Privacy Policy

Who handles your data

The data controller is me, Lorenzo Lottici, VAT number IT03146830348. You can write to lottici.lorenzo04@gmail.com about anything concerning this notice, including exercising your rights.

I have not appointed a data protection officer: the conditions that would make one mandatory under Article 37 of European Regulation 2016/679 do not apply here.

What data I collect

Three categories, and nothing beyond them.

• What you write to me. If you get in touch by email or WhatsApp I receive your address or number, the name you use, and the content of your message. There is no form anywhere on this site: data reaches me only because you typed it into a message.
• Server technical data. Like any website, the server logs the requests it receives: IP address, date and time, page requested, browser type. They keep the site running and make abuse visible.
• Measurement data, only if you consent. Accepting from the banner activates the Meta pixel, which records the visit and links it to your Facebook or Instagram profile if you have one. If you decline, or make no choice, the pixel is never loaded at all.

Why I process it, and on what legal basis

• To reply when you write, and to prepare a quote. Legal basis: pre-contractual measures taken at your request, Article 6(1)(b).
• To keep the site running safely and prevent abuse, through server logs. Legal basis: my legitimate interest in keeping the service intact, Article 6(1)(f).
• To measure how well the communication works, through the Meta pixel. Legal basis: your consent, Article 6(1)(a), which you can withdraw at any time.
• To meet tax obligations, if we become client and supplier. Legal basis: legal obligation, Article 6(1)(c).

How long I keep it

• Messages and conversations: twenty-four months from the last contact, then I delete them. If work begins in the meantime, the next line applies.
• Tax and contract documents: ten years, because the law requires it (Article 2220 of the Italian Civil Code).
• Server logs: thirty days at most, unless they are needed longer to investigate ongoing abuse.
• Measurement cookies: durations are listed in the Cookie Policy, and never beyond the consent you gave.

Who else sees it

I do not sell data to anyone and I do not share it for commercial purposes. Only the technical providers that make the site exist can see it, each appointed as a data processor where required.

• Vercel Inc., the infrastructure the site is published on.
• Meta Platforms Ireland Ltd., only if you consented to measurement.
• My email provider, for the messages we exchange.
• Typefaces are served by this site and not by Google's servers: opening the page sends no request to them.

Transfers outside the European Union

Some of these providers are based in the United States. Transfers rely on the adequacy decision adopted by the European Commission on 10 July 2023 regarding the EU-US Data Privacy Framework, for providers that participate in it, and otherwise on the standard contractual clauses approved by the Commission. Ask me if you want a copy of the safeguards in place.

Your rights

The Regulation gives you rights you can exercise by writing to lottici.lorenzo04@gmail.com. I reply within one month: if the request is complex I may take two months more, but I will tell you within the first.

• Access, Article 15: find out whether I process data about you and obtain a copy.
• Rectification, Article 16: correct anything wrong or incomplete.
• Erasure, Article 17: have it deleted, where no legal obligation requires me to keep it.
• Restriction, Article 18: freeze it rather than delete it while a dispute is sorted out.
• Portability, Article 20: receive it in a machine-readable format.
• Objection, Article 21: object to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before.

If you think something is wrong

Write to me: almost every time it is settled in one email. If that is not enough, you have the right to lodge a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, or to go to court.

Security and minors

The site is served over an encrypted connection only, and access to data is limited to me and the providers listed above. No measure is infallible, but these are appropriate to the risk of a site that collects very little to begin with.

This site is not aimed at children under fourteen and does not knowingly collect their data. If you notice that it has, write to me and I will delete it.

Changes to this notice

If I change how I handle data, I update this page and the date at the top. Changes apply from the moment they are published.