Privacy

This is an English translation of the Italian notice; where the two differ, the Italian version prevails.

Who processes the data

The data controller is Cosimo Lippi, a self-employed professional trading as CSML Integrated Solutions: via Ambrogio Traversari 74, 50126 Florence, Italy, VAT number IT07469180488.

For any request about personal data: info@csmlsolutions.it, or +39 055 093 9460. No data protection officer has been appointed: none of the cases in which it is mandatory applies.

This notice covers every point at which CSML Integrated Solutions collects data: this site; the method page (metodo.csmlsolutions.it) and the pages on info.csmlsolutions.it; the telephone, WhatsApp, Telegram and email; the emails that CSML Integrated Solutions sends; online payment with Stripe.

Visitors to the site

The pages of csmlsolutions.it are static, and those who read them leave no data, apart from technical data. There are two forms: the sign-in to the reserved area, used only by the controller, and the one on the business card page (csmlsolutions.it/biglietto/, reached from the QR code printed on the card), where anyone who wishes leaves their details to be contacted again: the section below on contacting CSML Integrated Solutions covers them. The server that hosts the site records accesses, as every web server does: IP address, date and time, page requested, type of browser. This record is necessary for operation and security, and is based on thelegitimate interest in keeping the site running and secure (Art. 6(1)(f) of Regulation (EU) 2016/679). The fonts are hosted on this same site.

With the visitor’s consent, the site measures visits with Google Analytics, to understand which pages are read. Without consent the measurement does not start and the site works exactly the same. The measurement is based solely on consent (Art. 6(1)(a) of the Regulation and Art. 122 of Italian Legislative Decree 196/2003), which can be given and withdrawn at any time from the «Cookie preferences» link at the bottom of every page. The details are on thecookie page.

Those who contact CSML Integrated Solutions

Contact can be made in these ways: the telephone, WhatsApp and Telegram, email, direct messages on Instagram, the forms on the method page and on the pages at info.csmlsolutions.it, and the form on the business card page. The details left on the business card form go straight into the contact archive (HubSpot), marked as coming from the card.

Which data. Those the person provides: first and last name, company or profession, email, telephone number or Telegram account, the WhatsApp, Telegram or Instagram profile name, and the request, written or spoken, with the original voice message and, the transcript of the video call and, with consent, the recording of the call. If the person mentions them, also legal form, role, sector, city and address, the business’s website and social profiles, and the challenge they bring. The language in which the conversation took place is kept.

The automated assistant. On WhatsApp and Telegram the first reply comes from an automated assistant that uses artificial intelligence, and it says so in its first message. It gathers the data needed to reply and, before entering it in the contact records, shows a summary to confirm or correct. Until confirmation, the conversation sits only on the assistant’s server and in the private group in which Cosimo Lippi reads it. To extract the data from the text and transcribe voice messages, the assistant uses artificial intelligence models, which receive only the messages of that conversation. The assistant decides nothing about the person: every conversation reaches Cosimo Lippi, who reads it.

Email. For those who write to info@, amministrazione@, consulente@ or cosimo@csmlsolutions.it, the reply is prepared with the help of artificial intelligence. A model (DeepSeek, through OpenRouter) reads the sender’s name and address, the subject and the text of the email, recognises the type of request and writes a proposed reply. Cosimo Lippi reads the proposal, corrects it if needed and decides whether to send it: no reply goes out without him. The email, the proposal and the reply sent are kept in the assistant’s database (Supabase, in the European Union), and a notice with the sender’s name and the subject reaches the private group in which Cosimo Lippi reads requests. A model also reads all the mail arriving in the mailboxes Cosimo Lippi uses for work, including the text of the emails, to sort it by type and importance. The text is not kept: for each message, the sender, the subject, the category, the importance and a short reason are kept. The model does not read the text of certified email (PEC).

Instagram. Direct messages to CSML Integrated Solutions’ Instagram profile and comments by others on its posts are read with Meta’s tools and reach Cosimo Lippi in the private group, with the profile name of the writer, the text and the date; they are kept in the same database so that they can be answered. Today no artificial intelligence model reads them.

