used and machine-readable format and have it transmitted to another controller where that is technically feasible.
• Withdraw consent at any time, with effect for the future.
• Lodge a complaint with a supervisory authority. For Italy this is the Garante per la protezione dei dati personali. Residents of Switzerland may contact the Federal Data Protection and Information Commissioner. You may also complain to the authority of the country in which you live or work.

Residents of Jordan have comparable rights under the Personal Data Protection Law, including access, correction, erasure and objection, and may address the authority established under that law. Residents of the United States have the rights granted by the privacy law of their state, where one applies, including the right to know what is collected, to delete it and not to be discriminated against for exercising those rights. The operator does not sell personal data and does not share it for cross-context behavioural advertising.

Write to the contact given at the end of this notice. State which right you are exercising and, so that the request can be matched to the data, the email address you used on the form. No form or template is required, and no fee is charged.

The operator replies within one month of receiving the request. Where a request is complex or several arrive together, that period can be extended by a further two months, and you are told within the first month if that is the case and why. If the operator cannot act on a request, for example because it cannot be satisfied that the request comes from the person whose data it concerns, it tells you the reason and reminds you of your right to complain to a supervisory authority.

Verification is kept in proportion. In most cases a reply from the email address on the original submission is enough. The operator will not ask for a copy of an identity document unless the data concerned is sensitive enough to justify it.

Forms use a hidden anti-abuse field and a request-rate limit. There is no minimum completion time. Rejected or undelivered requests do not receive a success receipt. A separate email copy is sent only where email delivery succeeds.

Access to the channels through which submissions arrive is limited to the people who need it to answer you. Each provider is bound by a data processing agreement that requires appropriate technical and organisational measures on its side.

If a breach of security affects your personal data and is likely to result in a high risk to you, the operator informs you without undue delay and notifies the competent supervisory authority within the period the law requires.

This website addresses organisations and the people who buy, build and run technology for them. It is not directed at children, and the operator does not knowingly collect personal data from anyone under the age at which consent for online services is valid in their country. If you believe a child has sent data through one of the forms, write to the contact given at the end of this notice and it will be deleted.

The effective date at the top of this page is the date the text was last changed. When the notice changes in a way that matters to you, for example because a new delivery channel or an analytics provider is enabled, the change is announced on this page for a period after it takes effect, so that a returning reader can see what is different. Because the text is kept in the same repository as the site, every change to it is recorded with its date.