This policy explains how cirovitale.me processes personal data during browsing and through the contact form. The website does not use analytics, advertising or profiling cookies.

1. Data Controller

The data controller is Ciro Vitale, a freelance Software & AI Consultant, Italian VAT number 06413640654. For privacy-related enquiries, contact hello@cirovitale.me.

2. Data Processed and Purposes

When you use the contact form, your name, email address, subject and message content are processed. This data is used solely to receive, manage and respond to your request and to retain the related professional correspondence.

While you browse, the hosting service may process technical data required to provide and protect the website, such as IP address, user agent, request date and time and requested resources.

Vercel Web Analytics processes aggregated visit data such as the page or route visited, referrer, approximate geographical area, browser, operating system, device type and date and time. Vercel states that the service does not use third-party cookies or retain personal identifiers associated with visits.

To protect the form from spam and automated submissions, Google reCAPTCHA may also process technical data required for risk analysis, including the IP address, browser and device information and data concerning interactions with the page.

3. Legal Basis

Processing the information submitted through the form is necessary to respond to your request and, where applicable, to take pre-contractual steps at your request under Article 6(1)(b) GDPR. Abuse prevention and website security are based on the controller’s legitimate interest under Article 6(1)(f) GDPR.

Operating the website and measuring aggregate traffic are based on the controller’s legitimate interest in maintaining its security and reliability and obtaining a general understanding of its use under Article 6(1)(f) GDPR.

4. Providers and Recipients

The website is hosted by Vercel, which also provides Web Analytics. Form data is transmitted to EmailJS and delivered through the SMTP email service provided by Register S.p.A. (Register.it), solely to handle the message and send any automatic confirmation. The form also uses Google reCAPTCHA for spam protection. These providers process data according to their respective terms and data protection agreements.

5. reCAPTCHA, Cookies and Local Storage

The form uses Google reCAPTCHA v2 for security and abuse prevention. The service may set a technical cookie required for risk analysis. Google processes the related data as a processor under the Google Cloud terms applicable to reCAPTCHA. Further information is available in the official reCAPTCHA documentation.

The website also stores only the light or dark theme preference in the browser’s local storage. Cookies and local storage are not used by the website for advertising or profiling.

6. International Data Transfers

Some providers may process data outside the European Economic Area. Where this occurs, transfers rely on safeguards provided by applicable data protection law, including, where relevant, the standard contractual clauses approved by the European Commission.

7. Retention

Data submitted through the form and the related correspondence are retained for a maximum of 24 months from the last contact, in order to handle and follow up on the request and document the communications exchanged. If the request leads to a contractual relationship, relevant data may be retained for longer where required by law and for the establishment, exercise or defence of legal claims. Vercel states that the anonymous identifier used by Web Analytics is renewed every 24 hours; aggregated data and technical logs are retained according to each provider’s plan, settings and policies.

8. Required Information

Providing the fields marked as required and completing the anti-spam verification are necessary to submit the form. You can always contact the controller directly by email instead.

9. Your Rights

Under the GDPR, you may request access, rectification, erasure, restriction and, where applicable, portability of your personal data, and you may object to its processing. You can exercise these rights by contacting hello@cirovitale.me. You also have the right to lodge a complaint with the Italian Data Protection Authority.