Privacy notice

The operator of this website is Altuon, a sole proprietorship registered in Italy. Its legal name, registered office, VAT number and contact details are set out in the operator block at the start of this notice.

For every item of personal data collected through this website, the operator is the controller within the meaning of the General Data Protection Regulation. That means the operator decides what is collected and why, and is the party you address when you want to exercise a right over your data.

Where the operator has appointed a data protection contact, that contact is given at the end of this notice; the general contact details are in the operator block at the start. Either address reaches the person responsible.

This notice applies to altuon.com in all six of its languages and to the requests you send through it. It does not apply to the processing Altuon carries out for a client under an engagement agreement; that processing is governed by the agreement and its data processing terms, and Altuon acts there as a processor on the client's instructions.

It also does not cover other websites you reach by following a link from this one, including the operator's profiles on professional and social networks. Those services have their own notices.

The website is available in English, German, French, Arabic, Turkish and Italian. The language you read is decided by the address you visit. It is never inferred from your browser settings, your IP address or your location, and no record is kept of which language you chose.

Reading this website requires no account and asks for no personal data beyond the technical data every web server receives, described under hosting and server logs below. Personal data is collected only when you fill in one of the four forms, and each form asks only for what is needed to answer the request it serves.

Proposal request. Your organisation and its size, your name, work email address, telephone number with country code and role; the region and industry the work concerns; the practices you need, your preferred engagement model, a budget band and its currency, a timeline and whether a non-disclosure agreement is required before detailed conversation; a written brief; and up to three attachments in PDF, PNG or JPEG format, 3.5 MB in total. This is used to scope and price a proposal, or to ask the questions that must be answered first.

Executive briefing request. Your name, work email address, organisation and role; the topics the briefing should cover, who will attend, whether it is held by video call or in person, and your preferred dates or times. This is used to prepare the briefing against your agenda and to agree a time.

Job application. Your name and email address, your CV as a PDF, links you choose to share such as a portfolio or professional profile, a letter explaining why this role and why now, where you would work from and your earliest start date. This is used to assess your application for the role you applied to and to reply to you.

Contact form. Your name, email address, a subject and your message. This is used to route the message to the team for your region and to reply.

Every form carries a consent checkbox that must be ticked before the request is sent. Every form also includes a hidden field that a person never sees and a check on how quickly the form was completed; both exist to reject automated submissions. Neither adds data about you to the request. A copy of what you sent is emailed to the address you gave, so that you hold the same record the operator holds.

Requests for a proposal, a briefing or contact are processed on two bases: the consent you give by ticking the box on the form, and the operator's legitimate interest in answering a request that you have addressed to it. The legitimate interest is narrow. It covers reading the request, replying to it and keeping the correspondence that follows; it does not extend to marketing, profiling or passing your details to anyone who did not need them to answer you.

Job applications are processed because they are steps you take, at your request, before entering into a contract with the operator. Your consent is asked for in addition, and is the only basis on which an application is kept once the process it was made for has ended.

The technical data in server logs is processed on the basis of the hosting provider's and the operator's legitimate interest in delivering the site reliably and defending it against abuse.

You can withdraw consent at any time by writing to the contact given at the end of this notice. Withdrawal takes effect for the future and does not affect what was lawfully done before it; it will usually mean that the request you made cannot be taken further.

The website itself stores nothing you send. When you send a form, the submission and any attachments are delivered to the operator through one or more delivery channels, and each channel is switched off until the operator has configured it. The channels that can be configured are:

• A message to a workspace on Slack, sent through a webhook the operator controls.
• A generic webhook, which is a delivery to a system that the operator runs.
• An email service, Resend, which delivers the submission to the operator's inbox and the copy to yours.
• A customer relationship management system, HubSpot, in which requests from organisations are recorded so that a conversation can be followed over time.

Attachments travel inside the submission to whichever channels are active. They are not written to storage on the website, and the website holds no copy of them once the delivery has completed.

Which channels are active at any time, together with the providers behind them and where each of them processes data, is set out in the current sub-processor list, provided on request and with every proposal. Each provider processes your data on the operator's instructions under a data processing agreement, and none of them is permitted to use it for its own purposes.

If no channel is configured when you send a form, nothing is transmitted. The form tells you so, keeps your entries on the page and gives you the contact address for your region instead. A submission never disappears silently.

altuon.com is a static website. Every page is built in advance and served from the global edge network of the hosting provider, Vercel. No page is generated for you at the moment you request it, and no page reads your location, your language settings or a cookie on the server to decide what to show.

