Privacy & cookies.
Notice on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”), as amended by Legislative Decree 101/2018. In case of discrepancies, the Italian version prevails.
In short
- We process your data only to reply to your requests and, if you become a client, to manage our relationship with you.
- This website does not use profiling or analytics cookies and shows no advertising.
- Visit statistics are anonymous, collected on our own server and without third-party services.
- We do not sell or transfer your data to third parties for marketing purposes.
- You can exercise your rights at any time by writing to info@thinktradefinance.com.
1. Data controller
The data controller is Think Trade Finance Srl, registered office at Via Montenapoleone, 8, 20121 Milan, Italy, VAT no. IT12516840969.
- Email: info@thinktradefinance.com
- Phone: +39 02 3031 6600
The controller has not appointed a Data Protection Officer (DPO), as it is not required to do so under Art. 37 GDPR. For any question about your data you can write to the email address above.
2. What data we process
a) Data you provide
When you fill in the contact form we collect: first name, last name, company, email address, phone number (optional), service of interest and the text of your message. We also process the data you share with us by email, by phone or in a meeting, such as your role in the company and information about your project.
Please do not include unnecessary data in the form, in particular health data, criminal records or other special categories of data (Arts. 9 and 10 GDPR).
b) Data collected while browsing
Server logs. Like all websites, the server hosting this site automatically records some technical information needed for its operation and security: IP address, date and time of the request, page requested, response code, browser type and operating system. These logs are managed by the hosting provider and are not used to identify you.
Anonymous visit statistics. To understand how the website is used, we run a statistics system installed on our own server, without cookies and without third-party services. For each page we record: the page visited, the referring website (for example a search engine or social network), any campaign parameters in the link, device type, browser and operating system, site language, country estimated from the browser's time zone, time spent on the page, how much of the page was read, and actions such as clicking the phone number, email or contact button, or submitting the form.
Your IP address is not stored in the statistics: it is used only for an instant, together with your browser and a random code that changes every day, to compute an encrypted fingerprint. This fingerprint lets us count the unique visitors of the day but cannot be used to identify you or to recognise you on later days.
c) Data of clients and prospective clients
If, after the first contact, you decide to engage us (for example for corporate financing, a factoring transaction or an outsourcing service), we will also process the data needed to provide the service, such as company, economic and financial data and the details of its contact persons. Where necessary, we will provide a specific privacy notice for these activities at contract stage.
3. Purposes and legal bases
| Why we process data | Legal basis |
|---|---|
| Replying to your requests, contacting you back and arranging a meeting or introductory call | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) |
| Assessing and proposing the services requested, preparing an offer and, if you engage us, managing the contractual relationship | Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) |
| Complying with legal obligations, for example accounting and tax requirements | Legal obligation (Art. 6(1)(c) GDPR) |
| Ensuring the operation and security of the website and preventing abuse (server logs, protection of the restricted area) | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Producing anonymous, aggregated statistics to improve the website and its content | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Establishing, exercising or defending legal claims | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
Our legitimate interest has been balanced against your rights: statistical data is anonymous and minimised, and server logs are used only for the operation and security of the service. You can nevertheless object to this processing as described in section 9.
We do not use data collected through this website to send you marketing communications or newsletters without your specific consent, and we do not carry out profiling or decisions based solely on automated processing.
4. Provision of data
Providing your data through the contact form is optional. However, the fields marked as required are necessary to reply to your request: without them we will not be able to contact you. Browsing data and anonymous statistics are collected automatically while you use the website.
5. Methods and security
Data is processed electronically by authorised and trained staff, with technical and organisational measures appropriate to protect it against unauthorised access, loss or disclosure, including:
- encrypted HTTPS connection across the whole website;
- restricted, password-protected access to the statistics area, with encrypted passwords and automatic lock after repeated failed attempts;
- a statistics data folder that cannot be accessed from the web;
- access to data limited to the people who need it for their work.
