Data controller
The data controller is Alberto Baroni.
For privacy requests and to exercise your personal-data rights, write to privacy@parchidinervi.it.
Personal data processed
During ordinary browsing, the hosting provider’s systems may process technical data such as the IP address, date and time of the request, requested page, browser type and device type, as needed to deliver and protect the website.
The contact form collects the sender’s name, email address and message. These data are sent by email and are not stored in the website database.
To prevent abuse, the system processes anti-spam tokens and pseudonymous hashes of the IP and email addresses, together with the outcome of each attempt.
Only after consent, the internal analytics system records a pseudonymous identifier generated in the browser, page visited, date and time, language, device category, referring domain, and any searches or not-found pages. Analytics do not record names, email addresses or full IP addresses.
Purposes and legal bases
Website delivery and security, abuse prevention and the technical management of logs are based on the controller’s legitimate interest in keeping the service available and secure under Article 6(1)(f) GDPR.
Data submitted through the contact form are processed to answer the user’s request, based on the legitimate interest in managing incoming communications. Where a request precedes a relationship or agreement with the data subject, processing may be necessary to take pre-contractual steps at their request under Article 6(1)(b) GDPR.
Pseudonymised analytics are based on the data subject’s consent under Article 6(1)(a) GDPR. Consent may be refused or withdrawn at any time through “Manage cookie preferences”, without affecting access to the website or the lawfulness of processing carried out before withdrawal.
Privacy-rights requests may also be processed to comply with a legal obligation of the controller under Article 6(1)(c) GDPR.
Providing personal data
Providing a name, email address and message through the form is optional, but necessary to submit a request and receive a reply. The website does not request special-category personal data; please do not include such data in a message.
Consent to analytics is optional. Refusing consent does not limit access to website content or features.
Recipients and international transfers
Personal data are processed by the controller and, insofar as necessary to provide the services, by Aruba S.p.A., the hosting, database and email provider. The provider acts as a processor under the applicable agreements.
Personal data are not sold or made public. They may be disclosed to authorities or other parties only where required by law or necessary to establish, exercise or defend legal claims.
The hosting and email services currently used are managed in Italian data centres. No transfers of personal data outside the European Economic Area are envisaged. If the services change, this notice will be updated and the safeguards required by the GDPR will be adopted.
Retention periods
Messages received through the contact form, messages sent to the privacy address and related replies are retained for 12 months from the date of each message, unless longer retention is required by law or to establish, exercise or defend legal claims.
Captcha tokens are valid for 10 minutes and are deleted by the next cleanup procedure. Pseudonymous hashes relating to anti-abuse attempts are retained for 30 days.
Pseudonymised analytics data are retained for 180 days. The consent preference and pseudonymous identifier remain in the browser until the user withdraws consent or deletes the website’s stored data.
The technical session cookie used by the contact form expires when the browser is closed. Any technical logs held by the provider are retained for the periods or according to the criteria set out in the service terms, for security, technical service delivery and compliance with legal obligations.
Data subject rights
Where applicable under Articles 15-22 GDPR, data subjects may request access to, rectification or erasure of their personal data, restriction of processing and data portability, and may object to processing. They may also withdraw consent to analytics at any time.
To exercise these rights, write to privacy@parchidinervi.it. The controller will respond without undue delay and normally within one month; it may be necessary to verify the requester’s identity.
Complaints and automated decisions
If a data subject believes that processing infringes the GDPR, they may lodge a complaint with the Italian Data Protection Authority at www.garanteprivacy.it, or with the supervisory authority in the EU country where they live, work or where the alleged infringement occurred.
The website does not make automated decisions that produce legal or similarly significant effects on users.