Last updated: June 16, 2025
Privacy Policy
Information on the processing of personal data pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Decree 101/2018.
1. Data Controller
Hub Srl
Via Montebello 8, 15040 Mirabello Monferrato (AL) — Italy
VAT 02721890065 | Share capital € 10,000 fully paid-up
Email: info@really-hub.it
2. Data collected and purposes
2.1 Contact form
When you fill in the contact form we collect: name, email address, optional company name and the content of your message.
Purpose: responding to your enquiry and, with your consent, sending commercial communications.
Legal basis: pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR) and/or consent (Art. 6(1)(a)).
Email provider: Resend Inc. (San Francisco, CA, USA) — DPA available at resend.com.
2.2 Registration and Freelance Area
During registration we collect: name, profession, work experience, portfolio URL, email address and password (encrypted by Supabase Auth). In the private area we may also process banking/tax details for compensation management and identity documents for verification.
Purpose: managing the working relationship and related administrative and tax obligations.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c)).
Provider: Supabase Inc. (San Francisco, CA, USA) — DPA available at supabase.com.
2.3 Analytics and marketing
We use Google Analytics 4, loaded via Google Tag Manager, to analyse website traffic in aggregated and pseudonymised form. The Meta Pixel (Facebook/Instagram) is used to measure the effectiveness of advertising campaigns. Both tools are activated only upon your explicit consent.
Legal basis: consent (Art. 6(1)(a) GDPR).
Providers: Google LLC (Mountain View, CA, USA) and Meta Platforms Ireland Ltd. (Dublin, Ireland).
2.4 Technical navigation data
The web server automatically logs IP address, browser type, pages visited and request timestamps to ensure the security and correct operation of the website. This data is deleted within 30 days.
Legal basis: legitimate interest of the controller in IT security (Art. 6(1)(f) GDPR).
3. Recipients of personal data
Personal data may be shared with the following parties, acting as data processors (Art. 28 GDPR) or, in the case of Google and Meta, as independent controllers:
| Provider | Location | Service |
|---|---|---|
| Supabase Inc. | San Francisco, CA, USA | Database, authentication, storage |
| Resend Inc. | San Francisco, CA, USA | Transactional emails |
| Sanity AS | Oslo, Norway | Website CMS |
| Vercel Inc. | San Francisco, CA, USA | Website hosting |
| Google LLC | Mountain View, CA, USA | Analytics 4 and Tag Manager |
| Meta Platforms Ireland Ltd. | Dublin, Ireland | Advertising Pixel |
| Calendly LLC | Atlanta, GA, USA | Call scheduling (if used) |
Data is never sold or shared with third parties for purposes other than those listed above.
4. International data transfers
Some providers (Google, Meta, Supabase, Resend, Vercel, Calendly) transfer data to the United States or other non-EEA countries. Transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR and, where applicable, by adherence to the EU–US Data Privacy Framework.
5. Retention periods
| Data category | Retention period |
|---|---|
| Contact form data | 24 months from the last interaction |
| Active freelance account | For the duration of the relationship |
| Freelance account (post-deletion) | 10 years (accounting and tax obligations) |
| Technical navigation data | 30 days |
| Analytics data (Google Analytics 4) | 14 months (Google default setting) |
| Marketing data (Meta Pixel) | 90 days |
6. Your rights
Under Articles 15–22 GDPR you have the right to:
- Access — obtain confirmation of processing and a copy of your data
- Rectification — correct inaccurate or incomplete data
- Erasure ("right to be forgotten") — request deletion of your data
- Restriction — restrict processing in certain cases provided by law
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdrawal of consent — at any time, without prejudice to lawfulness of prior processing
- Lodge a complaint — with the competent supervisory authority (for Italy: garante.privacy.it)
To exercise your rights, write to info@really-hub.it. We will respond within 30 days of receiving your request.
7. Cookies and tracking technologies
For detailed information on how we use cookies, tracking technologies and how to manage your preferences, please read our Cookie Policy.
8. Changes to this policy
This policy may be updated to reflect legislative or organisational changes. The current version is always available on this page with the last-updated date. Registered users will be notified by email of material changes.