6. Who we share data with
Data is not disclosed to the public or transferred to third parties for their own purposes. It may be processed, only to the extent necessary, by:
- Technical service providers acting as data processors (Art. 28 GDPR) under agreements ensuring confidentiality and security:
- Aruba S.p.A. (Italy): website hosting and server logs;
- Web3Forms: receipt of messages sent with the contact form and forwarding to our mailbox;
- Google Ireland Ltd (Google Workspace): business email service;
- Cloudflare, Inc.: redirection from our former domain thinktradefinance.org to the current website.
- Professionals and advisors of the controller (for example accountants and lawyers), bound by professional secrecy, when necessary.
- Partners involved in providing the services, only if you engage us and to the extent necessary:
- for outsourcing services, Consorzio Obiettivo Valore, our partner;
- for financing and factoring, the banks, financial institutions and factoring companies to which we submit your request, which will process the data as independent controllers under their own privacy notices.
- Public authorities, when required by law or by an order of the authorities.
The updated list of data processors is available on request.
7. Transfers outside the European Union
Some of the providers listed in section 6 (in particular Google, Cloudflare and Web3Forms) may also process data outside the European Economic Area, for example in the United States. In such cases the transfer takes place only with the safeguards required by Arts. 44 et seq. GDPR: an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework, for participating providers) or standard contractual clauses approved by the Commission. You can ask us about the safeguards in place by writing to info@thinktradefinance.com.
8. How long we keep data
| Data | Retention |
|---|---|
| Contact requests not followed by an engagement | 24 months from the last contact, then deleted |
| Client data and contractual and accounting records | For the duration of the relationship and, after it ends, for 10 years as required by law (Art. 2220 of the Italian Civil Code) |
| Anonymous visit statistics | Up to 25 months, to allow year-on-year comparisons |
| Server logs | For the time strictly necessary, as set by the hosting provider for the operation and security of the service |
| Security data of the restricted area (login attempts) | Up to 24 hours |
Data may be kept longer only where necessary to defend a legal claim or to comply with an order of the authorities.
9. Your rights
As a data subject you can exercise at any time the rights set out in Arts. 15–22 GDPR:
- access: find out whether we process your data and obtain a copy;
- rectification of inaccurate or incomplete data;
- erasure (“right to be forgotten”), where applicable;
- restriction of processing;
- portability: receive the data you provided in a structured, machine-readable format;
- objection to processing based on legitimate interest, on grounds relating to your particular situation;
- withdrawal of consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise them, write to info@thinktradefinance.com. We will reply without undue delay and in any case within one month of your request, a period that may be extended in the cases set out in Art. 12 GDPR. We may ask for information to verify your identity.
If you believe the processing infringes the law, you have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live or work.
10. Cookies and similar technologies
Cookies are small files that a website can store on your device. This website:
- does not use profiling, marketing or analytics cookies, nor third-party cookies;
- does not include embedded third-party content (such as maps, videos or social buttons) that sets cookies: the links to Google Maps, LinkedIn, Facebook and Instagram take you to external websites with their own privacy notices;
- loads fonts and libraries directly from our server, without connections to external services.
The statistics described in section 2.b work without storing anything on your device. For this reason the website does not show a cookie banner: no consent is required, because no cookies or technologies requiring consent under Art. 122 of the Italian Privacy Code and the Italian DPA Guidelines of 10 June 2021 are used.
The only cookie in use is a technical session cookie used exclusively in the restricted statistics area, accessible only to the controller's authorised staff: it is never set for regular visitors. In the same area, authorised staff can save a setting in their own browser that excludes their visits from the statistics.
11. Other information
Minors. Our services are aimed at businesses and are not intended for minors. We do not knowingly collect data of children under 14.
Changes. We may update this notice to reflect changes in the law or in our services. The version in force is always published on this page, with the date of the last update.
Last updated: 26 October 2026