Privacy Policy

Last updated: 8 September 2026

At CM Italian, I take your privacy and the security of your personal data very seriously. This Privacy Policy outlines how I, Carla Morra, collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

For the purposes of the UK GDPR, the Data Controller is: Carla Morra (trading as CM Italian) Email: contact@cmitalian.co.uk Website: www.cmitalian.co.uk

If you have any questions regarding how your data is handled, please contact me directly at the email address above.

2. What Personal Data Do I Collect?

To provide professional and certified translation services, I collect the following types of information:

• Contact Information: Your name, email address, phone number, and postal address (if physical copies of translations are required).

• Document Data: The personal, financial, or sensitive information contained within the documents you submit for translation (e.g., birth and marriage certificates, police clearance checks, academic transcripts, or legal decrees).

• Technical Data: Information collected automatically when you visit my website, such as your IP address and standard website analytics via cookies.

3. Why Do I Collect Your Data? (Lawful Basis)

I will only collect and process your data when there is a lawful basis to do so. These include:

• Contractual Necessity: To provide you with a quote, translate your documents, and deliver the final certified translations to you.

• Legal Obligation: To keep financial and administrative records (such as invoices) for HM Revenue & Customs (HMRC).

• Legitimate Interests: To reply to your enquiries and communicate with you effectively regarding your project.

4. How Do I Protect Your Data?

Handling highly sensitive official documents requires strict confidentiality.

• All digital files and emails are hosted on secure, encrypted servers.

• My work devices are password-protected and updated regularly with standard security and anti-virus software.

• I never share, sell, or distribute your personal documents or contact details to third parties unless required by law, or unless strictly necessary to fulfil our contract (for example, providing your name and address to Royal Mail to post your physical documents).

5. How Long Do I Keep Your Data?

I will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected:

• Translated Documents and Source Files: Retained securely for 6 months after the delivery of the final translation. This allows for any follow-up queries, revisions, or requests for additional printed copies. After this period, the files are permanently and securely deleted from my systems.

• Financial Records: Invoices and payment records are kept for 6 years to comply with UK tax law (HMRC requirements).

6. Use of Cookies

This website is hosted via Google Sites, which uses standard cookies to ensure the site functions properly and to help analyse basic web traffic. These cookies do not give me access to your computer or any personal information about you, other than the data you explicitly choose to share with me. You can modify your browser settings to decline cookies at any time.

7. Your Data Protection Rights

Under the UK GDPR, you have several rights regarding your personal data, including:

• The Right to Access: You can request a copy of the personal data I hold about you.

• The Right to Rectification: You can ask me to correct any inaccurate or incomplete information.

• The Right to Erasure (Right to be Forgotten): You can request that I delete your personal data (subject to legal obligations, such as retaining invoices for HMRC).

• The Right to Restriction of Processing: You can ask me to limit how I use your data.

To exercise any of these rights, please email me. I will respond to all requests within 30 days.

8. Complaints

If you feel that your personal data has not been handled appropriately, please contact me first so I can resolve the issue. You also have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).