The telephone. The 055 number is answered by an automated assistant, made of recorded messages and keypad choices, which puts the call through to Cosimo Lippi. With those who are among the contacts, the assistant uses a sentence with the person’s name, or their business’s if the name is missing: in outgoing calls from the switchboard, to introduce itself; in incoming calls, only if the number is a mobile that belongs to a single contact. The sentence is created once, at the first call, by Google’s speech synthesis (Gemini), and is kept on the assistant’s server as long as the contact’s record exists: it is remade if the name changes and deleted with the record. A no to recording, or a request to Cosimo Lippi, also removes the sentence with the name. On the first telephone contact, incoming or outgoing, the assistant asks for consent to recording with a short question: press 1 for yes, 2 for no, 9 to hear the full text. No answer counts as no, and the call goes ahead in any case. The choice also applies to later calls, in both directions, and can be changed at any time by telling Cosimo Lippi or writing to info@csmlsolutions.it. If the same number belongs to more than one person, the question is asked at every call and the answer applies to that call only. Consent can also be given when booking the video call, with an optional box on the appointments page: whoever ticks it is no longer asked, and withdraws it as above. It can also be given, changed or withdrawn from the consent page, and whoever has already given it there is no longer asked.

Only with consent (Art. 6(1)(a) of the Regulation) is the call recorded and transcribed with Mistral AI’s Voxtral model: Mistral AI keeps the audio for at most 30 days and, like OpenRouter, does not use it to train artificial intelligence models. The transcript becomes a note in the contact’s record and reaches the private group where Cosimo Lippi reads requests. The audio stays with Zadarma, in the European Union, and is deleted after 30 days. Without consent, the recording the phone system makes on its own is deleted as soon as it is ready, without being listened to or transcribed. For the choice, the answer, key pressed, date and time, version of the text, number, direction and identifier of the call, and the link to the contact’s record when there is one, are kept, to be able to prove consent and respect a refusal. Voicemail messages are transcribed in the same way, because they serve to answer the request, and the audio is deleted within 30 days. Calls from Cosimo Lippi’s personal phone are not recorded.

The video call. The call to define the challenge together is booked from the appointments page on info.csmlsolutions.it and held on Google Meet, transcribed: Google Meet writes the transcript while we talk, and it serves to write the summary of what was said and the first steps. For this reason the page says so and asks to tick a box; anyone who does not want the transcript does not book the video call, and can write to info@csmlsolutions.it. The transcript is based on the legitimate interest in giving back a faithful summary (Art. 6(1)(f) of the Regulation), and one may object at any time; Google Meet shows everyone when it is on. Only the transcript is kept, in CSML Integrated Solutions’ Google Drive (Google Workspace), and it follows the contact’s record. The video call is not kept as a recording: if Google Meet also creates a recording, it goes to the trash as soon as the transcript is ready, and the trash deletes it on its own within 30 days.

Why it is lawful. Replying to a request, sending what the person asked for (for example the method PDF or the link to book a call) and preparing a possible engagement arepre-contractual steps taken at the request of the data subject (Art. 6(1)(b) of the Regulation). Keeping the contact in order to recognise it when the person writes again and to pick up the conversation is based on the legitimate interest in keeping a record of professional relationships (point (f)); it can be objected to at any time. Reading and keeping the comments on Instagram posts, in order to answer them and keep them in order, is based on the same legitimate interest.

If the data is not provided. Providing it is optional. Without a name and a way to reply, however, no reply is possible.

Choices about one’s contact details: the consent page

After a meeting, or after filling in a form, CSML Integrated Solutions sends a personal link by email to a page (csmlsolutions.it/consensi/). If the person has given a mobile number and said that WhatsApp may be used for this, the link can also arrive there, as a service message. The page shows a summary of the data the person has given, with the email and phone partly hidden, and lets them make three choices. None is compulsory: whoever does not choose, or says no, continues the relationship as before, and the method PDF does not depend on any choice. Cosimo Lippi never gives a consent on a person’s behalf.

1 · The privacy notice. The page shows it, and clicking «I have received the privacy notice» is only proof that it was delivered. It is not a consent and commits to nothing.

2 · News and proposals from CSML. These are two separate choices, one for email and one for WhatsApp. They are based on consent (art. 6(1)(a) of the Regulation): messages from CSML Integrated Solutions to keep the person up to date on what interests them (articles, guides, invitations to meetings, news on the topics discussed), at most a couple of times a month, never from other companies, and where it makes sense given what the person has said they may also present a service. The choice does not involve passing the data to others and does not authorise promotional phone calls. Whoever does not consent still receives replies to their requests and everything about work in progress, but no promotional message: the refusal also counts as an objection to the presentation emails described below, and the address goes on the exclusion list. A yes to emails counts only if given through the link received by email, because that confirms the address: a choice made without the confirmation code (for example right after a form, before opening the email) stays pending and is not used. For WhatsApp the yes must name WhatsApp: it is given on the page, or verbally to Cosimo Lippi, who records it with the date and the wording used. Consent is withdrawn from the page with one click, from the link at the bottom of every email, by writing STOP on WhatsApp, or to info@csmlsolutions.it.

