Privacy Policy

The controller for the processing of your personal data is Cittadinanza Desk, a company being incorporated under the French legal form SASU (Société par Actions Simplifiée Unipersonnelle), with registered office at 15 avenue des Champs-Élysées, 75008 Paris, France. Official registration with the Paris Trade and Companies Register is expected to be completed in June 2026.

For any inquiries relating to the protection of your personal data or the exercise of your rights, please contact us at the dedicated address dpo@cittadinanzadesk.com. For general inquiries about the service, the main contact address is hello@cittadinanzadesk.com.

We collect only the data strictly necessary to deliver the Eligibility & Strategy Assessment service and to comply with our legal obligations. Collection takes place at three distinct points in the customer journey: during the initial questionnaire, at the time of payment, and after payment confirmation when document uploads are requested.

During the initial questionnaire, we collect the following identification data: your first name, your email address, and your WhatsApp number (with international prefix). These data are essential to send you the preliminary diagnostic result and to maintain a communication channel during the Assessment phase.

Also during the questionnaire, we collect data about your family situation and possible Italian connection: your current country of residence, the type of genealogical link with an Italian ancestor (father, grandfather, great-grandfather), the place and region of that ancestor’s birth, the approximate historical period of birth and any emigration, naturalizations that occurred in the line of descent, any prior administrative applications you may have made, and the personal motivations leading you to pursue Italian citizenship.

After payment confirmation, we ask you to upload supporting documents in a secure area. These documents typically include civil-status records (birth, marriage, death certificates), baptism certificates, naturalization records, historical passports, and other identity papers. These documents contain personal data concerning both you and your ancestors.

At the payment stage, payment-instrument data (card number, expiry date, CVV) are processed exclusively by our payment processor Stripe, certified PCI-DSS Level 1. We never receive or store the full details of your bank card. We receive only the following data after the transaction: the amount paid, the currency, the unique Stripe transaction identifier, the payment status, and the last four digits of your card for accounting purposes.

Finally, while you browse our site we automatically collect technical data: your IP address (used for anti-fraud rate limiting and security, retained for 30 days), your browser user-agent, and analytics data about your journey through the site. The use of cookies is governed by our dedicated Cookie Policy and depends on your express consent for non-essential categories.

Each processing of your personal data corresponds to a specific purpose and is based on one of the legal bases set out in Article 6 of the GDPR. Transparency about these purposes is one of our fundamental obligations to you, and a right you fully exercise when interacting with our service.

Service delivery

Data collected during the questionnaire, the uploaded documents, and payment data are processed for the performance of the contract for the Assessment service. Legal basis: contract performance (Article 6.1.b GDPR).

Follow-up communication

Your email and WhatsApp number are used to send you the questionnaire result, the final Assessment, and to answer your questions during the 30 days of follow-up included. Legal basis: contract performance (Article 6.1.b GDPR).

AI-assisted strategic analysis

Your questionnaire responses are transmitted in pseudonymized form (without your full name — only first name and case-specific data) to our AI provider Anthropic, for the generation of the preliminary diagnostic. Legal basis: contract performance (Article 6.1.b GDPR).

Security and fraud prevention

Your IP address, user-agent, and certain browsing behaviors are processed to detect abuse attempts, prevent payment fraud, and protect the integrity of our service. Legal basis: legitimate interest of the controller (Article 6.1.f GDPR).

Accounting and tax obligations

Invoices and related accounting data are retained for 10 years in accordance with French law. Legal basis: legal obligation (Article 6.1.c GDPR).

Analytics and targeted advertising

If you have given express consent via our cookie banner, certain browsing data is shared with our analytics and advertising partners (Meta Platforms). Legal basis: consent (Article 6.1.a GDPR), revocable at any time.

Your personal data is processed exclusively by the Cittadinanza Desk team and by a limited number of carefully selected technical subprocessors. These subprocessors act on our instructions, under contracts complying with the requirements of Article 28 of the GDPR, and implement appropriate technical and organizational measures to safeguard your data.

We do not sell, rent, or transfer your personal data to third parties for commercial purposes. The only disclosures to third parties take place within the purposes listed in the previous section, and always with your knowledge.

• Vercel Inc. (San Francisco, USA — European data centers in Frankfurt, Germany): technical hosting of the website and our APIs.
• Supabase Inc. (San Francisco, USA — Frankfurt, Germany data center): relational database and storage of uploaded files.
• Stripe Payments Europe Ltd. (Dublin, Ireland): payment processing and PCI-DSS Level 1 certification.
• Resend Inc. (San Francisco, USA — eu-west-1 Ireland data center via AWS SES): delivery of transactional emails (confirmation, Assessment).
• Anthropic PBC (San Francisco, USA): generation of the preliminary diagnostic using the Claude AI model, on pseudonymized data.
• Meta Platforms Inc. (Menlo Park, USA, via the Conversions API): advertising analytics, only with your marketing consent.
• Upstash Inc. (Frankfurt, Germany data center): anti-fraud rate limiting.

The comprehensive, up-to-date list of our subprocessors, together with the underlying processing agreements, can be provided upon a reasoned request at dpo@cittadinanzadesk.com.

