Privacy policy

Last updated: 19 October 2026

Data controller

The data controller is Yalla Europa di Ammar Shawesh, the sole proprietorship of Ammar Shawesh, Via Vittore Ghislandi 2, 24125 Bergamo (BG), Italy, VAT no. 04163410162. For any privacy matter write to info@yallaeuropa.com or to the certified email address (PEC) yallaeuropa@lamiapec.it.

A Data Protection Officer has not been appointed, because the activity does not require one under Art. 37 GDPR.

Who this notice applies to

This notice applies to everyone who visits www.yallaeuropa.com or contacts us, wherever they are located: in Italy and the European Union, in the Gulf countries, in the Middle East and North Africa or elsewhere.

Because the controller is established in Italy, all processing follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

Data we process

Data you provide in our forms: name, business email, company or organisation, country, website, area of interest and the content of your message, opportunity or proposal.

If you book a call: your name, email, the date and time you choose and any notes, processed through the Google Calendar booking page, and the video call itself if it takes place on Google Meet.

Emails you send to info@yallaeuropa.com or to our PEC address, and our replies.

Technical data needed to deliver the website securely, such as IP address, browser type, date and time and pages requested, recorded in the hosting provider's server logs.

Aggregated visit statistics collected without cookies and without identifying individual visitors, only if this service is activated.

We do not ask for special categories of data (for example health, religion or political opinions). Please do not include them in your messages.

Purposes and legal bases

Answering your requests, scheduling calls and preparing proposals: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).

Managing a professional relationship: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations such as tax and accounting rules (Art. 6(1)(c) GDPR).

Evaluating business opportunities and collaboration proposals you submit: pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in developing business relationships (Art. 6(1)(f) GDPR).

Website security, fraud and spam prevention, and aggregated statistics: legitimate interest (Art. 6(1)(f) GDPR).

Loading external content, namely the booking calendar and the live market widgets: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not send newsletters or marketing emails without your separate, explicit consent.

Service providers and recipients

Your data is processed by the controller and by these providers, acting as processors under Art. 28 GDPR or as independent controllers where stated:

Netlify, Inc. (United States): website hosting and delivery, and receipt of form submissions.

Web3Forms (form-to-email service): forwards the content of the forms you send to our mailbox info@yallaeuropa.com; it does not use the data for its own purposes.

Google Ireland Ltd and Google LLC: appointment booking (Google Calendar) and video calls (Google Meet), only if you book a call.

Plausible Insights OÜ (Estonia, EU): cookie-free statistics, only if this service is activated.

TradingView, Inc.: live market widgets on the Markets page, loaded only with your consent. TradingView acts as an independent controller for the data it collects.

Your data is never sold or used for advertising. It may be disclosed to public authorities where the law requires it, and to professional advisers such as the accountant, who are bound by confidentiality.

International transfers

Some providers, such as Netlify, Google and Web3Forms, may process data in the United States or other countries outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework, where the recipient is certified, or on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

If you contact us from outside the European Union, for example from the Gulf or MENA region, your data is transferred to Italy and the EU, where it is protected by the GDPR.

Retention

Requests that do not lead to a professional relationship are kept for up to 24 months and then deleted. Booking records are kept for the same period. Data relating to contracts is kept as long as the law requires, generally 10 years for accounting records. Server logs are kept for a short period set by the hosting provider.

Your rights

You have the right to access, rectify and erase your data, to restrict processing or object to it, to data portability, and to withdraw consent at any time without affecting earlier processing (Arts. 15–22 GDPR). To exercise these rights, write to info@yallaeuropa.com or yallaeuropa@lamiapec.it. We reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

Visitors from the Gulf, the Middle East and North Africa

We apply the GDPR level of protection to every visitor and contact, whatever their country.

If you are located in a country with its own data protection law, you may also have rights under that law. Examples include the United Arab Emirates (Federal Decree-Law No. 45 of 2021), Saudi Arabia (Personal Data Protection Law), Qatar (Law No. 13 of 2016), Bahrain (Law No. 30 of 2018), Oman (Royal Decree No. 6/2022), Egypt (Law No. 151 of 2020), Jordan (Law No. 24 of 2023), Morocco (Law No. 09-08), Tunisia and Türkiye (Law No. 6698).

You can exercise those rights in the same way, by writing to info@yallaeuropa.com. We will reply within the period required by the GDPR or by your local law, whichever is shorter.

When you send us a form or an email from outside the EU, your data is processed in Italy and by the providers listed above, under the safeguards described in this notice.

Security

The website uses encrypted connections (HTTPS), strict security headers and no third-party tracking code. Access to form submissions and emails is limited to the controller. Your browser stores only your privacy choice and language preference.

Other information

Providing data through the forms is voluntary, but we cannot reply without the required fields. No automated decision-making or profiling takes place. The website is intended for professionals and organisations and is not directed at people under 18.

We may update this notice to reflect changes in the law or in our services. The date at the top shows the latest version.