Privacy Policy

1. Data Controller

BossDevelop S.r.l., P.IVA IT-01234567890, V. Guglielmo Reiss Romoli, 4, 10155 Torino TO, Italy. Email: hello@bossdevelop.com. Phone: +39 011 201 507.

2. Legal Framework

This privacy policy is issued in accordance with the General Data Protection Regulation (GDPR, Regulation EU 2016/679), the Italian Privacy Code (D.lgs. 196/2003 as amended by D.lgs. 101/2018), and the guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali). For more information visit garanteprivacy.it.

3. Categories of Data Collected

We collect the following categories of personal data: contact information (name, email, phone number) provided through our contact forms and checkout process; project-related information shared during consultations; payment data processed exclusively by Stripe (PCI DSS Level 1 certified); and analytics data collected through Plausible Analytics, which is cookieless and GDPR-compliant by design.

4. Purpose and Legal Basis

Contact data is processed for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Payment processing is necessary for contract performance. Analytics data is processed based on our legitimate interest in improving our services (Art. 6(1)(f) GDPR).

5. Data Retention

Client data and invoices are retained for 10 years as required by Italian tax legislation (D.P.R. 600/1973). Project files are retained according to contractual terms. Contact form submissions are retained for 24 months unless a contract is established.

6. Your Rights Under GDPR

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). To exercise these rights, contact hello@bossdevelop.com. We respond within 30 days. You may also lodge a complaint with the Garante at garanteprivacy.it.

7. Security Measures

All data is transmitted via HTTPS/TLS. Team members use two-factor authentication. All contractors sign NDAs. In the event of a data breach, we will notify the Garante within 72 hours as required by Art. 33 GDPR.

8. Third-Party Processors

Stripe Inc. (payment processing, USA, EU-US Data Privacy Framework certified). Plausible Analytics (EU-hosted). GitHub/GitLab (code hosting, DPA in place).

Last updated: March 2026.