Legal

Privacy Policy

How TMG Books collects, uses, and protects your personal data.

Last updated: August 2026

This privacy policy explains how we collect, use, store, and protect your personal data when you visit our website or use our services. It is provided in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Italian Codice in materia di protezione dei dati personali (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018). Our services are provided in both English and Italian.

1. Data controller

The data controller is The Makeover Group (trading as "TMG Books"), P.IVA (VAT number) 07406690482, with registered office at Via di Belvedere 17, 50125 Florence, Italy.

For any questions regarding this privacy policy or the processing of your personal data, contact us at: [email protected].

We have not appointed a Data Protection Officer (DPO) as our processing activities do not fall within the categories requiring such appointment under GDPR Article 37. You may direct all privacy-related enquiries to the email address above.

2. Categories of personal data we collect

We collect personal data that you voluntarily provide through forms and interactions on our website, as well as data collected automatically during your visit.

Data you provide directly

  • Contact and enquiry forms: name, email address, company name, and any information you include in your message.
  • Booking forms: name, email address, company name, business type, team size, and related details needed to prepare for your consultation.
  • Free tools and lead magnets (Bookkeeping Scorecard, Setup Cost Estimator, Payroll Calculator, Deadline Checker, Ditta vs SRL Quiz, case study downloads): name, email address, company name (where requested), and your tool inputs and results.
  • Email subscription: email address.

Data collected automatically

  • Analytics data via Google Analytics 4 (GA4): anonymised usage data including pages visited, session duration, referral source, device type, browser, country, and in-site events (e.g. form submissions, button clicks). GA4 in its default configuration does not collect or store full IP addresses.
  • Technical data via Cloudflare: IP address (for security and DDoS protection), request metadata, and country of origin. Cloudflare processes this data as a data processor on our behalf to deliver its CDN and security services.

We do not collect any special categories of personal data (as defined in GDPR Article 9), such as data concerning health, racial or ethnic origin, political opinions, or biometric data.

3. Purposes and legal basis for processing

We process your personal data for the following purposes, each with a corresponding legal basis under GDPR Article 6(1):

Purpose Legal basis (GDPR Art. 6(1))
Responding to enquiries and booking requests Performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b))
Delivering free tools, scorecards, and downloads you request Consent (Art. 6(1)(a)) -- you submit your data voluntarily to receive the resource
Sending email marketing and follow-up sequences (e.g. newsletters, service updates) Consent (Art. 6(1)(a)) -- you may unsubscribe at any time via the link in every email
Sending service-related communications to existing clients (e.g. deadline reminders, tax updates) Legitimate interest (Art. 6(1)(f)) in keeping clients informed about matters directly related to the services they receive
Website analytics and performance improvement Legitimate interest (Art. 6(1)(f)) in understanding how visitors use our site to improve content and user experience
Website security and protection against abuse Legitimate interest (Art. 6(1)(f)) in protecting our website and users from malicious activity
Compliance with Italian tax, accounting, and legal obligations Legal obligation (Art. 6(1)(c))

Where processing is based on legitimate interest, you have the right to object at any time (see Section 7 below). We do not engage in automated decision-making or profiling as defined in GDPR Article 22.

4. Recipients and data processors

We share your personal data with the following third-party service providers (data processors), solely to deliver the services described above. Each processor is contractually bound to process data only on our instructions and in compliance with the GDPR.

  • Google LLC (Google Analytics 4) -- website analytics. Data is processed in the United States. Google is certified under the EU-US Data Privacy Framework (DPF). Google Privacy Policy.
  • Klaviyo, Inc. -- email marketing and follow-up sequences. Data is processed in the United States. Klaviyo is certified under the EU-US Data Privacy Framework (DPF), with Standard Contractual Clauses (SCCs) as an additional safeguard. Klaviyo Privacy Notice.
  • Web3Forms (Web3Creative) -- form submission processing. Data is transmitted to and stored on servers in the United States (AWS). Form submissions are retained for up to 30 days, then automatically deleted. The transfer is covered by Standard Contractual Clauses. Web3Forms Privacy Policy.
  • Google Calendar (Google LLC) -- appointment scheduling via Google Calendar API. Booking data (name, email, meeting time) is processed through Google Workspace on servers in the United States. Google is certified under the EU-US Data Privacy Framework (DPF). Google Privacy Policy.
  • Hostinger International Ltd -- web hosting. Hostinger is headquartered in Lithuania (EU) and hosts data within the European Economic Area. Hostinger Privacy Policy.
  • Cloudflare, Inc. -- content delivery network and DDoS protection. Data may be processed in the United States and other global locations. Cloudflare is certified under the EU-US Data Privacy Framework (DPF), with Standard Contractual Clauses (SCCs) as a fallback mechanism. Cloudflare Privacy Policy.

