1. Data controller
Yellow Tech S.r.l., tax code and VAT no. 10568721210, Via Carlo Boncompagni 3/B, 20139 Milan (MI), Italy, represented by its legal representative pro tempore. Email: info@yellowtech.it, PEC (certified email): yellowtech@pec.it.
2. Data Protection Officer (DPO)
Avv. Francesco Angelo Lorusso, Viale Monte Nero 66, Milan, Italy. Email: lorusso@legalelorusso.it, PEC (certified email): lorussofrancesco@milano.pecavvocati.it.
3. What data we process and where it comes from
Personal details of the legal representative and of the contacts; the client's company name and tax details (VAT number, tax code); postal addresses, phone numbers and email addresses; bank details; the economic value of the services purchased; the content of communications exchanged during the project.
Data is collected directly from the data subject or received from the client they work for (Art. 14 GDPR).
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Entering into and performing the contract: project management, communications with contacts, delivery of training, consulting and artificial intelligence solutions, support and assistance | Performance of a contract or of pre-contractual measures (Art. 6.1.b GDPR); legitimate interest in performing the contract, for the data of the client's contacts (Art. 6.1.f) |
| Administration and accounting: issuing invoices, managing collections and payments | Compliance with legal obligations, in particular tax and accounting obligations (Art. 6.1.c) |
| Protecting Yellow Tech's rights in the event of complaints or disputes | Legitimate interest (Art. 6.1.f) |
Providing the data is necessary to enter into and perform the contract: without it, Yellow Tech cannot deliver the service or issue invoices.
5. How we process it and who it may be disclosed to
Data is processed in digital form on company systems, with personal user accounts and access limited to Yellow Tech staff authorised under Art. 29 GDPR. It may be disclosed to: public authorities, where required by law; companies that provide data processing services or carry out activities related to the contractual relationship; banks, for the management of payments; law firms and professional advisers for the handling of any disputes. These parties act as independent controllers or as processors. Data is not disseminated.
6. Transfers outside the European Economic Area
For the purposes of this notice, data is not intentionally transferred to countries outside the European Economic Area (EEA). Where this happens through technology tools of providers based outside the EEA, the safeguards required by the GDPR apply (an adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses). A copy of the safeguards can be requested from the Controller. Where a specific project requires the use of providers outside the EEA for the data processed on behalf of the client, the conditions and safeguards are set out in the contract and in any data processing agreement.
7. How long we keep it
For the duration of the contract and, afterwards, for the period required by tax and accounting obligations (10 years for accounting records, Art. 2220 of the Italian Civil Code) and by the limitation periods for the protection of rights in civil proceedings. In the event of a dispute, until it is resolved. Once these periods have elapsed, the data is deleted or anonymised.
8. Rights of data subjects
Every data subject may request access to their data, rectification, erasure, restriction of processing and portability, and may object to processing based on legitimate interest (Arts. 15-22 GDPR), by writing to info@yellowtech.it or to the DPO. Yellow Tech replies within one month of the request, extendable to three months for complex requests, in which case it explains why within the first month. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
9. Automated decision-making
No decisions based solely on automated processing, including profiling, are taken on the data processed for the purposes of this notice.
10. Updates
This notice may be updated, including following changes in the law; the updated version is communicated to data subjects. Last updated: 12/10/2026.
If anything here is unclear, ask us
To exercise your rights or to ask a question about this notice, write to info@yellowtech.it. We reply within 30 days, as the GDPR requires.