Privacy policy

1. Who we are

This website is operated by Corviado Ltd, a company registered in England and Wales (company number 17098795). Our registered office is 3rd Floor, 86-90 Paul Street, London, EC2A 4NE.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Corviado Ltd is the data controller. You can contact us at privacy@corviado.com.

2. What this site does

This is an independent directory of Italian citizenship service providers serving the United Kingdom. We compile information from publicly available sources and present it in a structured format. We do not sell services, process payments, or create user accounts on this site.

3. Data we collect

We collect very little personal data. Specifically:

We do not ask for special category data: health, religion, political opinions, biometric data, or criminal records. No field on this site requests any of it. The free-text boxes on the contact form and the route tool are yours to write in, so something of that kind can reach us anyway. Where it does, we use it only to answer you and we do not copy it anywhere else. If you would rather it were not in our inbox, tell us and we will delete it. This paragraph used to say flatly that we do not collect such data, which was a promise about what other people type. We do not collect data from children. We do not create user accounts or profiles.

3a. Information about other people

The route tool asks which generation your Italian connection sits in, whether descent passes through a mother or a father, and whether an ancestor naturalised. Those are facts about your parents, grandparents and great-grandparents. If you choose to send your result, we receive them, and those people have not visited this site and will usually not know we hold anything.

So: we use it only to answer you, we never contact anyone named or described in it, we do not add it to anything, and it is deleted with the rest of your message. You can also use the tool without any of this reaching us. It works out your route in your browser and shows it to you there; sending it is a separate step you have to take.

4. How we use your data

5. Lawful basis

We process personal data under Article 6(1)(f) of the UK GDPR (legitimate interests). Our legitimate interest is operating this directory, responding to enquiries, and maintaining site security. Given the minimal data we collect and the low privacy impact, we consider this proportionate. You can object to processing based on legitimate interests at any time (see “Your rights” below).

For information about listed providers specifically, we have conducted a legitimate interest assessment. The legitimate interest is providing the public with transparent, independently verifiable information about professional services in a market with no industry regulator or independent comparison resource. This interest is necessary because there is no less intrusive means of providing this transparency. The information is already public, and we link to the original sources. The balance favours publication because the data relates to professional business activities, not private life, and the public interest in informed decision-making about professional services is significant.

A data protection officer is not required under Article 37 of the UK GDPR given the nature and scale of our processing. The privacy contact (privacy@corviado.com) serves as the designated point of contact for all data protection matters.

6. Who we share data with

We share personal data only with service providers who help us operate this site:

Both providers process data as processors on our behalf. Data reaches the United States, and the mechanism we rely on for that is contractual: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which our processors' data processing agreements incorporate by reference. Those agreements also state participation in the UK Extension to the EU-US Data Privacy Framework.

We name the contractual route first on purpose. A Data Privacy Framework certification is renewed each year and can lapse without anyone here being told, which would turn a true sentence on this page into a false one silently. The Addendum does not work that way. We have also not independently confirmed either processor on the Framework's public list: it is published through an interface that will not answer an automated request, so what we have is each processor's own statement in its agreement, and we would rather say that than imply we checked.

We do not sell, rent, or trade your personal data. We do not share data with advertisers or marketing platforms. We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.

7. Data retention

Messages sit in the directory inbox. We delete anything older than twelve months when we review it, and we delete anything at all on request, usually the same week. That review is done by hand rather than by a rule that runs on its own, so twelve months is the standard we hold ourselves to and not a switch that flips. This page used to say the data "is deleted" after the period, which described a mechanism that does not exist. Server log retention is set by our hosting provider and not by us, so the figure here is theirs to change.

8. Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, email privacy@corviado.com. We will respond within 30 days.

9. Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at privacy@corviado.com.

10. Changes to this policy

We may update this policy from time to time. Material changes will be indicated by updating the “last updated” date at the top of this page. We do not collect sufficient data to notify you individually of changes, so we encourage you to review this page periodically.

11. Information about listed providers

This directory contains business information about Italian citizenship service providers. This information is sourced from publicly available records including provider websites, Companies House, the SRA Register, and public review platforms. It relates to businesses and professional services, not to private individuals.

Where a listed provider is a sole trader or named individual, we process their business name and professional contact details under Article 6(1)(f) (legitimate interests). Our legitimate interest is providing accurate, publicly verifiable information about professional services. Providers can request corrections of factual inaccuracies by contacting us at privacy@corviado.com with the specific information to be corrected and a verifiable source. Factual information sourced from public records is retained as part of the directory's public interest function.

Processing provider data is also carried out for journalistic purposes within the meaning of Schedule 2, Part 5 of the Data Protection Act 2018. This exemption applies to the extent that publication is in the public interest and compliance with certain data protection provisions would be incompatible with those purposes.