Skip to content
Lorenzo Lottici

Privacy Policy

Updated October 3, 2026

This page explains how I handle the personal data of people who visit lorenzolottici.it or write to me. It’s written to be read, so it’s in the first person and no longer than it needs to be. Where the law asks for a precise reference, I’ve included it. The Italian version is the legally binding one. This is a faithful translation.

Who handles your data

The data controller is me, Lorenzo Lottici, VAT no. IT03146830348. You can write to me at lorenzo@lorenzolottici.it about anything related to this policy, including exercising your rights.

I have not appointed a data protection officer: the conditions that make one mandatory under Article 37 of the EU General Data Protection Regulation 2016/679 (GDPR) do not apply.

What data I collect

Three categories, and nothing beyond these.

  • What you write to me. If you contact me by email or WhatsApp, I receive your address or your number, the name you use and the content of the message. If you use the Let’s talk page, your answers (name, company, what you need, budget, email, how you prefer to be contacted and, if you choose it, your number) stay in your browser until you press send: the site doesn’t save them anywhere. When you press send they are delivered securely over HTTPS to my inbox so I can get back to you, and you receive a confirmation email at the address you provided. Meanwhile the draft sits in the browser’s session storage (parliamone-bozza) and disappears when you close the tab or send the message. I keep messages for as long as we’re discussing the work, then I delete them.
  • Technical server data. Like any website, the server logs the requests it receives: IP address, date and time, page requested, browser type. This is needed to run the site and to notice abuse.
  • Measurement data, only if you consent. If you accept on the banner, the Meta pixel is activated: it records the visit and links it to your Facebook or Instagram profile if you have one. If you decline, or don’t choose, the pixel isn’t loaded at all.

Why I process it, and on what legal basis

  • To reply when you write to me and to prepare a quote, if you ask for one. Legal basis: steps taken at your request before entering into a contract, Article 6(1)(b).
  • To run the site securely and prevent abuse, through the server logs. Legal basis: my legitimate interest in keeping the service intact, Article 6(1)(f).
  • To measure how well my communication works, through the Meta pixel. Legal basis: your consent, Article 6(1)(a), which you can withdraw whenever you like.
  • To meet tax obligations, if we become client and supplier. Legal basis: legal obligation, Article 6(1)(c).

How long I keep it

  • Messages and conversations: twenty-four months from the last contact, then I delete them. If a project starts in the meantime, the term below applies.
  • Tax and contract documents: ten years, because the law requires it (Article 2220 of the Italian Civil Code).
  • Server logs: thirty days at most, unless they’re needed longer to investigate abuse in progress.
  • Measurement cookies: the duration is stated in the Cookie Policy, and in any case no longer than the consent you gave.

Who else sees it

I don’t sell data to anyone and I don’t pass it on for commercial purposes. The only people who see it are the technical providers the site needs in order to exist, each appointed as data processor where required.

  • Vercel Inc., the infrastructure the site is published on.
  • Meta Platforms Ireland Ltd., only if you’ve consented to measurement.
  • My email provider, for the emails we exchange.
  • The fonts are served by this site, not by Google’s servers: opening the page sends no request to them.

Transfers outside the European Union

Some of these providers are based in the United States. The transfer relies on the adequacy decision adopted by the European Commission on July 10, 2023 for the EU-US Data Privacy Framework, for providers that have joined it, and otherwise on the standard contractual clauses approved by the Commission. If you’d like a copy of the safeguards in place, ask me.

Your rights

The GDPR gives you rights that you can exercise by writing to me at lorenzo@lorenzolottici.it. I reply within one month: if the request is complex I may take two more months, but in that case I’ll tell you within the first.

  • Access, Article 15: find out whether I process data about you and get a copy.
  • Rectification, Article 16: correct anything that’s wrong or incomplete.
  • Erasure, Article 17: have it deleted, when I’m not legally required to keep it.
  • Restriction, Article 18: freeze it instead of deleting it, while a dispute is being settled.
  • Portability, Article 20: receive it in a machine-readable format.
  • Objection, Article 21: object to processing based on my legitimate interest.
  • Withdrawal of consent at any time, without affecting the lawfulness of what was processed before.
  • I don’t make automated decisions about you and I don’t profile you, except for Meta’s profiling if you accept the pixel.

If you think something’s wrong

Write to me: almost every time, one email sorts it out. If that’s not enough, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy, or to go to court.

Security and minors

The site is served only over an encrypted connection, and access to the data is limited to me and the providers listed above. No measure is infallible, but these are proportionate to the risk of a site that collects very little in the first place.

This site is not aimed at children under fourteen and does not knowingly collect their data. If you find out that it has, write to me and I’ll delete it.

Changes to this policy

If I change the way I handle data, I’ll update this page and the date at the top. Changes apply from the moment they’re published.

Cookie Policy