Legal notices
Privacy policy
This notice explains how TIA Costruzioni processes the personal data of people who visit the website or contact the company, under Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR) and Italian data protection law.
Last updated: .
1. Controller and contact details
The controller is TIA COSTRUZIONI S.R.L.S., based at Via dei Braschi 7, 20161 Milano (MI), Italy, Italian VAT number 14810510967, REA registration number MI-2808425, share capital EUR 1,000.00.
- For privacy information and to exercise your rights: privacy.office@tiacostruzioni.it.
- For quotations and site visits: lavori@tiacostruzioni.it.
- For certified email communications (PEC): tiacostruzionisrls@pec.it.
- Telephone: +39 348 679 6516.
The privacy mailbox is separate from the business email and PEC addresses. Quotation enquiries are directed to the ordinary mailbox, not the PEC address.
2. Data collected and contact channels
Browsing and language
When you visit the website, technical data needed for the connection is processed, such as IP address, date and time, requested pages and browser information. Hosting and security services may record access and error data.
The website remembers Italian or English through the technical tia-language preference, saved in your browser including when the default language is applied. You can change it using the selector or by clearing site data. This preference contains no enquiry data.
Contact form
The form requests your name, email address or telephone number, the municipality of the project, type of work, description and acknowledgement of the privacy notice. It does not accept attachments. Please provide only information relevant to the enquiry and avoid health data, identity documents, credentials and unnecessary information about other people.
The “Send via email” button prepares a mailto: link on your device to lavori@tiacostruzioni.it, with a subject and message based on the completed fields, and opens your email application, if configured. The website does not send the email automatically, and the form does not submit the fields to the website server. You can review and edit the message in your application and decide whether to send it yourself.
If the application does not open or the message is too long for the link, the form provides the recipient, subject and complete text for you to copy into your email app or webmail. The copy buttons write to your device's clipboard only at your request; if automatic copying is unavailable, you can copy the text manually. The handling and any storage or synchronisation of clipboard contents and email drafts depend on your device, application and chosen services, rather than the TIA website.
The form keeps the fields on the page and does not save them in persistent browser storage. After an error, they remain available so that you can use an alternative channel. Autofill and page restoration also depend on your browser settings.
Email, telephone and WhatsApp
When you send an email, the message and the data needed for delivery are processed by the sender's and recipient's email services. TIA processes the correspondence received and contact details to respond to your enquiry, in accordance with the purposes and retention criteria in sections 3 and 7. The privacy notices of your chosen email service also apply to its processing. If you call us, we process the information you choose to provide in order to respond; the telephone link starts the call function and does not transmit form fields.
WhatsApp is an optional channel. The service is not loaded automatically when pages open. The form's WhatsApp button prepares a link containing the completed fields in the enquiry text: opening the link may communicate that text to the service before you finally confirm sending the message. TIA receives the message when you actually send it. You can always choose email or telephone.
In conversations, TIA processes the telephone number, profile information made visible, message text, date and time, and any attachments you choose to send. The website opens an external Click-to-Chat link without loading a messaging platform or WhatsApp API within the website.
TIA's WhatsApp contact uses a standard WhatsApp account. WhatsApp's processing is described in its notice for the European Region.
3. Why we process data and the legal bases
| Purpose | Legal basis |
|---|---|
| Responding to your quotation, site visit or information enquiry concerning a potential engagement | Steps taken at the data subject's request before entering into a contract, Article 6(1)(b) GDPR |
| Handling general correspondence and communications from business representatives | Legitimate interest in managing business communications, Article 6(1)(f) GDPR |
| Operating the website, remembering the language, preventing abuse and protecting the service | Legitimate interest in website usability and security, Article 6(1)(f) GDPR. Strictly technical language storage is covered by the consent exemption under Article 122 of the Italian Privacy Code |
| Displaying Google Maps after your choice | Consent to display the content, Article 6(1)(a) GDPR, and consent to any non-technical technologies where required by Article 122 of the Italian Privacy Code |
| Managing any contract and related obligations | Performance of the contract, Article 6(1)(b) GDPR, and compliance with legal obligations, Article 6(1)(c) GDPR |
| Responding to rights requests and protecting specific company legal rights | Legal obligations, Article 6(1)(c) GDPR, and legitimate interest in establishing, exercising or defending legal claims, Article 6(1)(f) GDPR, according to the relevant purpose |
Processing based on legitimate interests must remain necessary and proportionate to people's rights. The Privacy Policy acknowledgement checkbox is not marketing consent. You do not have to accept advertising or analytics to contact us.