3 · Recording phone calls. This is the same choice described in the section «The phone» (art. 6(1)(a)): the page lets the person give it, change it or withdraw it, and whoever gave it there is no longer asked on the phone. It applies to all calls, incoming and outgoing. If the yes comes from a link not yet confirmed, the phone assistant still asks the first time. Whoever withdraws consent has the transcripts of their calls deleted from the record.

The record of choices. Every choice (yes, no, withdrawal) is recorded in addition to the previous ones, without deleting them: which item, the choice, the date and time, the entry point it came from (meeting, form, method page, switchboard), the version and the full text the person had in front of them, the version of the privacy notice, the IP address, the browser and the identifier of the link. It serves to prove the consent (art. 7(1) of the Regulation) and to respect a no, and is based on the legitimate interest in being able to do so. The link allows a yes for 30 days from sending; a no or a withdrawal is always accepted. The page uses no cookies or measurement tools, and is addressed to adults.

Clients

For those who give an engagement, the data is used to carry it out (Art. 6(1)(b)) and to meet tax and accounting obligations (point (c)).

Payment is made online with Stripe, through the link that comes with the proposal. On the payment page the client enters company name, VAT number, billing address, email and, if available, the recipient code or certified email (PEC). Card data is handled only by Stripe: CSML Integrated Solutions receives the card network, the last four digits and the expiry date.

Once the payment is confirmed, the invoicing data is recorded in a spreadsheet reserved to the controller and in the contact and company records in HubSpot. Cosimo Lippi receives a Telegram alert with who paid and the invoicing data.

The electronic invoice goes through the Italian Revenue Agency’s Exchange System (Sistema di Interscambio), which delivers it to the recipient code or PEC given, and it is kept in compliant storage for ten years. The controller’s tax advisor also sees the invoicing data.

Those who receive an email they did not ask for

CSML Integrated Solutions writes to businesses and professionals in the sectors it works in, to present its services. It uses the data that the business makes public in order to be contacted: name, role, company, business contact details, sector and city, the business’s social profiles, taken from the business’s website, its Google Maps listing, its public Facebook and Instagram pages, the public lists it appears in, such as a trade fair’s exhibitor list or a shopping centre’s store directory, and the Apollo.io professional database. Google Maps listings and business websites are read by the Outscraper service, Facebook and Instagram pages by the Apify service, and websites that cannot be read directly by the Firecrawl service. For some people, chosen one by one by Cosimo Lippi, the data also comes from their public LinkedIn profile: name, role, company and profile address. The business email address of these people, which the profile usually does not show, is looked up by the LinkedHub extension through other services, which derive it from public sources or from the format of their company’s addresses; this data goes directly into the contact records (HubSpot). The list is kept in a database on servers in the European Union (Supabase); those who receive the emails are also kept in the contact records (HubSpot). The emails are sent from the CSML Integrated Solutions mailbox (Google Workspace).

To decide whom to write to and what to propose, an artificial intelligence model (DeepSeek, through OpenRouter) reads the data collected about the business and writes a description and an assessment of it: how close the business is to the services or initiatives of CSML Integrated Solutions and what it seems to need. From the privacy page of the business’s website it also takes the name of the owner, if it is given there. The assessment concerns the business; it is read by Cosimo Lippi, who decides whom to write to.

The processing is based on the legitimate interest in making its services known to those who work in those sectors (Art. 6(1)(f) of the Regulation). The first email says where the address comes from and links to this page. Every email says who is writing and contains a link to stop receiving them. The emails contain nothing that records whether they are opened; their links carry a personal code, which identifies who opens them and pre-fills the form with that person’s data. Anyone who asks to stop receiving emails, through the link, from the consent page or in any other way, receives no more: the address stays on an exclusion list, which exists precisely to respect that choice.

Who processes the data on the controller’s behalf

These providers process the data on behalf of the controller, only for the services they provide, under a contract that limits its use.

