Privacy Policy

Last updated: 22 September 2026

This Privacy Policy describes how BCP Consulting processes the personal data collected through its websites bcpc.xyz and ai.bcpc.xyz, as well as through communications by email and similar channels, in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian legislative decree D.Lgs. 196/2003 as amended by D.Lgs. 101/2018.

1. Data controller

No Data Protection Officer (DPO) has been appointed, as the conditions making the appointment mandatory under Art. 37 GDPR are not met. For any request concerning the processing of personal data, please write to the addresses indicated above.

2. Types of data collected

Through the contact form on bcpc.xyz, BCP Consulting collects the following personal data:

• First name and surname
• Name of the company you belong to
• Email address
• Telephone number (optional)
• Content of the message

Through the White Paper request form on ai.bcpc.xyz, BCP Consulting collects the following personal data:

• First name and surname
• Business email address
• Name of the company you belong to
• Telephone number
• Indication of the area of interest (consulting, training, development of AI assistants, first contact, or White Paper request only)

Further data may be collected in the course of subsequent interactions (for example by email or during a first exploratory contact): content of communications, professional information about your business or company that you provide voluntarily.

Automatically collected data

Our websites do not use profiling or marketing cookies. Only minimal technical data (IP address, browser type, pages visited) necessary for the operation of the service and for security are collected. These data are kept for limited periods and are not used for profiling.

3. Purposes of processing

The data collected through the contact form are processed for the following purposes:

• Replying to the message sent and managing the resulting contact.
• Sending commercial communications about BCP Consulting's services (newsletters, service updates, invitations to events), only with your optional consent, given by ticking the relevant box in the form. Not giving consent does not prevent you from receiving a reply.

The data collected through the White Paper request form are processed for the following purposes:

• Sending the requested White Paper and managing the resulting communication.
• Handling your request for personalised consulting, a training course, the development of an AI assistant, or a first exploratory contact, where indicated.
• Sending commercial communications about BCP Consulting's services (newsletters, service updates, invitations to events), subject to your explicit consent collected when filling in the form.
• Fulfilment of legal obligations (tax, accounting and contractual obligations, should a consulting relationship be established).

BCP Consulting may also compile internal statistics in anonymous and aggregate form (for example on the number and origin of requests), which do not in any way allow individuals to be identified.

4. Legal basis for processing

• Explicit consent (Art. 6.1.a GDPR) for replying to messages sent through the contact form, for sending the White Paper and for commercial communications;
• Performance of pre-contractual measures (Art. 6.1.b GDPR) for handling your service request;
• Legal obligation (Art. 6.1.c GDPR) for tax and accounting obligations;
• Legitimate interest (Art. 6.1.f GDPR) for the security of IT systems and the prevention of abuse.

5. Methods of processing and recipients of the data

The data collected through the forms are:

• Sent by email to the addresses bcp@bcpc.xyz and assistant@bcpc.xyz, where they are read by Boris Caharija Pizzolitto and processed by the internal operational AI assistant.
• Stored in BCP Consulting's internal CRM, hosted on dedicated infrastructure directly controlled by the Data Controller.
• Used to contact you in relation to your request.

No disclosure to third parties for marketing purposes. Your data are not transferred, sold or shared with third parties for the purposes of email marketing, advertising profiling or the sale of third-party products.

The data may be disclosed, limited to what is strictly necessary, to the following parties:

• Technical service providers (hosting, email, backup, protection of forms against automated submissions), appointed as Data Processors pursuant to Art. 28 GDPR, who act on documented instructions from the Data Controller and guarantee appropriate security measures;
• Professional advisers (accountant, payroll consultant) within the limits of legal obligations;
• Competent authorities in the event of lawful requests.

6. Transfer of data abroad

The data are stored on servers located in the European Economic Area (EEA). Should a transfer outside the EU be necessary for technical reasons (backup, email services, protection of forms), it will take place exclusively to countries that guarantee an adequate level of protection under the GDPR, or by means of the legal instruments provided for (standard contractual clauses, adequacy decisions).

7. Retention period

• Data collected through the contact form: kept for 24 months from the last interaction, unless erasure is requested.
• Data collected through the White Paper form: kept for 24 months from the last interaction, unless consent is withdrawn or erasure is requested.
• Data of clients with whom a contractual relationship is established: kept for the duration of the contract and for the periods required by tax law (10 years).
• Contact data for commercial communications: kept until consent is withdrawn.
• Technical data (server logs): kept for a maximum of 12 months.

8. Rights of the data subject

With regard to the processing of your personal data, you have the right to:

• Access your data and receive a copy of them (Art. 15 GDPR);
• Rectify inaccurate or incomplete data (Art. 16 GDPR);
• Erase your data (“right to be forgotten”, Art. 17 GDPR);
• Restrict processing (Art. 18 GDPR);
• Receive your data in a structured, machine-readable format (right to data portability, Art. 20 GDPR);
• Object to processing (Art. 21 GDPR);
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
• Lodge a complaint with the Autorità Garante per la Protezione dei Dati Personali (the Italian supervisory authority, www.garanteprivacy.it).

To exercise your rights, write to bcp@bcpc.xyz or to the PEC address boris.pizzolitto@pec.it. We will reply within 30 days of the request.

9. Data security

BCP Consulting adopts appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, destruction or improper disclosure. The servers are protected by an encrypted connection (HTTPS/TLS), access with multi-factor authentication, regular backups and continuous monitoring. However, no security measure is infallible: in the event of a data breach that poses risks to your rights, we will notify you without delay pursuant to Art. 34 GDPR.

10. Cookies

The websites bcpc.xyz and ai.bcpc.xyz use only technical cookies necessary for the operation of the site and for navigation. No profiling, tracking or third-party advertising cookies are used.

The contact form on bcpc.xyz and the White Paper request form on ai.bcpc.xyz use Cloudflare Turnstile to prevent automated submissions: the use of Turnstile is subject to Cloudflare's privacy policy.

11. Changes to this Privacy Policy

This Privacy Policy may be updated at any time to reflect regulatory or operational changes. The current version can always be consulted at this address. The date of the last update is indicated at the top of the page.

12. Contact

For any question concerning this Privacy Policy or the processing of your personal data, you can contact us at the following details: