Privacy notice

The data controller is Risma Energy, an engineering firm for renewable energy permitting. For any request about your data, write to info@rismaenergy.com.

• Browsing data: IP address, date and time of the request, page visited, browser and device type, logged automatically by the servers hosting the website to run and protect it.
• Booking a call: name, email, any notes and the date and time you choose in the booking calendar.
• Sending documents: name, work email, your company if you provide it, the project description and the files you attach (for example KMZ, KML, STMG, land registry extracts, PDF, DOCX, ZIP).
• Email exchanges with our firm.

Project documents may contain data about other people, for example the owners of the land shown in a land registry extract or the coordinates of a plot. By sending them you confirm that you may share them with us for the assessment of the project; we use them only for that purpose.

We do not collect special categories of data (for example health data) and ask you not to send any.

• To answer your requests, arrange the call, prepare a quote or an assessment of the project: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• To carry out the engagement if you become a client: performance of a contract (Art. 6(1)(b)).
• To meet legal obligations, for example tax and accounting: legal obligation (Art. 6(1)(c)).
• To keep the website working and secure and to prevent abuse such as form spam: legitimate interest (Art. 6(1)(f)).

We do not use your data to send you advertising or newsletters, we do not sell it and we do not take automated decisions about you. Project documents are not used to train models.

Your name and email are needed to reply to you: without them we cannot follow up on your request. All other data is optional.

The website uses no profiling cookies and no advertising tools. In your browser's storage we only keep a few technical preferences: the light or dark theme you chose and whether you closed the welcome message. They stay on your device and are not sent to us.

For visit statistics we may use Plausible Analytics (Plausible Insights OÜ, with servers in the European Union): it uses no cookies, collects no personal data and only gives us aggregate figures, such as the most visited pages.

The booking calendar is provided by Cal.com and loads only when you reach the call section or open the booking: Cal.com may use technical cookies needed for the service, as described in its own privacy policy (cal.com/privacy).

The data is processed by Risma staff and by authorised engineers and collaborators bound by confidentiality. We also rely on providers that process it on our behalf as processors (Art. 28 GDPR):

• Railway Corporation, for hosting the website and the files you send;
• Cal.com, Inc., for the booking calendar;
• Notion Labs, Inc., which we may use to manage the requests we receive (without the attached files);
• our email provider.

The data is not disclosed to the public. It may be shared with authorities only where the law requires it.

Some providers are based in the United States. In these cases the transfer relies on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) for certified providers, or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

• Project files sent for an assessment or a quote: deleted when the assessment ends and in any case within 90 days of our reply, unless you engage us.
• Requests and correspondence that do not lead to an engagement: 12 months from the last contact.
• Call bookings: 12 months.
• Data and documents of engagements: for the duration of the relationship and then for as long as the law requires, for example 10 years for accounting records.
• Server browsing data: only as long as needed for security, normally no more than 30 days.

The website uses encrypted connections (HTTPS). The files you send stay on our servers, in a separate folder for each request, and only authorised staff can access them. We handle project documents with the confidentiality of an engineering firm.

At any time you can ask to access your data, rectify it, erase it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest (Arts. 15-22 GDPR), by writing to info@rismaenergy.com. We reply within one month.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

We may update this notice, for example if our services or providers change. The date of the latest update is shown at the top of the page.