LEGAL DOCUMENT

Privacy notice and data retention policy

Version: 2.0 · Last updated: 2026-07-10 · Legal reference: GDPR (Reg. (EU) 2016/679), Arts. 13, 14, 5, 17, 28

This notice is provided pursuant to Arts. 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and describes how MyPerito processes the personal data of account holders, billing contacts and website visitors, as well as the policy for retaining and deleting the survey data processed on behalf of its Clients (surveying firms, freelance surveyors, insurance companies — hereinafter, "the Client").

1. Data controller and roles

The controller of the personal data processed by MyPerito for its own purposes is:

• Controller: Andrea Salomone (MyPerito), sole trader under the Italian flat-rate tax regime
• Italian VAT number (Partita IVA): 14760190968
• Italian tax code (Codice Fiscale): SLMNDR95C13D969M
• Registered office: Via S. Bartolomeo del Fossato 20, 16149 Genova (GE)
• Certified email (PEC): salomone.io@pec.it
• Personal data contact: privacy@perito.my

Dual role. MyPerito acts in two distinct roles depending on the data processed:

• As data controller for the data of account holders, billing contacts and website visitors (registration and authentication data, billing, technical logs and browsing data). This notice applies to that processing.
• As data processor pursuant to Art. 28 GDPR for the personal data contained in the survey case-file documents uploaded by the Client: for that data the Client remains the data controller and MyPerito acts solely on the Client's documented instructions, as governed by the Data Processing Agreement (DPA).

2. Purposes and legal bases of the processing

As a controller, MyPerito processes personal data for the following purposes and on the following legal bases:

• Performance of the contract (Art. 6.1.b GDPR): creating and managing the account, providing the Service, support and management of the contractual relationship.
• Legal obligations (Art. 6.1.c GDPR): tax, accounting and invoicing obligations under Italian law.
• Legitimate interest (Art. 6.1.f GDPR): security of the Service, prevention of abuse, diagnostics and technical logs, to the extent that the rights and freedoms of the data subject do not override them.

For the data contained in the survey case files, the legal basis of the processing is determined by the Client in its capacity as controller; MyPerito processes it as a processor on the Client's instructions (see section 1 and the DPA).

3. Categories of data processed

4. Special categories (Art. 9) and criminal-offence data (Art. 10)

The survey case-file documents uploaded to the Service may contain special categories of personal data within the meaning of Art. 9 GDPR — in particular data concerning health and personal injury — and, in some cases, data relating to criminal convictions and offences within the meaning of Art. 10 GDPR.

Such data is processed by MyPerito solely in its capacity as data processor, on the documented instructions of the Client-controller and within the limits set by the DPA. MyPerito does not process such categories of data for its own purposes and makes no use of it beyond generating the survey report requested by the Client.

5. Retention periods

Case-file documents and generated reports are not subject to automatic deletion at a fixed deadline: they remain available for the duration of the contractual relationship. The Client may export them or request their deletion at any time; deletion takes place on request or at the end of the relationship (see section 6).

Retention criterion. Data is retained for the time strictly necessary for the purposes for which it is collected and, where applicable, for the period imposed by legal, ethical or professional obligations (for example limitation periods and tax obligations). MyPerito periodically reviews — as a rule at least once a year — the data it retains, in order to verify that a purpose or an obligation justifying its retention still exists, deleting or anonymising data that is no longer necessary.

6. Rights of the data subject

The data subject may exercise the following rights at any time, within the limits and under the conditions laid down by the GDPR:

• Access (Art. 15): obtain confirmation of the processing and a copy of their data.
• Rectification (Art. 16): correct inaccurate data or complete incomplete data.
• Erasure (Art. 17): obtain the deletion of the data in the cases provided for (see the procedure below).
• Restriction (Art. 18): restrict the processing in the cases provided for by law.
• Portability (Art. 20): receive their data in a structured, machine-readable format (see below).
• Objection (Art. 21): object at any time to processing based on legitimate interest.
• Automated decision-making (Art. 22): MyPerito does not carry out automated decision-making, including profiling, producing legal effects concerning the data subject or similarly significantly affecting them. Artificial intelligence is used solely to produce document drafts, which are always subject to the surveyor's checking and review.

