Privacy and cookies.

Last updated: 27 October 2026

1. Data controller

The data controller for personal data collected through commonsystems.net is Christian Marcello, owner of the business operating as "Common" or "Common Systems" (the "Controller").

For any request about the processing of personal data, write to mail@commonsystems.net.

2. Personal data collected

We collect the data you give us directly:

• when you book a call through the booking calendar: name, email address, phone number and any notes you choose to add;
• when you write to us through the website chat: the details you enter and the content of your messages;
• when you email us: your address and the content of your message.

We also collect some technical data (IP address, device and browser type, pages visited, date and time of access) needed for the site to work and stay secure. See Section 12.

3. Purposes and legal basis

• a) Responding to your request, arranging the call and giving you information about Common's services. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• b) Contacting you by phone, SMS or WhatsApp about your request. Legal basis: your consent (Art. 6(1)(a) GDPR), where requested in the calendar or the chat.
• c) Managing the business relationship: proposals, quotes and follow-ups related to your request. Legal basis: the Controller's legitimate interest in following up a discussion you started (Art. 6(1)(f) GDPR).
• d) Meeting legal obligations (accounting, tax, administrative) if your request becomes a contract. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• e) Marketing communications, only with your specific and separate consent. Legal basis: consent (Art. 6(1)(a) GDPR).

4. Whether providing data is required

Name, email and phone number are needed to book the call: without them we can't follow up. Everything else is optional.

5. How data is processed

Personal data is processed using IT and electronic tools, following logics strictly related to the purposes indicated above, and in a manner that ensures the security and confidentiality of the data. The Controller adopts appropriate technical and organisational measures to prevent loss, unlawful use, or unauthorised access to data, including: encryption of communications (HTTPS/TLS), data access restricted to authorised staff and collaborators bound by confidentiality obligations, and periodic review of the security measures in place.

6. Recipients and data processors

For the purposes indicated above, personal data may be shared with third parties acting as data processors under Art. 28 GDPR, including in particular:

• HighLevel Inc. (GoHighLevel): CRM and marketing automation platform used to manage contacts, communications and automated workflows. Based in the United States.
• OpenAI, L.L.C.: provider of the artificial intelligence functionality used for automated assistance to contacts. Based in the United States.
• Netlify, Inc.: hosting provider for the commonsystems.net website. Processes technical data (IP address, device/browser type, access logs) necessary to serve the site. Based in the United States.
• Collaborators, consultants and employees of the Controller, authorised to process data and bound by confidentiality obligations.

A Data Processing Agreement under Art. 28 GDPR has been or will be entered into with each of the above parties that processes data on the Controller's behalf. Data is never disclosed or sold to third parties for purposes other than those set out in this policy.

7. Transfers outside the EU

Some of the processors listed in Section 6 (in particular GoHighLevel, OpenAI and Netlify) are based in the United States, a country that does not benefit from a general adequacy decision by the European Commission for personal data transfers.

Transfers of data to these parties are therefore carried out on the basis of appropriate safeguards under Art. 46 GDPR, in particular through the adoption of Standard Contractual Clauses (SCCs) approved by the European Commission under Implementing Decision (EU) 2021/914, and/or the providers' participation in the EU-U.S. Data Privacy Framework, where applicable and verifiable in the relevant public register.

A copy of the safeguards adopted can be requested by writing to the address indicated in Section 1.

8. Retention period

• Data collected through the calendar, the chat or email is kept for as long as needed to handle your request and any discussion that follows, and in any case no longer than 24 months from the last contact if no contract is signed.
• If a contract is signed, data is kept for its duration and then for the period required by tax and civil law (usually 10 years).
• Data processed on the basis of consent is kept until you withdraw it.

9. Your rights

As a data subject, in relation to the processing of your personal data you have the right to:

• Access your personal data (Art. 15 GDPR)
• Obtain rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• Obtain erasure of your data, in the cases provided for by applicable law (Art. 17 GDPR)
• Obtain restriction of processing (Art. 18 GDPR)
• Receive the data you provided to us in a structured, commonly used, machine-readable format (data portability, Art. 20 GDPR)
• Object at any time to processing based on the Controller's legitimate interest (Art. 21 GDPR)
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the competent authority in your country of residence, if you believe the processing infringes applicable law

To exercise the rights listed above, you can write at any time to the email address indicated in Section 1. The Controller will respond to the request without undue delay and, in any case, within one month, as provided by Art. 12 GDPR.

10. Withdrawing consent to calls and messages

You can withdraw your consent to being contacted by phone or SMS/WhatsApp at any time: by replying "STOP" to a message received, by stating so verbally during a call, or by writing to the address indicated in Section 1. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

11. Minors

Common's services are intended for adults acting for their own business. The Controller does not knowingly collect data from minors through the site.

12. Cookies and similar technologies

Technical cookies, always on. The site stores one technical cookie (common_cookie_consent, 6 months) to remember your cookie choices. The provider of the chat and booking services may set a strictly necessary cookie (__cf_bm) for bot detection and security. These cookies do not require consent under Art. 122 of the Italian Privacy Code.

Chat and calendar, only with consent. The site uses two services from HighLevel Inc. (GoHighLevel): the support chat, on every page, and the booking calendar, on the Book page. Both may set cookies and store data in your browser, for example a session identifier. The chat loads only after you consent through the cookie banner. The calendar loads only after the same consent, or when you ask for it with the "Show the calendar" button. Without consent you can always email us at mail@commonsystems.net.

No profiling or analytics cookies are used by the site.

You can change your preferences at any time with "Cookie preferences" at the bottom of every page or with the icon in the bottom-left corner.

13. Changes to this policy

This policy may be updated periodically to reflect regulatory, organisational, or service-related changes. The updated version will always be available on commonsystems.net, with the date of the last revision shown at the bottom of this page.

14. Contact

For any question about this policy or the processing of your personal data, write to mail@commonsystems.net.