We do not sell, rent, or trade your personal data to any third party. We do not share your data with third parties for their own marketing purposes.

5. International data transfers

Some of our data processors are based in the United States, which means your personal data may be transferred outside the European Economic Area (EEA).

For each transfer, we rely on one or more of the following safeguards, as required by GDPR Articles 44-49:

  • EU-US Data Privacy Framework (DPF): where the recipient is certified under the DPF, the transfer is covered by the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795). Google, Klaviyo, and Cloudflare hold active DPF certifications.
  • Standard Contractual Clauses (SCCs): where DPF certification is not available or as an additional safeguard, we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) to ensure an adequate level of data protection.

You may request a copy of the safeguards in place for any transfer by contacting us at [email protected].

6. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Enquiry and booking data: retained for up to 24 months from your last interaction, unless a client relationship is established (in which case data is retained for the duration of the relationship plus 10 years as required by Italian tax and accounting record-keeping obligations under Article 2220 of the Italian Civil Code).
  • Free tool inputs and lead-magnet data: retained for up to 24 months from collection, or until you request deletion, whichever is sooner.
  • Email subscription data: retained until you unsubscribe or request deletion.
  • Analytics data: retained according to Google Analytics 4 settings (14 months), after which it is automatically deleted by Google.
  • Web3Forms submissions: automatically deleted after 30 days by the processor.
  • Cloudflare logs: retained briefly (typically less than 72 hours) for security purposes, then automatically purged.

7. Your rights

Under the GDPR (Articles 15-22), you have the following rights regarding your personal data:

  • Right of access (Art. 15): request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"), subject to any legal retention obligations.
  • Right to restrict processing (Art. 18): request that we limit how your data is processed.
  • Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format, or request that it be transferred directly to another controller.
  • Right to object (Art. 21): object to processing based on legitimate interest. Where you object, we will cease processing unless we demonstrate compelling legitimate grounds.
  • Right not to be subject to automated decision-making (Art. 22): we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
  • Right to withdraw consent (Art. 7(3)): where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your request. If a request is complex or we receive a large number of requests, we may extend this period by up to two additional months, and we will inform you of any such extension.

You also have the right to lodge a complaint with the Italian Data Protection Authority:
Garante per la protezione dei dati personali
Piazza Venezia, 11 -- 00187 Roma
Website: www.garanteprivacy.it
Email: [email protected]

8. Cookies and tracking technologies

Our website uses a limited number of cookies, all related to analytics. We do not use advertising, social-media, or third-party tracking cookies.

Cookie name Provider Purpose Duration
_ga Google Analytics Distinguishes unique visitors 2 years
_ga_* Google Analytics Maintains session state 2 years

Under Italian Garante guidelines and the ePrivacy Directive (2002/58/EC, as transposed into Italian law), analytics cookies that are not strictly necessary require your prior consent. We recommend the use of a cookie consent mechanism to collect this consent before analytics cookies are set.

You can also control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect your experience on our website. Instructions for managing cookies are typically found in your browser's "Help" or "Settings" menu.

9. Security measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with GDPR Article 32. These measures include:

  • Encryption of data in transit via HTTPS/TLS across all pages of our website.
  • DDoS protection and web application security through Cloudflare.
  • Access to personal data restricted to authorised personnel on a need-to-know basis.
  • Use of reputable, security-certified hosting and data-processing providers.
  • Regular review of our data processing practices and security measures.

10. Children

Our services are designed for businesses and professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 16, please contact us at [email protected] and we will promptly delete it.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our data processing practices or applicable law. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Where changes are significant, we will endeavour to notify you by email or by a notice on our website.

12. Governing law

This privacy policy is governed by Italian law and the GDPR. Any dispute arising from or in connection with this policy shall be subject to the exclusive jurisdiction of the courts of Florence, Italy.

13. Contact

If you have any questions about this privacy policy or wish to exercise your data protection rights, contact:

The Makeover Group (trading as TMG Books)
P.IVA 07406690482
Via di Belvedere 17, 50125 Florence, Italy
Email: [email protected]