Privacy policy
Information on the processing of personal data
Last updated: 6 July 2026
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and to Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the "Italian Privacy Code"), for anyone interacting with the website blueprint33.it (the "Site").
1. Data controller
The data controller is Böhm Consulting, registered office at Via Cucchiari 30, 20155 Milan (IT), VAT number 14340150961, certified email bohmconsulting@pec.it.
The Site and the "Blueprint 33" project are operated by Böhm Consulting. For any matter relating to the processing of personal data you can write to privacy@blueprint33.it.
The controller has not appointed a Data Protection Officer (DPO), as the conditions making such appointment mandatory under Article 37 GDPR do not apply.
2. Categories of data processed
The controller processes the following categories of personal data:
- Data provided voluntarily through the application form ("Architect Program"): first name, last name, email address and information on professional background and experience entered freely by the data subject.
- Browsing data: the IT systems and software procedures that operate the Site acquire, in the course of normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols (for example IP addresses, browser and device type, request times). Such data is processed by the hosting provider for technical and security purposes.
- Cookies and tracking tools: see the Cookie Policy for details.
The controller neither requests nor knowingly processes special categories of data (Article 9 GDPR). Data subjects are asked not to enter irrelevant or special category data in the form.
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Handling and assessing applications to the Architect program | Performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR) |
| Contact regarding future opportunities and subsequent cohorts similar to the application submitted | Legitimate interest of the controller in making use of the applications received (Article 6(1)(f) GDPR). The data subject may object at any time (see section 8) |
| Compliance with legal obligations and defence of legal claims | Legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR) |
| Technical operation and security of the Site | Legitimate interest of the controller in ensuring network and information security (Article 6(1)(f) GDPR) |
4. Nature of the provision of data
Providing the data marked as mandatory in the form is necessary in order to handle the application: failure to provide it makes it impossible to follow up on the request. The provision of browsing data is inherent in the use of the Site.
5. Recipients of the data and processors
The data is processed by the controller's authorised personnel. To deliver the service the controller relies on third-party suppliers acting as data processors pursuant to Article 28 GDPR, including:
- Mokapen — CRM platform used to collect and manage applications submitted through the form.
- Cloudflare, Inc. — provider of hosting, content delivery (CDN) and security services for the Site.
- Google Ireland Ltd. / Google LLC — provider of font rendering services (Google Fonts) and form protection against automated traffic (reCAPTCHA).
The data is not disseminated, nor transferred to third parties for marketing purposes of parties other than the controller.
6. Transfers to third countries
Some of the suppliers listed above (in particular Google and Cloudflare) are based in the United States of America or may process data outside the European Economic Area. In such cases the transfer takes place under appropriate safeguards pursuant to Chapter V of the GDPR, such as adherence to the EU-U.S. Data Privacy Framework and/or the signing of the Standard Contractual Clauses approved by the European Commission.
7. Retention period
Data collected through the application form is retained for a maximum of 24 months from receipt, after which it is deleted or anonymised, unless a different legal obligation applies or it is necessary to defend a legal claim. Browsing data and technical logs are retained for as long as strictly necessary for technical and security purposes.
8. Rights of the data subject
In the cases provided for by Articles 15-22 GDPR, the data subject has the right to:
- access their personal data and obtain a copy of it (Article 15);
- request its rectification (Article 16);
- request its erasure (Article 17);
- request restriction of processing (Article 18);
- obtain data portability (Article 20);
- object to processing based on legitimate interest, including contact regarding future opportunities (Article 21);
- withdraw any consent given, without affecting the lawfulness of processing carried out beforehand (Article 7).
These rights may be exercised by writing to privacy@blueprint33.it. Data subjects also have the right to lodge a complaint with the competent supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) should they consider that the processing infringes applicable law.
9. Processing methods and security
Processing is carried out using IT and electronic tools, following logic strictly related to the stated purposes and by adopting technical and organisational security measures adequate to prevent loss, unlawful or incorrect use, and unauthorised access to the data.
10. Changes to this notice
The controller reserves the right to amend or update this notice, including as a result of regulatory changes. Changes will be published on this page together with the date of the latest update.
This is a translation provided for convenience. The Italian version of this notice is the binding one: in case of any discrepancy, the Italian version prevails.