This policy explains what personal data nicvannetti.it (the “site”) processes, why, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003 as amended).
Data controller
The data controller is Nic Vannetti, Via De Gasperi,24 Gaiole in Chianti SI, Italy. You can reach me at n.vannetti@gmail.com for any privacy question or request.
What data I process and why
Reading the site
When you visit a page, the hosting infrastructure receives technical data that every web request carries: IP address, date and time, requested URL, referrer, and browser user agent. These server logs are processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) to deliver the site, keep it secure and diagnose errors. They are not used to profile you and are deleted automatically after 30 days.
Contact form and email
If you write to me through the contact form or by email, I process your name, email address, the subject and the content of your message, in order to reply and, where relevant, to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR) or on the basis of my legitimate interest in answering correspondence (Art. 6(1)(f) GDPR). Messages are kept for up to 24 months after the conversation ends, unless a longer period is required by law (for example, tax records for a consulting engagement).
Spam protection
The contact form uses Cloudflare Turnstile to tell people from bots. Turnstile processes technical signals from your browser (such as IP address and browser characteristics) only to perform this check, on the basis of legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR). It does not use cookies for advertising.
What I don’t do
The site currently uses no analytics, no advertising cookies and no tracking pixels, and I do not sell or share your data for marketing.
Advertising
The site may show advertising served by Google AdSense in the future. Before any advertising or advertising cookies are enabled, a consent banner provided by a Google-certified consent management platform will ask for your choice, and advertising cookies will only be set with your consent (Art. 6(1)(a) GDPR). This policy and the Cookie Policy will be updated at that time to describe the providers and purposes in detail.
Processors and international transfers
I use the following service providers, each acting as a processor under a data processing agreement:
- Google Cloud / Firebase (Google Ireland Ltd.) — hosting and content delivery. Servers are in the European Union (europe-west4, Netherlands); content is cached by a global CDN.
- Resend (Plus Five Five, Inc., USA) — delivery of contact-form messages to my inbox.
- Cloudflare, Inc. (USA) — Turnstile spam protection on the contact form.
Where data is transferred outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to data portability (Articles 15–22 GDPR). Where processing is based on consent, you can withdraw it at any time without affecting processing carried out before the withdrawal.
To exercise any of these rights, email n.vannetti@gmail.com. I will answer within one month. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the EU country where you live or work.
Security
The site is served only over HTTPS. Access to hosting, logs and email is restricted to me and protected with multi-factor authentication. Contact-form messages are not stored on the website; they are delivered by email.
Changes to this policy
I will update this policy when the way the site processes data changes. The date at the top shows the latest revision.