Privacy Policy

1. Data controller

PauSolutions, Manzano (UD) 33044, Italy. Email: info@pausolutions.com. In this notice, "we" and "us" mean this controller.

No Data Protection Officer has been appointed, as it is not required for this activity.

2. What data is processed

• Contact and request forms: name, business, email, optional phone/website/budget, your message, whether you buy as a business or a consumer, optional tax ID, and the consent choices you made (with the text version and time).
• Free tools: the calculators and the scorecard run in your browser. Nothing is sent unless you ask for the emailed report (then your answers, the result, your email and any optional details are sent) or sign up for the newsletter (then only your email address and language are sent).
• Newsletter (optional practical automation tips and occasional offers about our services, about 1 email a week): your email address, the language of the page, where you signed up (e.g. a guide or a free tool), the version of the consent text, the time of signup and of your confirmation click, which welcome emails have been sent and whether you have unsubscribed.
• Purchases: Stripe processes the payment and sends us your name, email, billing address, optional tax ID, the package bought and the payment status. We never see or store your card details.
• Project work: the information and access you share to build or maintain an automation.
• Technical data: IP address and request data processed by the hosting provider to deliver and protect the site. When you send a form, Cloudflare Turnstile also processes technical signals (IP address, browser and device characteristics) to check that you are a person and not a bot; it sets no advertising or tracking cookies.
• Website statistics: on pausolutions.com we use Cloudflare Web Analytics, which is cookie-free, doesn't use local storage or fingerprinting, and gives us only aggregate statistics (e.g. page views, referring sites, country, browser and device type). We can't identify individual visitors from it.

3. Purposes and legal bases

• Replying to enquiries and sending the report or quote you asked for — pre-contractual steps taken at your request (art. 6(1)(b) GDPR).
• Performing a purchase or project, invoicing and support — performance of a contract (art. 6(1)(b)).
• Accounting, tax and legal obligations, e.g. keeping invoices — legal obligation (art. 6(1)(c)).
• Newsletter (direct marketing): sending practical automation tips and occasional offers about our own services and packages, about 1 email a week — only if you tick the separate, optional, unticked box and then confirm by clicking the link we email you (double opt-in): consent (art. 6(1)(a) GDPR; art. 130 Italian Privacy Code). Every email has a one-click unsubscribe link; you can also reply "unsubscribe" or email us. Withdrawal doesn't affect earlier processing. We don't turn on open or click tracking for these emails.
• Site security, abuse and spam prevention (e.g. the hidden form field, timing check, per-connection rate limit and the Cloudflare Turnstile bot check on forms), aggregate website statistics and defending legal claims — legitimate interest (art. 6(1)(f)).

Data marked as required in a form is needed to reply to you; without it we can't handle the request. Everything else is optional.

4. AI-assisted reports

Emailed tool reports and some draft replies are prepared with the help of AI tools and then reviewed by a person before they are sent. Only the answers you submitted are used, without your email address where possible. No decision with legal or similarly significant effects is taken by automated means (art. 22 GDPR).

5. How long data is kept

• Enquiries, report requests and quotes that don't lead to an order: up to 24 months from the last contact, then deleted.
• Orders, invoices and accounting records: 10 years, as required by Italian law (art. 2220 Civil Code).
• Project materials and access: for the project and any care plan. At handover (or at the end of the care plan) our access is removed and any copies we hold are deleted or returned, at the latest within 60 days, unless you ask otherwise in writing.
• Newsletter: while you are subscribed, and at most 24 months without any interaction. Signups that are never confirmed are not added to the list (the confirmation link expires after 7 days; the sending log stays with Resend only for its short log-retention period). After you unsubscribe we keep only your address flagged as unsubscribed, with the consent record, so we can respect the opt-out and demonstrate consent, for up to 24 months; you can ask us to delete it sooner.
• Hosting logs: for the short periods set by the hosting provider.

6. Who processes data on our behalf

Data is shared only with the providers needed to run the service, acting as processors under a data processing agreement, or as independent controllers where stated:

• Cloudflare, Inc. — website hosting, form processing (Pages Functions), security (including the Turnstile bot check on forms) and cookie-free web analytics.
• Resend, Inc. — delivery of form submissions, confirmation emails and the newsletter, and storage of the newsletter contact list (address, language, consent record, subscription status).
• Google (Google Workspace / Gmail, Google Drive, Google Sheets) — email inbox, project files and records.
• Stripe (Stripe Payments Europe, Ltd.) — payments; Stripe is also an independent controller for its own legal and anti-fraud obligations.
• AI model providers used via API to draft reports and documents, under business terms that exclude training on submitted data.
• Accountant (commercialista) — invoices and tax obligations, as an independent controller.

Data is not sold and is not shared for third-party marketing.

7. Client data we process for you

When we build or maintain an automation that handles personal data of your customers, staff or suppliers, you are the controller and we act as your processor. In that case we sign a data processing agreement under art. 28 GDPR, act only on your documented instructions and use least-privilege access. Your data is not used to train AI models. Details: see the "Data & privacy" page (/data-privacy/).

8. Transfers outside the EU

Some providers are based in the United States or may access data from there. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (art. 45–46 GDPR).

9. Your rights

You can ask for access, correction, deletion, restriction, portability and object to processing based on legitimate interest (art. 15–21 GDPR), and withdraw consent at any time. Write to info@pausolutions.com; we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the authority of your EU country.

10. Cookies

See the Cookie Policy. The site uses no analytics or advertising cookies; the Cloudflare Web Analytics statistics described above are collected without cookies.

11. Changes

When this notice changes, the date and version above change too. The version you accepted is stored with each form submission.