Information that must not be invented.
Legal identity, contacts, infrastructure, suppliers, retention, contracts and payment arrangements must be completed with real, consistent evidence before commercial launch.
Controller / SaaS provider
Legal name, legal form, VAT and business-register details, registered office, support channel and privacy contact or DPO if appointed.
Infrastructure
Hosting and data region, tested backups, subprocessors, transfers outside the EEA and incident-response ownership.
Retention
Documented periods or criteria for accounts, service requests, reviews, security logs, workforce documents and invoices.
Commercial documents
B2B/B2C terms, Article 28 DPA, SLA, licences, data ownership, service exit, billing, refunds and property-specific conditions.
Release gate: The site may remain online as a clearly identified pilot. It must not be described as legally compliant or ready for real data until verification and commercial blockers are closed with evidence.
Primary official sources
GDPR · Regulation (EU) 2016/679EU AI ActItalian Data Protection Authority