• Netsons S.r.l. (Italy): hosts the site and the consent page.
• Contabo GmbH (Germany): the server on which the automated assistant and the automations run.
• HubSpot Ireland Ltd (data stored in the European Union): the contact records, the forms and the pages on info.csmlsolutions.it.
• Supabase Pte. Ltd. (Singapore; data stored in the European Union): the database of the businesses to write to, and the assistant’s database with emails, replies and Instagram messages.
• Apify Technologies s.r.o. (Czech Republic): reads the public Facebook and Instagram pages of the businesses to write to.
• Google Cloud Italy S.r.l. (Italy): email, contacts, spreadsheets and video calls with their transcripts (Google Workspace and Google Meet), and the voice of the telephone assistant (Gemini), which receives the text of the sentence with the name, once per contact, keeps it for a limited time only to check for abuse, and does not use it to train artificial intelligence models.
• Google Ireland Ltd: only with consent, Google Analytics.
• Meta Platforms Ireland Ltd: WhatsApp, whose messages stay on its servers for at most 30 days, for delivery (also of the service messages with the link to the consent page and, with consent, of communications from CSML Integrated Solutions); and Instagram, to read direct messages and comments on CSML Integrated Solutions’ profile.
• IP Telecom Bulgaria Ltd (Bulgaria, part of the Zadarma group; data stored in the European Union): the 055 number, phone calls and the phone app’s contact list.
• OpenRouter, Inc. (United States), which gives access to the artificial intelligence models: DeepSeek, to read messages, sort mail and propose replies to emails, and to describe and assess the businesses to write to, and Mistral AI (France), to transcribe voice messages and recorded calls.
• Stripe Payments Europe, Limited (Ireland): online payment. For some purposes of its own Stripe processes the data as an independent controller, under its own privacy policy: preventing fraud, anti-money-laundering and other legal checks, improving its services.
• Openapi S.p.A. (Italy): transmission of electronic invoices to the Exchange System and their compliant storage, and the digital signature of contracts and engagement documents, with the controller’s qualified certificate issued by Namirial S.p.A. (Italy).
• iubenda S.r.l. (Italy): management of cookie consent.

In addition, Telegram (Telegram Messenger Inc., based outside the European Economic Area; representative in the Union: EDPO, Brussels) runs the Telegram bot and the private group in which every conversation, from any channel, reaches Cosimo Lippi with its content, and the payment alerts, with the invoicing data, and the documents the controller sends there to sign them. Telegram also processes the messages as an independent controller, under its own privacy policy.

In addition, Outscraper (United States; its terms also give a registered office in Dubai, United Arab Emirates) collects, at the controller’s request, the public data of Google Maps listings and business websites. Outscraper does not sign a processor contract with its customers: the service runs on its general terms, the same for everyone, and it states that it does not use the data it returns for its own purposes. The results remain in the controller’s Outscraper account for a short time and then expire on their own: in the check of 16-19 October 2026 they were still there after two hours and gone within three days. The controller downloads them into its own database as soon as they are ready.

In addition, Firecrawl (SideGuide Technologies, Inc., United States) reads, at the controller’s request, the websites of businesses that cannot be read directly. On the plan the controller uses, Firecrawl does not sign a processor contract: the service runs on its general terms.

In addition, LinkedHub (Petrov Digital, Tbilisi, Georgia), a browser extension connected to the contact records, reads, at the controller’s request, the LinkedIn profile of the person the controller is viewing and looks up their business email address. To do so it in turn queries other services: according to LinkedHub, Dropcontact, Hunter and Nymeria, and IPQualityScore to verify the addresses found. Petrov Digital’s terms do not provide for a processor contract and do not state how long it keeps the data; they state that it does not sell it.

Otherwise, the data is not sold, transferred or disclosed to anyone else.

Data outside the European Union

Some providers are based outside the European Union, or have access from outside it:

• OpenRouter, Inc. (United States) and Supabase Pte. Ltd. (Singapore): they are not certified under the Data Privacy Framework, and the transfer is based on the European Commission’s standard contractual clauses, included in their contracts. The model that reads the messages and emails and assesses the businesses runs at providers that do not retain the data, and those with servers in China are excluded. To transcribe voice messages and recorded calls, Mistral AI keeps the audio for at most 30 days and, like OpenRouter, does not use it to train artificial intelligence models.
• HubSpot, Google and Meta (WhatsApp included): their US companies are certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), and their contracts also provide, where needed, for the European Commission’s standard contractual clauses.
• Apify Technologies s.r.o. (Czech Republic): the processor contract is part of its terms; the data may also be processed in the United States by its sub-processors, and the contract requires a valid transfer mechanism for those transfers.
• Stripe: its US parent, Stripe, LLC, is certified under the EU-US Data Privacy Framework, and Stripe’s agreement includes the European Commission’s standard contractual clauses; the data may also be processed in the United States and India.
• Telegram: Telegram Messenger Inc. is based outside the European Economic Area, in a country its privacy policy does not name. European users’ chat data is kept in data centres in the Netherlands, but Telegram signs neither a processor contract nor standard contractual clauses with those who use its bots. Messages that pass through its service, including conversations that start on WhatsApp and are forwarded to the controller’s group, are processed on Telegram’s terms.
• Outscraper (United States): it is not certified under the Data Privacy Framework and does not offer standard contractual clauses, so for this transfer there is neither an adequacy decision nor one of the safeguards of Article 46 of the Regulation. Outscraper processes only the public data of the businesses the controller searches for; the service runs on Amazon Web Services servers and payments go through Stripe.
• Firecrawl (United States): its servers are in the United States; on the plan the controller uses it does not offer standard contractual clauses, and its privacy policy does not state a Data Privacy Framework certification, so for this transfer too there is neither an adequacy decision nor one of the safeguards of Article 46 of the Regulation. Firecrawl reads only the public websites of businesses.
• LinkedHub (Petrov Digital, Georgia): Georgia has no adequacy decision of the European Commission and Petrov Digital’s terms do not provide for standard contractual clauses, so for this transfer there is neither an adequacy decision nor one of the safeguards of Article 46 of the Regulation. The terms do not state where the servers are, nor where the services LinkedHub queries for addresses are located. LinkedHub processes only the profiles of the people the controller chooses one by one.