To exercise their rights, the data subject may write to privacy@perito.my. The operational detail for erasure and portability follows.

Erasure (Art. 17) — procedure

1. Written request to: privacy@perito.my
2. Verification of the requester's identity (within 5 working days)
3. Execution of the erasure within 30 calendar days of the verified request
4. Written confirmation that the erasure has taken place

Exceptions to erasure:

• Data subject to legal retention obligations (e.g. invoices, under Art. 22 D.P.R. 600/1973, the Italian Presidential Decree on tax records): retained for the period required by law, isolated and inaccessible to the Service's operators.
• Security logs already anonymised: not attributable to the data subject.

Method:

• Complete, unrecoverable deletion from the production databases and from all active backups within 30 days.
• Backups predating the deletion are rotated and overwritten according to the standard cycle (14 days); MyPerito does not reconstruct deleted data from backups.

Portability (Art. 20)

The Client may request, at any time and free of charge, a copy of their data in a structured, machine-readable format (JSON or CSV for structured data, original formats for documents). Turnaround time: within 30 days of the request.

7. Complaint to the Garante (Art. 77)

Without prejudice to any other administrative or judicial remedy, a data subject who considers that the processing of their data infringes the GDPR has the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority; Piazza Venezia 11, 00187 Roma; www.garanteprivacy.it), or to bring proceedings before the competent court.

8. Recipients and sub-processors

Data may be disclosed to third-party suppliers acting as processors or sub-processors, bound by agreements compliant with Art. 28 GDPR. The up-to-date list of sub-processors is available on request. The main recipients are:

• Google Cloud Platform (infrastructure, storage, database, Vertex AI / Gemini) — storage in europe-west1 (Belgium); AI inference may take place outside the EU (Google LLC, certified under the EU-US Data Privacy Framework)
• Anthropic, PBC (Claude — document generation on custom templates) — processing in the USA on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission
• Firebase (authentication) — Google LLC (USA), certified under the EU-US Data Privacy Framework
• Stripe, LLC (payment processing) — USA, certified under the EU-US Data Privacy Framework
• Resend (transactional email) — delivery metadata only, never case-file content; US supplier certified under the EU-US Data Privacy Framework
• Brevo (Sendinblue SAS) (receipt of inbound email — email intake function) — supplier established in the European Union (France)

Transfers outside the EU. Where a recipient processes data outside the European Economic Area, the transfer is covered by appropriate safeguards under Chapter V of the GDPR — certification under the EU-US Data Privacy Framework or Standard Contractual Clauses, as indicated above.

MyPerito gives the Client advance notice of any change to the list of sub-processors that may have an impact on data protection.

9. Encryption

• At rest: AES-256 (Google Cloud SQL and Cloud Storage default)
• In transit: TLS 1.2+ on all connections (browser ↔ backend, backend ↔ cloud services)
• Signed links: 15-minute expiry, regenerable only by authenticated users

10. Internal access

Access to production data by MyPerito personnel is limited to cases of:

• technical support explicitly requested by the Client,
• emergency intervention to guarantee continuity of the service,
• documented legal obligations.

Every access is logged.

11. Cookies

The site uses cookies and similar technologies. For details of the cookie categories, the purposes and how consent is managed, please refer to the Cookie Policy.

12. Data protection impact assessment (DPIA)

Some processing carried out through the Service involves the systematic use of artificial intelligence on data that may include special categories (Art. 9). Such processing may require a data protection impact assessment (DPIA) pursuant to Art. 35 GDPR, the obligation for which falls on the controller of the data — that is, on the Client. MyPerito provides the Client with the information and assistance reasonably necessary to draw it up, pursuant to Art. 28.3.f GDPR.

13. Data protection officer (DPO) and contacts

MyPerito has not currently designated a Data Protection Officer (DPO): whether designation is required under Art. 37 GDPR is being assessed. In the absence of an appointed DPO, any request concerning data protection — exercise of data subject rights, compliance queries or reports — may be addressed to the following contacts:

Personal data contact: privacy@perito.my
Certified email (PEC): salomone.io@pec.it
Registered office: Via S. Bartolomeo del Fossato 20, 16149 Genova (GE)

Document under internal version control. Previous versions available on request.