Like every web server, the edge network records each request it serves: the IP address it came from, the browser and operating system announced in the user agent string, the address requested and the time. The hosting provider processes these logs to deliver the site, to balance load, to detect and block abuse and to diagnose faults. The logs are kept for a short period set by the provider and are then discarded. The operator does not export them, does not join them with form submissions and does not use them to identify visitors.

The site does not use a font service, an embedded video player or any other third-party resource that would receive your IP address when a page loads. Fonts are served from the same place as the pages.

Requests for a proposal, a briefing or contact are kept for as long as is needed to answer them and, where a conversation or an engagement follows, for the duration of that relationship. When the relationship ends, or when a request leads nowhere, the data is deleted or anonymised. Records that the operator is required by law to keep, such as invoices and contracts, are kept for the period that law prescribes and are governed by the engagement agreement rather than by this notice.

Job applications are deleted when the recruitment process they were made for has concluded, unless you agree to be kept on file for future roles. If you do agree, you can withdraw that agreement at any time and the application is then deleted.

Copies of submissions that were delivered through a configured channel are subject to the same periods. The operator removes them from each channel when the period ends.

The hosting provider and the delivery providers named above operate globally, and some of them may process data outside the European Economic Area and Switzerland. Where they do, the transfer rests on one of two grounds: an adequacy decision of the European Commission recognising that the destination protects personal data to an equivalent standard, or the standard contractual clauses adopted by the European Commission, entered into between the operator and the provider and supplemented where necessary by additional safeguards.

For visitors in Switzerland, the corresponding instruments recognised by the Federal Data Protection and Information Commissioner apply, and the standard contractual clauses are adapted for Swiss law where a transfer relies on them.

The location in which each provider processes data is stated in the current sub-processor list, provided on request and with every proposal. You may also ask for a copy of the safeguards that apply to a particular transfer.

Under the General Data Protection Regulation and, for residents of Switzerland, the revised Federal Act on Data Protection, you have the right to:

• Access the personal data the operator holds about you and receive a copy of it.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased where there is no longer a lawful reason to keep it.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Object to processing that rests on legitimate interest, which the operator must then stop unless it can show grounds that override yours.
• Receive the data you provided in a structured, commonly used and machine-readable format and have it transmitted to another controller where that is technically feasible.
• Withdraw consent at any time, with effect for the future.
• Lodge a complaint with a supervisory authority. For Italy this is the Garante per la protezione dei dati personali. Residents of Switzerland may contact the Federal Data Protection and Information Commissioner. You may also complain to the authority of the country in which you live or work.

Residents of Jordan have comparable rights under the Personal Data Protection Law, including access, correction, erasure and objection, and may address the authority established under that law. Residents of the United States have the rights granted by the privacy law of their state, where one applies, including the right to know what is collected, to delete it and not to be discriminated against for exercising those rights. The operator does not sell personal data and does not share it for cross-context behavioural advertising.

Write to the contact given at the end of this notice. State which right you are exercising and, so that the request can be matched to the data, the email address you used on the form. No form or template is required, and no fee is charged.

The operator replies within one month of receiving the request. Where a request is complex or several arrive together, that period can be extended by a further two months, and you are told within the first month if that is the case and why. If the operator cannot act on a request, for example because it cannot be satisfied that the request comes from the person whose data it concerns, it tells you the reason and reminds you of your right to complain to a supervisory authority.

Verification is kept in proportion. In most cases a reply from the email address on the original submission is enough. The operator will not ask for a copy of an identity document unless the data concerned is sensitive enough to justify it.

Every connection to altuon.com is encrypted in transit. Forms are protected against automated submission by the hidden field and the timing check described above, and by a limit on how many submissions a single connection may make in a short period. Submissions are transmitted to the configured delivery channels over encrypted connections and are never written to the website's own storage.

Access to the channels through which submissions arrive is limited to the people who need it to answer you. Each provider is bound by a data processing agreement that requires appropriate technical and organisational measures on its side.

If a breach of security affects your personal data and is likely to result in a high risk to you, the operator informs you without undue delay and notifies the competent supervisory authority within the period the law requires.

This website addresses organisations and the people who buy, build and run technology for them. It is not directed at children, and the operator does not knowingly collect personal data from anyone under the age at which consent for online services is valid in their country. If you believe a child has sent data through one of the forms, write to the contact given at the end of this notice and it will be deleted.

The effective date at the top of this page is the date the text was last changed. When the notice changes in a way that matters to you, for example because a new delivery channel or an analytics provider is enabled, the change is announced on this page for a period after it takes effect, so that a returning reader can see what is different. Because the text is kept in the same repository as the site, every change to it is recorded with its date.