Controller and contact
The data controller is Stefano Rosa Rosso, operating under the SRR brand (SRR di Stefano Rosa Rosso), Via Parini 9, 20121 Milan, Italy. You can contact advisory@stefanorosarosso.com.
Information and purposes
Forms collect your name, business email, role and organisation; enquiry context is optional. These details are used to respond, assess your requested engagement or deliver a resource. Do not submit sensitive data, information about third parties or confidential documents.
Service enquiries are handled to take pre-contractual steps at your request. General correspondence and service security serve the legitimate interest of operating and protecting the practice. Submitting a form does not subscribe you to a newsletter or activate a paid subscription.
Systems used
The website is hosted through Sites and Cloudflare infrastructure. Contact forms use Resend for email and HubSpot for contact management; some resources use embedded HubSpot forms. Providers may process data in countries other than yours. Their notices describe processing locations and transfer safeguards.
Retention and rights
Enquiries that do not become professional engagements are retained for 24 months after the last contact, then deleted or anonymised. If an engagement follows, data needed for the professional relationship is retained according to the contract and applicable legal obligations. Data needed to establish, exercise or defend a legal claim is retained only for that purpose and for as long as necessary. For information or erasure requests, use the contact above. You can request access, correction, restriction, objection and, where applicable, portability and erasure. You may also complain to the Italian data protection authority or your competent supervisory authority.
Cookies and self-assessment
Cookie preferences let you accept or refuse traffic analytics. Reopen them using the Cookie preferences button. The S.T.E.P. questionnaire calculates scores in your browser and does not submit individual answers. With analytics consent, completion and score may be recorded as events. Results are indicative and do not make automated service-access decisions.