Your privacy

The site is hosted on Cloudflare Pages. Cloudflare processes content transmitted through its network and customer logs on the controller’s behalf. It also acts as an independent controller for certain other data it processes for its own network operations and security, as described in section 6 of its Privacy Policy.

Messages sent to privacy@arturolotito.com are forwarded by Porkbun’s email forwarding service to a Gmail mailbox. Porkbun and Google, as the Gmail provider, handle the sender’s address, message, attachments and delivery metadata. Google’s own processing is described in its Privacy Policy. Data may also be disclosed to competent authorities where required by law.

Cloudflare’s global infrastructure can involve processing outside the European Economic Area, including in the United States. For transfers covered by an applicable adequacy decision, Cloudflare relies on that decision, including the EU–US Data Privacy Framework where applicable. For restricted transfers, its Data Processing Addendum, section 6 provides for EU Standard Contractual Clauses and additional safeguards. Those safeguards can be consulted through the linked terms, or you can request information using the contact address above.

Gmail can also involve international processing, including in the United States. Google describes its reliance on adequacy decisions, the EU–US Data Privacy Framework where applicable, and Standard Contractual Clauses for other transfers in its data-transfer information, which also explains how to request a copy of its clauses.

The website files do not set cookies, use browser storage, or include analytics, advertising pixels, remote fonts or embedded third-party content. Cloudflare security features may set strictly necessary cookies depending on the protection enabled and the requests received. Details of Cloudflare’s cookies and their purposes are available in its cookie documentation.

A cookie-consent banner is not required where only strictly necessary cookies are used. Any addition of non-essential cookies or tracking will be assessed and this notice updated; prior consent will be obtained where required.

The website has no application database or application code that creates a separate visitor access-log database. Cloudflare processes technical and security data, and its services may make request or security information available through its dashboard.

For data processed on the controller’s behalf, Cloudflare’s DPA, Annex 1, sets retention by the earlier of the end of the service agreement or the point when processing is no longer necessary to perform the relevant contractual obligations. Service-specific retention settings also apply. For data processed as an independent controller, Cloudflare’s Privacy Policy, section 11 describes retention criteria including the processing purpose, the nature of the data, security risks and applicable legal obligations. These are retention criteria, not a fixed number of days for every type of technical data.

Cloudflare’s sampled HTTP-request analytics are available in the dashboard for at least 31 days under Cloudflare’s current documentation; the precise availability can depend on the plan. This site does not use Cloudflare Log Explorer or a Logpush export for separate stored request logs.

If you write to privacy@arturolotito.com, I process your address, name if supplied, message and any relevant attachments to handle your enquiry. Ordinary correspondence is based on my legitimate interest in answering messages (Article 6(1)(f) GDPR). Handling requests to exercise GDPR rights is based on compliance with a legal obligation (Article 6(1)(c) GDPR, in connection with Articles 12–22).

Correspondence and the record of how a request was handled are kept for up to 12 months after closure, unless a specific legal obligation requires longer retention. Irrelevant information is deleted sooner. Sending an ordinary enquiry is voluntary, but without a reply address and enough information I may be unable to answer. For a rights request, I will ask for additional information only where needed to clarify the request or reasonably verify your identity.

This retention policy applies to the correspondence I manage. Google’s deletion process can take additional time to remove copies from active and backup systems, as explained in its Privacy Policy.

You may request access, rectification, erasure or restriction of processing, subject to the conditions in the GDPR. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Data portability applies where the conditions of Article 20 are met, including automated processing based on consent or a contract.

Send requests to privacy@arturolotito.com. I will respond without undue delay and normally within one month. Where necessary because of the complexity or number of requests, the period may be extended by up to two further months; I will explain the extension within the first month. Requests are normally free of charge.

You may lodge a complaint with the Garante per la protezione dei dati personali in Italy, or another competent supervisory authority, including where you habitually reside or work or where an alleged infringement took place.