Privacy Policy
1. Who we are
Corepoint Project Management is the data controller for personal data collected through corepointpm.com. It is an interior construction project management practice based in Milan, Italy, led by Alessandro Bruno as managing partner.
Privacy inquiries are handled at info@corepointpm.com. Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer.
2. What we collect
Information you give us. When you use the contact form we collect your name, company, email address, the role you select, the service and project stage you indicate, the notes you write, and any files you choose to attach. If you email or call us instead, we hold what you send.
Information collected automatically. Our hosting provider records standard technical data for security and reliability: IP address, browser and device type, pages requested, and timestamps.
Providing this information is voluntary and there is no statutory obligation to give it. It is, however, necessary if you want us to respond to an inquiry or to enter into an engagement: without it we cannot assess fit or reply. We do not ask for special category data, and you should not submit it.
3. Why we use it, and on what basis
- To respond to your inquiry and assess fit — steps taken at your request prior to entering a contract (GDPR Art. 6(1)(b)).
- To provide services under an agreed engagement — performance of a contract (Art. 6(1)(b)).
- To keep the website secure and functioning — our legitimate interests in protecting the website (Art. 6(1)(f)).
- To send occasional practice updates — our legitimate interests in maintaining professional relationships, or your consent where required (Art. 6(1)(f) or 6(1)(a)).
- To establish, exercise or defend legal claims — our legitimate interests (Art. 6(1)(f)).
- To meet accounting, tax and legal obligations — legal obligation (Art. 6(1)(c)).
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We do not use it for automated decision-making or profiling.
4. Files you attach, and third-party data
You are welcome to attach drawings, schedules, budgets or other project material to the contact form, and describing a project usually requires it. Material sent before an engagement and its confidentiality terms are agreed is not received under any obligation of confidence and is not covered by a confidentiality agreement. Send what is needed to describe the project, and hold anything more commercially sensitive until a confidentiality agreement is in place.
Project documents often contain the personal data of other people — consultants, contractors, suppliers, colleagues. If you send us such material, you confirm that you are entitled to share it and that those individuals have been informed as their own privacy notice requires. We process that personal data only to respond to your inquiry or to perform the engagement, and we retain it for the periods set out in section 8.
Technical and commercial content that does not identify an individual — drawings, specifications, sequencing and coordination detail, and the working knowledge drawn from them — may be retained indefinitely as part of our own project reference. It is held internally and is not published or disclosed except as described in section 6 and in our Terms of Use.
5. Updates and communications
Where you have asked to hear from us, or where we have a relationship that makes it reasonable, we may send occasional practice updates or information relevant to your project. Every such message includes a way to opt out, and you can opt out at any time by replying or emailing us. Opting out of updates does not affect correspondence about an active inquiry or engagement.
6. Who we share it with
We share personal data with service providers who process it on our behalf under a data processing agreement: our website host, our email and communications provider, the service that delivers contact form submissions, and the systems used to manage inquiries and client records.
Where an engagement requires it, and only to the extent necessary, information may be shared with the other parties on your project — for example a manufacturer, supplier or contractor being asked to quote or to coordinate a delivery.
We may also disclose personal data where required by law, to establish or defend legal claims, or in connection with a merger, acquisition or other transfer of the practice, in which case the recipient remains bound by this policy. We do not disclose personal data to third parties for their own independent marketing purposes.
7. International transfers
We operate from Italy and work with clients and manufacturers in the United States and elsewhere, and some of our providers are established outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission, together with any additional safeguards required. You may request a copy of the relevant safeguard by writing to info@corepointpm.com.
8. How long we keep it
Inquiries that do not lead to an engagement are reviewed at 24 months from the last contact and are then deleted or anonymized. Records relating to an engagement are kept for its duration and afterwards for the period required by Italian accounting and tax law — currently ten years for accounting records — and for as long as a claim relating to the engagement could be brought. Server logs are kept for a short period for security purposes.
9. Your rights
Subject to applicable law, you may ask us to give you access to your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on legitimate interests, you may object at any time, and where we rely on consent you may withdraw it without affecting processing already carried out.
To exercise any of these rights, email info@corepointpm.com. We respond within the time limits set by applicable data protection law. If you believe we have handled your data improperly, you may complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in your country of residence.
10. If you are in the United States
Where state privacy law applies to you, you may have the right to know what personal information we hold, to request its correction or deletion, to opt out of any sale or sharing of it, and not to be discriminated against for exercising those rights. As stated above, we do not sell personal information and do not share it for cross-context behavioral advertising. Requests may be sent to info@corepointpm.com and are handled in the same way as those described in section 9.
11. Cookies and analytics
The website uses cookies that are strictly necessary for it to function. Our hosting provider may set cookies or use similar technologies for website functionality, security and performance. These do not require your consent.
We may also measure how the website is used. Where that measurement is carried out without cookies or similar identifiers, or in a form that does not identify you, is not enriched with other data and is not passed to a third party for its own purposes, it is treated as technical and no consent is requested.
Any analytics, marketing or other non-essential cookie or identifier is set only after you have given consent. Where such technologies are in use, a consent notice is presented on your first visit, this policy is updated to describe them, and you may change or withdraw your choice at any time. You can also manage or block cookies through your browser settings; disabling some may affect how parts of the website work.
Typefaces and images that form part of the website are served from our own host; the website does not load fonts, scripts or tracking from advertising or analytics networks. The Calendly and LinkedIn buttons are plain links: nothing from those services loads until you choose to follow them, at which point their own privacy policies apply.
12. Security
We apply appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access. No transmission over the internet can be guaranteed to be completely secure, and you send information to us at your own risk.
13. Children
The website is directed at businesses and professionals. We do not knowingly collect personal data from anyone under 16.
14. Third-party websites
The website may link to websites operated by third parties. We are not responsible for their content, security or privacy practices, and this policy does not apply to them.
15. Changes
We may update this policy to reflect changes in our practices, providers or legal obligations. The version published here applies, and the date above shows when it was last revised.
16. Contact
Questions about this policy, or any request concerning your data:
Corepoint Project Management
info@corepointpm.com