4. Google Maps and website resources
Fonts and icons are served by the website, without connecting to Google Fonts or UNPKG to load them.
The Google map is optional. Before your choice, an information panel is displayed and the map is not loaded. If you select “Load Google map”, your browser connects to Google, which receives technical connection data and may use cookies or other identifiers according to the service and browser or account settings. Additional resources needed for the map also load after this choice. Data received by Google may include IP address, browser and device information, and map interactions, depending on the features used.
The authorisation concerns only that map and does not activate TIA analytics or marketing. It is not saved between visits. “Revoke map” removes the map and restores blocking; reloading, leaving or returning to the page also requires a new choice. Withdrawal does not retrieve data already transmitted, necessarily cancel requests already started, or delete Google cookies.
You can also use “Open map” to visit Google Maps directly. The service's processing is described in the Google Privacy Policy and information about its cookies.
5. Authorised people and providers
Access to personal data is restricted to the company owner and personnel expressly authorised to process it, acting under the owner's authority and in accordance with the instructions received.
TIA uses Aruba S.p.A. for Basic Linux Hosting and ordinary email. The service terms provide for the role of processor under Article 28 GDPR for data processed on TIA's behalf. Aruba is a separate controller for contract management and its own obligations. The terms applicable to the purchased service govern this relationship.
Where necessary for an engagement or an obligation, relevant data may be disclosed to parties assisting TIA and authorities entitled to receive it by law. Enquiries are not intended for publication.
For EEA users, Google Ireland Limited is the controller identified by Google for user data relating to its services, subject to the specifics described in its notice. WhatsApp Ireland Limited independently processes account and platform usage data of users in the European Region. TIA remains the controller for handling enquiries and conversations received. These roles do not amount to a general appointment of Google or WhatsApp as TIA's processors.
6. International transfers
According to Aruba's information on service locations, hosting and email are managed in its Italian data centres. This is not a general guarantee about the location of every processing operation carried out through external services.
When you choose Google Maps, data may also be processed in the United States, by Google LLC, and other countries where Google and its providers operate. In its transfer information, Google states that it relies on adequacy decisions and, for covered US transfers, the EU-US Data Privacy Framework, addressed by Decision (EU) 2023/1795. It also describes using standard contractual clauses (SCCs) where required for transfers not covered by adequacy.
WhatsApp also involves infrastructure in the United States, including WhatsApp LLC and Meta Platforms, Inc. The WhatsApp DPF disclosure and European notice describe reliance on the DPF for services and transfers covered by the respective certifications; the notice also describes SCCs for other relevant flows, including transfers to Singapore. These mechanisms have specific scopes and conditions and do not apply indiscriminately to every processing operation.
Google's official transfer pages and WhatsApp's European notice explain how to request copies of SCCs and contact the providers. You may also write to privacy.office@tiacostruzioni.it for information relevant to TIA's processing. Consent to load the map does not replace the safeguards required for international transfers. Local fonts and icons do not involve requests to their previous external distributors.
