What I hold, and how to make me delete it

Last updated: 25 September 2026

This explains what personal data I hold, where I got it, what I do with it, and how to make me delete it. If you only want the last part, it’s in “Your rights” below, or just reply to any email from me with “stop”.

Who is responsible for your data

DropoffAudit is operated by Luca Panetto, an individual based in Italy. I am the data controller, which means I decide what data is held and why.

• Postal address: Via Cesare Battisti 88, 12045 Fossano (CN), Italy
• Email: luca@dropoffaudit.me

What data I hold

For people I contact about an audit, the data is limited to business contact information:

• Your name and job role
• Your work email address
• Your business name and its website address
• Publicly listed business details such as the practice’s city or phone number
• Whether you opened or replied to an email I sent, and whether you asked me to stop

If you buy an audit, I also hold the details of that purchase. I never see or store your card number. Payment is handled entirely by Stripe.

I do not seek out or hold special-category data, and I do not collect data about your patients. An audit examines your public website only; I have no access to any booking or patient system.

If you leave your email address on the home page to receive the audits I publish, I hold that address and the date you gave it to me. Nothing else is asked for.

Where I got it

Because most people I contact never gave me their details directly, I am required to tell you where they came from. It is one or more of these:

• Your business website and its publicly published contact pages
• Public business listings and directories
• You, if you typed your email address into the form on the home page

Why I am allowed to use it, and what I use it for

I rely on legitimate interests under Article 6(1)(f) of the EU GDPR. My interest is contacting businesses that may want a service I offer. I have weighed this against your privacy: the data is professional rather than personal, the volume is small and each message is written and sent individually, the contact relates directly to your own business, and you can stop it permanently with a one-word reply.

I use the data to:

• Send you an individually written audit of your website, and one follow-up at most if you don’t reply
• Answer you if you write back
• Deliver and support an audit you have paid for
• Keep a record of anyone who has asked not to be contacted, so I don’t contact them again

The email list on the home page works on consent, under Article 6(1)(a) of the GDPR: you gave me the address, and I use it for one thing, sending you each published audit when it comes out. Every message carries a way to stop, and one word by email does the same.

Where the law requires consent instead of legitimate interests, I ask for it. I do not sell, rent or share your data for anyone else’s marketing.

Who else sees your data

A small number of service providers process data on my behalf, under contract and only on my instructions:

• Zoho Mail: sending and receiving email
• Stripe: payments. Stripe is the controller of your payment data and holds it under its own privacy policy
• GitHub Pages: hosting for this website. GitHub receives your IP address when the page loads
• Formspree: receives the email address you type into the form on the home page and passes it to me. Formspree is based in the United States and holds the submission under its own privacy policy
• Google Analytics: counting visits to this website, only if you accept analytics cookies. See “Cookies and analytics” below

Some of these are based outside the European Economic Area, mainly in the United States. Where that is the case, transfers rely on the European Commission’s Standard Contractual Clauses, the EU-U.S. Data Privacy Framework (Google LLC has certified under it), or an equivalent approved safeguard.

How long I keep it

• If you don’t reply: your details are deleted within 12 months of the last message I sent you.
• If you ask me to stop: I delete everything except your email address, which I keep on a suppression list indefinitely. That record exists only so I never contact you again, and it is never used for anything else.
• If you buy an audit: I keep the records for as long as Italian tax and accounting law requires, currently ten years.
• If you joined the email list: I keep your address until you ask to stop, then I delete it from the list and keep only the suppression record described above.

Your rights

You can ask me to:

• Show you what data I hold about you
• Correct anything wrong
• Delete it
• Restrict how I use it, or provide it in a portable format
• Object to my using it at all. Where I rely on legitimate interests, including for direct marketing, I must stop when you object to marketing

If you think I’ve handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live. I’d rather you told me first so I can fix it.

Cookies and analytics

When you first visit, a banner asks whether you accept analytics cookies. Nothing from Google Analytics loads until you press Accept. Reject, or closing the banner with the X, means no.

• Your choice itself is saved in your browser’s local storage, not in a cookie, so the banner doesn’t ask again on every page. It is kept for 6 months, then the banner asks again. It never leaves your browser.
• If you accept, Google Analytics sets two cookies, _ga and _ga_ followed by an ID, which by Google’s default expire after 2 years. They tell me which pages were read, how visitors arrived (for example from a link on X or a search), the approximate location and the type of browser and device. Google states that it does not log or store the IP addresses of visitors in the EU, the UK and Switzerland.
• Nothing is used for advertising. The site tells Google that advertising storage and advertising use of the data are refused, whatever you choose.
• I keep the analytics data in Google Analytics for 2 months.

The legal basis for analytics cookies is your consent, under Article 6(1)(a) of the GDPR and the Italian rules on cookies. You can change your mind at any time with the Cookie settings link at the bottom of every page. If you withdraw consent, the site deletes the Google Analytics cookies it had set.

The typeface is served from this website itself. No font is loaded from Google or any other outside service.

If a link in one of my emails records that it was clicked, I say so in that email.

Changes

If I change this notice I’ll update the date at the top. If a change materially affects people already in my records, I’ll tell them directly.