Privacy notice
Version 2 · published on 12 September 2026
Privacy notice
Provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003. Version of 12 September 2026. The Italian text is the binding one; this English version is a courtesy translation.
This notice covers the website moving2italy.com, its simulators, bookings, purchases and the Illico reserved area made available to clients.
1. Data controller
The data controller is Moving2 S.r.l., registered office at Piazza Santissima Trinità 2, 20154 Milan, Italy, VAT and tax code 13114100962, certified e-mail moving2@pec.it.
For any request about your data, write to support@moving2italy.com. We have not appointed a data protection officer (DPO), because the law does not require one for our activity.
2. What data we process and where it comes from
2.1 Data you give us
- Identity and contact data: first name, last name, e-mail, phone, address, country of residence, nationality, language.
- Tax and civil-status data: Italian tax code, VAT number, date and place of birth, identity document details, AIRE registration, marital status and household composition when you extend a service to family members.
- Financial and employment data: type of work, employer, income, financial assets and property in Italy and abroad, years of residence abroad: the data needed to check eligibility for tax benefits and to prepare returns and applications.
- Documents you upload to the reserved area: identity documents, employment contracts, payslip certificates, bank statements, deeds, company extracts and any other document requested by the consultant.
- Deeds you sign: professional engagement, anti-money-laundering declaration (Art. 22 of Legislative Decree 231/2007), checklists and self-certifications.
- Booking data: date and time of the consultation, consultant chosen, notes you leave when booking.
- Communications: the messages you exchange with us and with the consultants through the reserved area, e-mail or the forms on the site.
- Simulator data ("Tax calculation" and "Eligibility check"): the answers you enter (income, costs, work and family situation, years abroad). They are processed to produce the result you see on screen; we do not ask for your name to use them.
2.2 Payment data
Payment takes place on Stripe's page, which collects your card details directly. We do not see or store them: we only receive the outcome, the amount, the last four digits of the card and the transaction identifier.
2.3 Data collected automatically
When you visit the site, our systems record IP address, date and time, pages visited, browser and device type, and the identifiers of the cookies you have consented to. Cookies and measurement tools are described in the cookie policy, where you can also change your choices.
2.4 Data from other sources
To perform the services, consultants may obtain data from public sources or from public administrations on your behalf (for example the Revenue Agency's tax drawer, Chamber of Commerce extracts, the civil registry), always under the engagement you signed.
3. Why we process data and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Sale and performance of the services: purchase, activation of the reserved area, eligibility check, returns, applications, consultations, support | Identity, tax, financial data, documents, deeds, bookings, communications | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and 10 years afterwards for civil and tax obligations |
| Legal obligations: invoicing, accounting, anti-money-laundering, replies to authorities | Identity, tax data, identity document, signed deeds | Legal obligation (Art. 6(1)(c) GDPR) | 10 years from the end of the relationship (Art. 2220 Italian Civil Code; Art. 31 Legislative Decree 231/2007) |
| Simulators on the site | Financial and family data entered | Performance of what you request (Art. 6(1)(b)) | Not linked to you and not kept beyond the session, unless you leave us your contact details |
| Booking of consultations and reminders | Contact details, date and time, notes | Performance of the contract (Art. 6(1)(b)) | As contract data |
| Security of the site and the reserved area: access logs, abuse prevention, form protection | Automatically collected data, reserved-area access logs | Legitimate interest (Art. 6(1)(f)) in protecting systems and client data | Logs for 12 months |
| Service communications: confirmations, deadlines, notices about the contract | Contact details | Performance of the contract (Art. 6(1)(b)) | For the duration of the relationship |
| Newsletter and marketing communications about services and regulatory news | Name, e-mail | Consent (Art. 6(1)(a)), which you can withdraw at any time from the link in every e-mail | Until withdrawal, and in any case no longer than 24 months from your last interaction |
| Communications to existing clients about services similar to those purchased | Legitimate interest (Art. 130(4) Italian Privacy Code), with the right to object at any time | Until you object or the relationship ends | |
| Measurement and improvement of the site | Browsing data, usage events | Cookie consent (Art. 6(1)(a)) | See cookie policy |
| Defence of our rights in the event of disputes | The data relevant to the dispute | Legitimate interest (Art. 6(1)(f)) | For the duration of the dispute and the limitation periods |
Providing the data needed to perform the services and to comply with legal obligations is essential: without them we cannot activate the service or must stop it. The newsletter and non-essential cookies are optional.
4. Who sees your data
4.1 Staff and consultants
Your data are processed by authorised Moving2 staff and by the consultants (chartered accountants, lawyers and other licensed professionals) who perform the service you purchased. In the reserved area each consultant sees only the clients they follow. For the obligations that the law places directly on them, such as anti-money-laundering and professional-conduct duties, consultants act as independent controllers.
