In force since 7 September 2026
Data protection notice
How idealsito handles the personal data of site visitors, of people who contact us, of our clients, and of the businesses we approach.
Two frameworks at once
Both the Swiss Federal Act on Data Protection (FADP), because the controller is established in Switzerland, and EU Regulation 2016/679 (GDPR), which applies in addition under its Article 3(2) because services are also offered to people located in the European Union. Where the two differ, the more protective one applies.
1. Who processes your data
| Controller | Carvalho Da Silva, IdealSito |
|---|---|
| Legal form | Sole proprietorship |
| Sole trader | Christian Carvalho Da Silva |
| Registered seat | Via Navegna 2D, 6648 Minusio, Ticino, Switzerland |
| VAT | Not registered for VAT |
| info@idealsito.com | |
| Website | https://idealsito.com |
No data protection officer has been appointed: the conditions making it mandatory do not apply. For any question, write to the address above.
2.1 Visiting this site
This site uses no cookies, installs no analytics, loads no third-party scripts or fonts, and contains no data collection forms. There is nothing to consent to: visitors are not profiled.
The server does keep a technical access log, as any web server does.
| Data | IP address, date and time, page requested, response code, browser type |
|---|---|
| Purpose | Service security, fault diagnosis, defence against abuse |
| Legal basis | Legitimate interest (GDPR art. 6(1)(f)) — overriding interest (FADP art. 31) |
| Retention | 14 days, then automatic deletion |
The log format excludes everything after the question mark in the address.
2.2 If you write to us
| Data | Name, email address or phone number, message content, and whatever you add to it |
|---|---|
| Purpose | Replying, assessing feasibility, preparing a quote |
| Legal basis | Pre-contractual measures at the data subject's request (GDPR art. 6(1)(b)) |
| Retention | 24 months from the last exchange, if no contract follows |
If you use WhatsApp, the conversation passes through WhatsApp Ireland Limited under its own terms, over which we have no control. Email is available to anyone who prefers to avoid that.
2.3 Clients and suppliers
| Data | Company name, first and last name, address, VAT number, tax code, UID, email, phone, website, contact person details, contract content, documents issued and payments |
|---|---|
| Purpose | Performing the contract, invoicing, accounting, tax obligations |
| Legal basis | Performance of a contract (GDPR art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Retention | Ten years from the end of the financial year, as required by art. 958f of the Swiss Code of Obligations |
Those ten years are a legal retention duty, not a commercial choice: an erasure request cannot be granted for documents that fall under it.
2.4 Businesses we approach commercially
If you received an email from us without asking for it, this section concerns you. We keep a list of businesses potentially interested in our services. This data was not collected from the data subjects but from publicly accessible sources: company websites, professional directories, public registers.
| Data | Company name, generic company email address, phone, website, sector, outcome of contacts made |
|---|---|
| Source | Publicly accessible sources — company websites, professional directories, public registers |
| Purpose | Offering our website design services |
| Legal basis | Legitimate interest in business-to-business direct marketing (GDPR art. 6(1)(f), recital 47) — no infringement of personality for data made accessible to anyone (FADP art. 30(3)) and overriding private interest (FADP art. 31(1)) |
| Retention | 24 months from the last contact, or immediately upon objection |
The right to object here is absolute. Anyone who does not want to be contacted says so — by replying to the message received or writing to our address — and is removed, without having to give a reason and without anyone assessing the request. The address is recorded in a suppression list that survives deletion of the contact: it is the only way to guarantee they are not approached again.
This notice constitutes the information owed under GDPR art. 14 and FADP art. 19(1), (3) and (5) for data not collected from the data subject. The Swiss deadline runs from receipt of the data, not from the first message.
3. Who receives the data
Data is never sold, transferred or disclosed for third-party marketing. It is processed on our behalf, under a written agreement, by the following technical providers.
| Oracle Corporation | Servers, database and document archive — eu-milan-1 region (Milan, European Union) |
|---|---|
| Clerk, Inc. | Authentication for our internal management system — United States |
| Resend, Inc. | Outgoing email delivery — United States |
| ImprovMX SAS | Forwarding of incoming email — European Union |
| Google LLC | Mailbox where email is read — United States / European Union |
| Aruba S.p.A. | Domain registration and DNS — Italy |
| GitHub, Inc. | Source code custody — United States |
Beyond these, data may be disclosed to our accountant and to authorities where the law requires it.
4. Where the data is held
Most of the data never leaves the European Union: servers, database and document archive are in Oracle's Milan data centre. For people located in the Union there is therefore no transfer to a third country; for the controller, established in Switzerland, this is a disclosure to a state the Federal Council recognises as providing adequate protection.
The United States providers — authentication, email delivery, mailbox, code custody — fall outside that. For these, transfers rely on the Standard Contractual Clauses approved by the European Commission and recognised by the Federal Commissioner and, for providers that adhere to it, on the EU-US Data Privacy Framework and its Swiss extension. A copy of the safeguards can be requested by writing to us.
5. Your rights
Anyone may, at any time and free of charge:
- find out whether we process data about them and obtain a copy (FADP art. 25 — GDPR art. 15);
- have inaccurate data corrected (FADP art. 32 — GDPR art. 16);
- request erasure, within the retention duties described in 2.3 (GDPR art. 17);
- request restriction of processing (GDPR art. 18);
- receive the data in machine-readable form and have it transmitted to others, for data they provided to us and that we process with their consent or to perform a contract with them (FADP art. 28 — GDPR art. 20). The right does not extend to the prospecting list in 2.4, which was not provided by the data subject and is not processed on either of those bases;
- object to processing, and in particular to commercial prospecting, where the objection needs no reason and is binding (GDPR art. 21).
Requests go to our email address. We answer within thirty days. To avoid handing data to the wrong person we may ask for elements confirming the identity of the requester; we never ask for a copy of an identity document over unprotected email.
Anyone who believes the processing breaches the law may contact the Federal Data Protection and Information Commissioner (Feldeggweg 1, 3003 Bern) under Swiss law, or the Italian Garante (Piazza Venezia 11, 00187 Rome) or the authority of their own country of residence under European law.
6. Security
Measures in place include: TLS encryption on all domains; access to the management system restricted to authenticated users with two-step verification; role separation; an immutable log of accounting operations; AES-256 encrypted backups kept off the server; request rate limiting and service ports closed to the outside.
No measure removes risk entirely. In the event of a breach likely to result in a high risk to data subjects, they are informed and the competent authority is notified within the legal deadlines.
7. Automated decisions and minors
No decisions are taken based solely on automated processing, and no profiling within the meaning of GDPR art. 22 takes place. Our services address businesses and professionals: we do not knowingly collect data about people under sixteen.
8. Changes
This notice may be updated. The version in force, with its date, is always the one published on this page. Previous versions are retained.