Some of our subprocessors are headquartered outside the European Union, in particular in the United States. This applies notably to Anthropic (AI analysis) and Meta Platforms (advertising analytics). These transfers are subject to a strict legal framework in accordance with Chapter V of the GDPR.

For transfers to Anthropic, we rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission in its Implementing Decision 2021/914 of 4 June 2021. These clauses require Anthropic to apply a level of protection of personal data equivalent to that prevailing in the European Union. In addition, the data transmitted to Anthropic is pseudonymized before sending: it does not include your surname, your physical address, or directly identifying elements beyond your first name and the case-specific details required for analysis.

For transfers to Meta Platforms, we rely concurrently on the Standard Contractual Clauses and on Meta’s participation in the Data Privacy Framework (DPF) adopted by the European Commission in July 2023, which recognizes an adequate level of protection for EU–US data flows with certified organizations.

You have the right to obtain a copy of the contractual safeguards framing these transfers, pursuant to Article 46 of the GDPR, by sending a reasoned request to dpo@cittadinanzadesk.com.

We do not retain your personal data beyond what is necessary for the purposes for which it was collected. The retention period varies depending on the category of data and the legal basis for processing.

Active customer data

Retained for the duration of the commercial relationship, then for 24 months following the last significant interaction, in order to respond to your subsequent questions and to maintain a coherent case history.

Assessment case documents

Uploaded supporting documents (civil-status records, certificates, etc.) are retained for 24 months following delivery of the Assessment, for the legal security of the case file and to allow follow-up consultation if your case evolves.

Invoices and accounting data

Retained for 10 years in accordance with Article L123-22 of the French Commercial Code, under our statutory accounting obligations.

Anonymized technical logs

Retained for a maximum of 12 months for security and incident-diagnostic purposes.

Cookies

The retention period for each cookie is set out in our Cookie Policy. Analytics and advertising cookies are retained for a maximum of 13 months in line with CNIL guidance.

At the end of these periods, your data is securely deleted or irreversibly anonymized. Certain data may be retained beyond these periods in the event of ongoing litigation, until final resolution.

As a data subject, you have a set of rights guaranteed by the GDPR. These rights may be exercised without justification, free of charge, and at any time.

• Right of access (Article 15): obtain confirmation that data concerning you is being processed and obtain a copy of that data.
• Right to rectification (Article 16): obtain correction of inaccurate data or completion of incomplete data.
• Right to erasure, also known as the right to be forgotten (Article 17): obtain deletion of data concerning you, under specific conditions (data no longer necessary for the purpose, withdrawal of consent, legitimate objection, etc.).
• Right to restriction of processing (Article 18): obtain temporary suspension of processing while a request is being examined (for example, while a rectification request is being reviewed).
• Right to portability (Article 20): receive the data you have provided in a structured, commonly used, machine-readable format, and transmit it to another controller.
• Right to object (Article 21): object at any time, on grounds relating to your particular situation, to processing of your data based on legitimate interest or public interest.
• Right to withdraw consent (Article 7): where processing is based on your consent, withdraw it at any time, without affecting the lawfulness of prior processing.

To exercise any of the rights listed in the previous section, please send us an email at dpo@cittadinanzadesk.com, clearly indicating the right you wish to exercise and providing proof of identity (a copy of an official identity document, partially masked except for the surname, first name, and date of birth).

This identity verification is necessary to protect your data against any fraudulent access attempts by third parties. The supporting document provided will be destroyed as soon as verification is complete.

We will respond without undue delay and in any event within one month of receipt of the request, in accordance with Article 12.3 of the GDPR. This period may be extended by two additional months for complex requests or where requests are numerous; in that case, we will inform you within the first month.

If, after contacting us, you believe that your rights have not been respected, you have the right to lodge a complaint with the competent supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. As a citizen of an EU Member State, you may also choose the supervisory authority of your country of residence.

Our site uses cookies and similar technologies (localStorage, sessionStorage) to ensure the technical operation of the service, improve the user experience, measure audience, and — subject to your consent — optimize our advertising campaigns.

Cookies essential to the operation of the site are placed automatically and do not require consent. Analytics and advertising cookies require your express consent, given via our cookie banner on your first visit. You can change your choice at any time by clicking the "Manage cookies" link present in the site footer.

See our detailed Cookie Policy

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental disclosure, loss, alteration, or destruction. These measures are reviewed and updated regularly to keep pace with evolving threats and industry best practices.

In particular, all traffic to our site is encrypted using HTTPS (TLS 1.3). Data stored in our database is protected by strict access controls, and access to personal data is limited to staff with a legitimate need-to-know in the course of their duties. Passwords are hashed using robust cryptographic algorithms; banking data is never stored on our servers.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with Article 34 of the GDPR, and we will notify the breach to the CNIL within 72 hours in accordance with Article 33.

This Privacy Policy may be updated periodically to reflect changes in our processing activities, services, or the applicable legal framework. The date of the last update is shown at the top of the document.

In the event of a material change affecting your rights or the purposes of processing, we will inform you by email before the new provisions take effect, and offer you the opportunity to exercise your rights before the changes apply.

For any question relating to this Privacy Policy or the processing of your personal data, you can contact us at dpo@cittadinanzadesk.com.

For any complaint, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) or with the competent supervisory authority of your country of residence within the European Union.

Official CNIL page — rights and complaints