EoriPronto
ITApply now

Privacy notice

Last updated: 6 October 2026

This is a translation provided for convenience. In case of discrepancy, the Italian version prevails.

This notice explains how we process the personal data of those who use the EoriPronto website to apply for an EORI number, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003.

1. Data controller

Pasqui Spedizioni Internazionali Srl, Via Btg. Val Leogra 168 – 36100 Vicenza (VI), P.IVA 01710930247. For any privacy-related request you can write to pasquisped@gmail.com.

2. What data we process

  • Applicant data: first name and surname or company name, Italian tax code (codice fiscale), VAT number, date and place of birth, sex, address of residence or registered office, date of incorporation and economic activity (for businesses).
  • Legal representative data (for businesses and associations): first name, surname, Italian tax code.
  • Identity document: images of the front and back and the document details (type, number, issuing authority, expiry date).
  • Chamber of Commerce company extract (visura camerale) (for businesses).
  • Signature drawn on screen on the mandate and on the application form, together with the date, time and IP address at the moment of signing.
  • Contact details: email address and telephone number.
  • Technical browsing data: IP address, browser type, date and time of requests to the website, recorded automatically for security and operational purposes and kept for a limited period.
  • Payment data: handled directly by the payment provider; we do not see or store full card details.

3. Why we process data and on what legal basis

  • Performing the requested service: preparing the application for the assignment of the EORI number, the mandate and the documents, and submitting them to the competent Customs Office (Art. 6(1)(b) GDPR — performance of a contract).
  • Checking whether an EORI number already exists for the VAT number or tax code provided, by querying the European Commission's public service (Art. 6(1)(b) GDPR).
  • Complying with legal obligations relating to tax and accounting in connection with the payment (Art. 6(1)(c) GDPR).
  • Protecting our rights in the event of disputes, by keeping evidence of the mandate received (Art. 6(1)(f) GDPR — legitimate interest).

Providing the data is necessary for the service: without it, we cannot submit the application. We do not use the data for advertising, we do not sell it and we do not carry out profiling or automated decision-making.

4. To whom we disclose data

  • Agenzia delle Dogane e dei Monopoli (ADM, Italian Customs and Monopolies Agency) (the territorially competent Customs Office), as recipient of the application and as an independent controller.
  • European Commission, only the VAT number or tax code, to check whether an EORI number already exists.
  • Technical providers processing data on our behalf as data processors (Art. 28 GDPR): website hosting, document storage (Cloudflare, with data stored in the European Union), email (Google), payment processing.
  • Accounting and tax advisers, and public authorities where required by law.

5. Transfers outside the European Union

Documents are stored in the European Union. Some providers (for example for email) belong to groups headquartered in the United States: in such cases the transfer takes place on the basis of the EU–US adequacy decision (EU-U.S. Data Privacy Framework) or of the standard contractual clauses approved by the European Commission.

6. How long we keep data

  • Identity document, company extract and application data: for the time needed to complete the application and then for 12 months, to handle any requests for clarification from the Customs Office; they are then deleted.
  • Signed mandate and proof of submission: 10 years, for legal protection.
  • Invoicing and payment data: 10 years, as required by tax legislation.
  • Incomplete applications (without payment): deleted within 30 days.

7. Your rights

You may at any time request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to pasquisped@gmail.com. We reply within 30 days. Erasure is not possible for data that we are required by law to retain.

If you believe that the processing infringes the GDPR you may lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (www.garanteprivacy.it).

8. Security

Data travels over an encrypted connection (HTTPS) and documents are kept in a private storage area, accessible only to the staff responsible for the application. Photos of documents are resized and checked directly on your device, without sending them to external analysis services.

9. Cookies

The website only uses technical cookies and tools that are necessary for it to function. We do not use profiling cookies or third-party analytics tools. Should we introduce them in the future, we will ask for your consent beforehand.

10. Changes

We may update this notice; the date of the last update is shown at the top of the page.