4.2 Suppliers (processors)
We use suppliers that process data on our behalf under a contract pursuant to Art. 28 GDPR:
| Supplier | What it does for us | Where it processes data |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the site and of the Illico reserved area, database and document storage, backups | European Union (Frankfurt) |
| Stripe Payments Europe Ltd | Payments and subscriptions. For card data Stripe is an independent controller, under its own privacy policy | European Union; possible transfers to the United States with the safeguards in section 5 |
| Brevo (Sendinblue SAS) | Sending transactional e-mails (confirmations, reminders, credentials) and the newsletter | European Union |
| Google Ireland Ltd (Google Workspace, Google Meet, Google Calendar) | Staff e-mail, video calls for consultations, consultants' calendars | European Union; possible transfers to the United States with the safeguards in section 5 |
| Zoho Corporation | Management of consultation bookings, while in use | European Union |
| TaxDemocracy | Calculation engine of the simulators: it receives only the financial values entered, never identifying data | European Union |
| Google Ireland Ltd (Tag Manager, Analytics) | Visit measurement, only with your cookie consent | European Union and United States |
| Mixpanel Inc. | Analysis of site usage, only with your cookie consent | United States, with the safeguards in section 5 |
| Cybot A/S (Cookiebot) | Collection and record of cookie consent | European Union |
| Google Ireland Ltd (reCAPTCHA) | Protection of the site's forms against automated submissions | European Union and United States |
| Trustpilot A/S | Displays reviews on the site; if you choose to leave one, Trustpilot processes your data as an independent controller | European Union |
The up-to-date list of suppliers is available on request to support@moving2italy.com.
4.3 Other recipients
Where needed to perform the services or to comply with the law, data may be disclosed to: the Italian Revenue Agency, INPS, Chambers of Commerce, municipalities, police headquarters, consulates and other public bodies; banks, for transfers; legal advisers and insurers, in the event of disputes; judicial and supervisory authorities, when they require it. We do not sell your data and do not pass them to third parties for their own marketing.
5. Transfers outside the European Union
Data are stored in the European Union. Some suppliers (Stripe, Google, Mixpanel) may transfer data to the United States: in such cases the transfer relies on the adequacy decision for the EU-US Data Privacy Framework, where the supplier is certified, or on the standard contractual clauses approved by the European Commission, with additional measures where appropriate. You may ask us for a copy of the safeguards applied.
6. How long we keep data
Retention periods are shown in the table in section 3. In short: contract data and tax documents are kept for 10 years after the end of the relationship, for legal obligations and so that we can give you a copy; security logs for 12 months; newsletter data until you withdraw consent; simulator data are not kept beyond the session. When the periods expire, data are deleted or anonymised. Documents uploaded to the reserved area remain downloadable for 90 days after the service ends; afterwards you can request a copy.
7. How we protect data
The Illico reserved area is developed and operated by Moving2 and hosted in the European Union (AWS, Frankfurt). Data travel encrypted (TLS); the documents you upload are kept in a storage separate from the database, encrypted at rest, and the database has automatic daily backups. Staff and consultant access is role-based: each consultant can see only what is needed to follow their own clients. Two-factor authentication and passkeys are available for access to the reserved area.
No system is invulnerable: should a data breach occur that entails a high risk for you, we will inform you without undue delay, as required by Art. 34 GDPR.
8. Your rights
At any time you may ask us for:
- access to your data and a copy of them;
- rectification of inaccurate or incomplete data;
- erasure, when the data are no longer necessary or you withdraw consent, unless we must keep them under a legal obligation;
- restriction of processing in the cases provided for by Art. 18 GDPR;
- portability: receiving the data you gave us in a structured, commonly used format;
- objection to processing based on legitimate interest, and at any time to marketing communications;
- withdrawal of consent, without affecting the lawfulness of processing already carried out.
Write to support@moving2italy.com. We reply within one month, extendable by two months in complex cases; if we cannot recognise you, we may ask you to verify your identity. If you believe the processing breaches the law, you may lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the supervisory authority of your State of residence, or bring the matter before a court.
9. Automated decisions and minors
We do not take decisions based solely on automated processing that produce legal effects on you. The site's simulators provide an indicative calculation, not a decision. The services are reserved for adults; data about minor children are processed only when you, as a parent, provide them for a service that concerns them (for example family reunification or tax deductions).
10. Cookies
The site uses technical cookies, which are necessary for it to work, and, only with your consent, measurement and third-party cookies. The full list, retention periods and the panel to change your choices are in the cookie policy.
11. Changes to this notice
We update this notice when processing, suppliers or the law change. The version in force is always the one published at this address, with the date at the top; previous versions are archived and available on request. If a change materially affects active clients, we notify them by e-mail.