A copy of the safeguards can be requested at info@csmlsolutions.it.

How long

• Technical logs of the site: the current month and the previous one; aggregate statistics up to twelve months.
• Visit measurement (with consent): at most 14 months.
• Requests and conversations that do not become an engagement: 48 months from the last contact.
• The state of a conversation with the assistant: one row per person, replaced by the next conversation and deleted 48 months after the last contact; the execution history on the server, seven days.
• Discussions in the controller’s Telegram group: 48 months from the last contact.
• In the assistant’s database, emails received with the replies proposed and sent, the register of incoming mail, Instagram messages and comments: 48 months from the last contact.
• Emails in CSML Integrated Solutions’ mailboxes: 48 months from the last message of the conversation. Correspondence with clients, invoices and receipts (ten years) and certified email (PEC) are kept longer.
• Call recordings and voicemail messages: 30 days; transcripts follow the contact’s record. The choice about recording is kept as long as the contact exists, and a no as long as needed to respect it. The sentence with the name used by the telephone assistant: as long as the contact’s record exists.
• Video calls: the transcript and the summary are kept and follow the contact’s record; no recording is kept, and any recording Google Meet creates goes to the trash as soon as the transcript is ready and is deleted within 30 days.
• Clients: for the duration of the engagement; accounting documents, including invoices and payment records, for ten years (Art. 2220 of the Italian Civil Code). Payment alerts on Telegram: 24 months. Signed documents stay with Openapi for three months. Stripe also keeps payment data for its own obligations, for the periods set in its privacy policy.
• Businesses that CSML Integrated Solutions wrote to and that did not reply: 12 months from the last email.
• Businesses found that CSML Integrated Solutions never wrote to: personal data (the owner’s name, emails and telephone numbers bearing their name) is removed 48 months after it was last collected; the business data is kept for at most ten years. For a sole proprietorship, a business name containing the owner’s name follows the personal data.
• Record of consents (yes, no and withdrawals, with the text, the date, the version and the technical data of the choice): for as long as the contact exists and for five years after it is deleted, the time within which a consent can be challenged.
• Those who asked not to receive emails: the address stays on the exclusion list for as long as it is needed to respect the request.

Automated decisions

No decision concerning a person is taken solely by an automated system, and there is no profiling for advertising purposes. Artificial intelligence is used to read messages, to transcribe voice messages and recorded calls, to sort mail and propose replies to emails, and to describe and assess the businesses to write to, and what comes out of it is read by a person: Cosimo Lippi approves every reply to an email, one by one; it also gives the telephone assistant its voice. The businesses to write to are searched for by sector and area, and Cosimo Lippi decides whom to write to.

Rights

Every person whose data is processed can ask at any time to access it, to correct or erase it, to restrict its processing, and to receive it in a machine-readable format to take it elsewhere. They can object to processing based on legitimate interest; they can always object to receiving presentation emails, without giving reasons. Where processing is based on consent, it can be withdrawn at any time, without affecting what was done before. It is withdrawn from the consent page, from the link at the bottom of every email, by writing STOP on WhatsApp, to info@csmlsolutions.it or to Cosimo Lippi, as easily as it was given.

Requests go to info@csmlsolutions.it. The reply arrives within one month; if the case is complex, within that month the person is told how long the extension will be, at most two further months.

Anyone who believes that the processing infringes the Regulation can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (piazza Venezia 11, 00187 Rome, garante@gpdp.it,www.gpdp.it), or go to the ordinary courts.

Cookies

How the site uses cookies, and how to change one’s mind about consent, is explained on thecookie page.

Last updated: 2 November 2026.