Privacy
policy

Giovanni Sarchiolla, Reggio Emilia (Italy). To exercise your rights, or for any question about this policy, write to the address below.

The site is static. It has no forms, no private areas and no sign-up, and it asks visitors for nothing.

Three kinds of data are processed. There is the usage data the server records by itself on each visit, the data contained in emails written to the controller and, only if a video is started, the data the browser sends to YouTube. Each activity is described below, with its purpose.

No data is mandatory. Writing to the controller is a choice, and nothing of a person arrives beyond what they decide to write; without an email there can be no reply, but the whole site stays available.

Data is processed with electronic tools and protected by the security measures required by art. 32 of Regulation (EU) 2016/679 (GDPR), so that no one may access, disclose, alter or destroy it without being entitled to. It is never sold or handed over, and it is not used for automated decisions or to profile anyone.

The controller operates in Italy. The providers listed for each activity may store data outside the European Economic Area as well, and where they do the transfer relies on the safeguards stated for that activity.

Data is kept for as long as the purpose it was collected for requires, stated activity by activity. After that it is deleted.

Each activity has a single purpose and rests on a legal basis under art. 6 GDPR.

Running and securing the site

System logs · legitimate interest (art. 6(1)(f))

Replying to enquiries

Email · pre-contractual steps and legitimate interest (art. 6(1)(b) and (f))

Showing videos

YouTube · consent (art. 6(1)(a))

As with any website, the server hosting it records the technical details of every request. They keep the site running and protect it from abuse; they are not used to identify anyone and are never cross-referenced with other information. You may object at any time, giving your reason.

Provider

Netlify, Inc., data processor

Data processed

IP address, browser and device type, date, time and page requested

Legal basis

Legitimate interest of the controller

Place

United States · European Commission standard contractual clauses

Retention

The short period set by the provider, then automatic deletion

Whoever writes to the controller’s address shares the data contained in the message, which serves only to reply and, should a collaboration follow, to carry it forward.

Provider

Google Ireland Limited (Gmail)

Data processed

Name, email address and whatever the message contains

Legal basis

Pre-contractual steps requested by the data subject and legitimate interest in replying

Place

Ireland; any transfer to the United States falls under the EU–US Data Privacy Framework

Retention

As long as it takes to reply and, should work follow, to document it

Some project pages carry a short video hosted by YouTube, the only content that comes from outside. Until it is started, an image belonging to the site stands in its place. The player loads in two cases only. The first is consent given by answering the question that appears when the site opens, and then the video starts by itself, muted. The second is pressing play on that single video.

The player uses privacy-enhanced mode (youtube-nocookie.com), which defers advertising identifiers but does not remove them. From that moment Google receives the data listed below and handles it under its own policy, and the controller has no control over it. Without consent and without a click, none of this happens.

Provider

Google Ireland Limited (YouTube), independent controller

Data processed

IP address, technical details of the request, referring page and trackers stored in the browser

Legal basis

Consent, which may be withdrawn at any time

Place

Ireland; any transfer to the United States falls under the EU–US Data Privacy Framework

Privacy policy

policies.google.com/privacy

The site sets no cookies, neither technical nor profiling ones, and uses no analytics tools. Typefaces, stylesheets and scripts all come from the site itself, never from third-party domains.

The browser’s local storage keeps only your answer to the question about videos, so it need not be asked on every page. It never leaves the device, does not expire and is erased along with the site’s data.

Consent may be freely given, refused or withdrawn, and refusing it takes nothing away, since photographs, drawings and text stay whole. Withdrawal applies from that moment onwards and does not make earlier processing unlawful (art. 7(3) GDPR). The choice can be changed with the button below.

Under the conditions of articles 15 to 22 GDPR, visitors hold the rights listed below.

Withdraw consent

At any time, from the cookies section above

Object to processing

Where it rests on legitimate interest, giving the reason

Access the data

Learn whether and which data is processed, and receive a copy

Rectify it

Have it corrected or completed

Restrict processing

Have it stored without any other use

Have it erased

Where it is no longer needed or the processing is unlawful

Receive or transfer it

In a structured, machine-readable format

Lodge a complaint

With the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or the authority of one’s own country

Write to the controller at the address at the top of this page. Requests are free of charge and answered within one month (art. 12 GDPR); where a request is complex, that term may be extended by two months, with notice given beforehand.

Data may be used to defend the controller’s rights in court or in the steps leading up to it, and disclosed to public authorities that request it by law.

The icons at the foot of every page lead to the Instagram, YouTube, TikTok and LinkedIn profiles. They are plain links, and until one is clicked no data reaches those platforms. Once you leave the site, their own policies apply.

Should the site change, by adding visit statistics or a contact form for instance, this page will be updated before the new feature goes live, and the date at the bottom will show it. Where new consent is needed, it will be asked for again. The version published here is always the one that applies.

The terms used on this page carry the meaning the GDPR gives them.

Personal data

Any information relating to an identified or identifiable natural person

Usage data

The technical details the browser sends with each request, such as IP, date and page

Tracker

Any technology, cookies included, that stores or reads information on the device

Data subject

The person the data relates to

Controller

Whoever decides the purposes and means of processing

Processor

Whoever processes data on the controller’s behalf