7. How long we keep data
| Data | Retention period or criterion |
|---|---|
| Quotation enquiries that do not result in an engagement | 12 months from the last communication, unless specific documented needs or legal obligations require otherwise |
| Email, WhatsApp messages and telephone notes relating to an unsuccessful quotation enquiry | Follow the same enquiry file and the same period of 12 months from the last communication |
| Contracts and technical or evidential documents relating to commissioned work | To manage the engagement and subsequently only to the extent needed for obligations or specific legal protection. For rights subject to the ordinary limitation period, the reference is 10 years from when the right can be exercised, under Articles 2935 and 2946 of the Italian Civil Code, taking account of special periods and any suspension or interruption |
| Accounting records | 10 years from the date of the last entry, under Article 2220 of the Italian Civil Code |
| Invoices and relevant business correspondence, including email | The ten-year retention required by Article 2220, with reference to the relevant documents and accounting records. No single starting date based on contract signature, the last email or completion of work applies to all archives |
| Documents relevant for tax purposes | For the applicable obligations and until assessments for the corresponding tax period are finalised, including beyond ten years where required by Article 22 of Presidential Decree 600/1973 |
| Mailbox access history in Aruba Webmail | The last 6 months can be consulted; this is an information access window, not a confirmed period for internal retention of all logs |
| Hosting backups of web space | One daily and one weekly copy, updated by overwriting according to the respective cycle. These cycles concern web content copies, not mailboxes or all provider logs |
| Fields and draft in the Contact form | Remain in page memory; the form does not create an enquiry archive or persistent submission counters. Any server logs are separate |
tia-language preference | No programmed expiry; until changed or site data is cleared, subject to browser intervention |
| Maps loading choice | Only for the open page, until withdrawal, reload or departure; no persistent preference is saved by the website |
For work warranties, Article 1667 of the Italian Civil Code generally requires notice of defects within 60 days of discovery and sets a two-year limitation period for the action from delivery, subject to statutory exceptions. Article 1669 concerns serious defects, collapse or danger of collapse arising within ten years of completion: notice must be given within one year of discovery and the right is time-barred one year after notification. Only documents relevant to the specific legal protection are retained for its applicable period; ten years is not automatically applied to all emails or documents.
Web space backups are separate from messages held in mailboxes and any exported copies. Messages follow the periods for their enquiry file or document category. Public documentation does not establish the existence, duration or cycles of any internal Aruba backups of ordinary mailboxes; the daily or weekly web backup cycle is therefore not assigned to them.
For internal HTTP, error, security and ordinary SMTP transport logs, no confirmed internal retention period or rotation cycle is available. Documented purposes are technical service delivery, fault diagnosis and security. Retention must be proportionate to those needs, specific incidents still being handled or applicable obligations and orders; these criteria do not establish the periods actually applied by Aruba. The six-month access history proves neither internal erasure after six months nor a specific longer period.
Aruba's contractual 30-day period after expiry without renewal concerns erasure of customer content, subject to applicable special terms: it is not a universal retention period for logs or backups.
Removal from the active archive does not imply immediate deletion of every backup copy. Any further retention, including for a specific dispute, must be justified, limited to relevant data and reviewed when the need ends; it does not justify keeping entire mailboxes indiscriminately.
8. Which data is required
Required fields are needed to understand the project and contact you; the form does not proceed without them. You can use the direct contact details. You are not required to use WhatsApp or load Maps, and refusal does not prevent use of the other channels. Necessary technical connection data is processed when you visit the website.
9. Your rights
In the cases and within the limits provided by the GDPR, you may request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent without affecting the lawfulness of earlier processing; the map has a “Revoke map” control.
To exercise your rights, write to privacy.office@tiacostruzioni.it. You may be asked for proportionate information to verify your identity and locate the data. We respond without undue delay and normally within one month of receipt. Where permitted, this may be extended by a further two months, notifying you of the reasons within the first month. Requests are normally free of charge, subject to GDPR exceptions.
You may lodge a complaint with the Italian Data Protection Authority (Garante) or the competent supervisory authority and seek a judicial remedy.
10. Automated decisions and updates
The website does not use automated decision-making producing legal or similarly significant effects. Form checks may reject invalid attempts without assessing the project's commercial merits.
Google Analytics for website usage statistics and Google Ads tools for advertising campaigns and measuring their results are planned for a later stage. Before activation, the notices will be updated to reflect the actual services and settings, and controls for consent to and withdrawal from optional tracking will be put in place. Until then, the technologies used are those described as current in the Cookie Policy. The website does not automatically subscribe you to newsletters.
See also the Cookie Policy and the Italian version of this notice.