Skip to main content
Roberto Ciacci
Back to home

Personal Data Processing Notice

(pursuant to Article 13 of Regulation (EU) 2016/679 — GDPR)

Data controller

The data controller is Roberto Ciacci, Bologna (BO), Italy.
Contact email: privacy@robertociacci.it
Website: www.robertociacci.it (hereinafter the “Website” or “Service”).

The Controller is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. For any privacy-related request, clarification, or exercise of their rights, data subjects may write at any time to: privacy@robertociacci.it.

Types of data processed

  • Browsing data: IP address, device identifiers, log data, requested URIs/URLs, time of the request, user agent, pages visited, interactions, and Website performance.
  • Cookies and similar technologies: technical and functionality cookies and, with prior consent, analytics and marketing/profiling cookies. Full details are available in the Cookie Policy.
  • Voluntarily provided data: first name, last name, email address, and any content of messages sent through contact forms or by email.
  • Data for marketing/CRM activities (where applicable): communication preferences, email opening/click events, subscriptions/unsubscriptions.
  • Data for Website support and security: information necessary to manage support requests and prevent abuse or unauthorised access.

Providing data marked as necessary in collection forms is essential to deliver the Service or respond to requests; failure to provide it may prevent such delivery.

Purposes and legal bases of processing

  • Delivery of the Service and responses to contact requests (technical management of the Website, handling requests, support): performance of pre-contractual measures or a contract (Article 6(1)(b) GDPR).
  • Website security and prevention of abuse/fraud: the Controller’s legitimate interest in protecting the Website and its users (Article 6(1)(f) GDPR).
  • Statistics and traffic measurement: where performed using non-anonymised or third-party tools, these are based on consent (Article 6(1)(a) GDPR). Where analytics are anonymised and aggregated, processing is based on legitimate interest (Article 6(1)(f) GDPR), in accordance with applicable guidelines.
  • Direct marketing (email, newsletters) and profiling: for marketing purposes (e.g. personalised communications, remarketing), processing is based on the user’s explicit consent (Article 6(1)(a) GDPR).
  • Compliance with legal requirements (tax obligations, requests from authorities, defence in legal proceedings): legal obligation (Article 6(1)(c) GDPR) and/or legitimate interest in legal defence (Article 6(1)(f) GDPR).

Where consent is the legal basis, users have the right to withdraw it at any time without affecting the lawfulness of processing already carried out.

Processing methods

Data are processed using electronic tools and, where necessary, paper records, with appropriate technical and organisational measures (Article 32 GDPR) to ensure security, integrity, availability, and confidentiality. No solely automated decisions producing legal effects on the data subject are made, unless otherwise specifically stated in the Cookie Policy.

Recipients and categories of recipients

Data may be disclosed to:

  • IT/hosting, maintenance, and security service providers.
  • Analytics and traffic measurement platforms (e.g. web analytics).
  • Advertising/remarketing and newsletter/CRM management platforms (only with prior consent for marketing/profiling purposes).
  • Consultants and professionals assisting the Controller (within the scope of their assignment).
  • Authorities and persons legally entitled to receive the data.

Depending on the circumstances, these parties act as processors (Article 28 GDPR) or independent controllers. An updated list of processors is available upon request to the Controller.

Transfers outside the EEA

Some third-party IT service providers or analytics tools may process data in countries outside the European Economic Area (EEA), particularly the United States. In such cases, transfers take place exclusively in accordance with Chapter V of the GDPR, in particular:

  • On the basis of European Commission adequacy decisions (including the EU–US Data Privacy Framework for certified US providers);
  • Through the signing of Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where necessary by appropriate additional technical and organisational measures;
  • Where other specific derogations permitted by the GDPR apply.

Detailed information and references to specific transfer mechanisms are available upon request or in the Cookie Policy.

Data retention

  • Contact/support data: for the time strictly necessary to handle and respond to the request, and for up to 24 months for traceability and legal protection purposes.
  • Browsing data and security logs: for up to 12 months, unless further retention is necessary due to security incidents or requests from judicial authorities.
  • Marketing/newsletter data: for up to 24 months after the last relevant interaction or until consent is withdrawn (opt-out).
  • Compliance with legal requirements and defence in legal proceedings: according to statutory retention periods and applicable limitation periods (e.g. 10 years for accounting/tax obligations).

Once the retention period has expired, data will be deleted, anonymised, or made no longer attributable to the data subject.

Data subject rights

Under the GDPR, you have the right to:

  • Request access to personal data and information about its processing;
  • Obtain rectification of inaccurate data and completion of incomplete data;
  • Request erasure (“right to be forgotten”) in the cases provided for in Article 17;
  • Obtain restriction of processing;
  • Exercise the right to data portability (receive data in a structured, commonly used, machine-readable format and transmit it to another controller);
  • Object to processing based on legitimate interest;
  • Withdraw consent at any time (for marketing communications, also through the unsubscribe link at the bottom of emails).

To exercise these rights, simply email: privacy@robertociacci.it.
The Controller will respond within one month (which may be extended to three months in more complex cases).

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of the EU Member State where they reside, work, or where the alleged infringement occurred.

Marketing communications and profiling

Direct promotional communications will be sent only with prior consent. These communications may be personalised based on the user’s preferences or interactions (profiling), always subject to specific consent. Consent may be withdrawn and processing objected to at any time:

  • Through the unsubscribe (opt-out) link in every promotional email;
  • By writing directly to privacy@robertociacci.it.

Cookies and similar technologies

This Website uses technical cookies necessary for its operation and, with the user’s prior consent, analytics and marketing cookies. For full details on categories, purposes, duration, third parties involved, and to manage your preferences (including use of the cookie banner), please consult the Cookie Policy, which forms an integral part of this notice.

Children

The Website is not intended for children under 14 (or any higher age required by local law). The Controller does not intentionally collect children’s personal data. If a user believes that children’s data have been collected without appropriate parental consent, they are asked to contact the Controller promptly to request immediate deletion.

Data security

The Controller adopts appropriate technical and organisational measures to prevent data loss, unlawful or improper use, unauthorised disclosure, alteration, and destruction. However, no information security measure can guarantee absolute protection, and transmitting information online involves residual risks inherent in using the Internet.

Changes to this notice

The Controller reserves the right to amend or update this notice to reflect legislative developments or new Website features. Significant changes will be announced by publication on the Website, clearly indicating the date of the latest update. Where changes concern processing based on consent, the Controller will obtain consent again where required by law.