Privacy Policy

PROVISIONAL PRIVACY NOTICE — INFORMATION TO COMPLETE This notice describes verified site behaviour. It does not certify compliance and must be completed before enabling statistics. Controller and privacy contact: TO BE CONFIRMED by the operator, including full identity and contact details for exercising rights. The portfolio name does not establish these details. Browsing and security: the server and proxy receive IP addresses, request timestamps and HTTP requests to deliver and protect the site. The verified configuration enables Nginx access logs and daily rotation with 14 archives; this alone does not prove actual deletion or cover backups and the system journal. Hosting provider, access to logs, legal bases and overall effective retention are TO BE CONFIRMED. There are no public data collection forms. Email and social links open external services with their own notices. Professional content, a photograph and an optional CV are published by the operator. Administration: restricted password access uses hashed credentials and eight-hour sessions. Login attempts are stored to limit abuse; expired sessions are deleted on subsequent logins. Retention and cleanup rules for attempts remain TO BE DEFINED. No email password recovery or SMTP is configured by this feature. Optional statistics: Google Analytics 4 loads only when configured, enabled and after statistics consent. No Google tag loads before consent or following refusal. If enabled, Google receives technical connection data and statistical identifiers. The app sends only allowlisted public paths, without queries, fragments, contacts, form data or user IDs. Statistics rely on consent, which can be withdrawn using “Cookie preferences”. The app does not enable advertising, Google Signals or ad personalisation. The controller must CONFIRM the Google contracting entity, agreements, international transfers and safeguards, actual property settings and GA4 data retention. Withdrawal stops future tracking but does not erase data already received by the provider. Translation: only the operator can request DeepL translation of public portfolio text. No translation takes place during visits. This translation flow does not send credentials, CV files or session data. DeepL plan, contracting entity, agreements, retention and transfers must be CONFIRMED before use. Drafts require manual review and publication. Rights: where applicable you may request access, rectification, erasure, restriction, objection and portability, withdraw consent and complain to the Italian data protection authority (garanteprivacy.it). The controller’s contact for requests must be COMPLETED. Reading this notice does not require generic consent. Sources: EU Regulation 2016/679, Articles 5, 6, 7, 12–22 and 44 onwards; Italian authority cookie guidelines of 10 June 2021. Technical review: 25 October 2026.