1. Data controller
The data controller is Marco Franceschi.
For any request concerning personal data protection, please contact:
info@marcofranceschi.com
2. Scope of this notice
This notice applies to personal data processed through marcofranceschi.com and through the contact channels made available by the website, including the contact form, email, telephone and WhatsApp.
It does not govern processing carried out independently by third-party websites, platforms or services that may be reached through external links.
3. Personal data processed
During normal use of the website, technical information necessary for operation, security and infrastructure management may be processed, including IP address, date and time of the request, requested resource and other information normally contained in web server logs.
Only after the user has given consent, Google Analytics 4 may process information about navigation and interaction with the website, including visited URLs, usage events, session data, browser and device information, IP address and approximate geographical location. The website does not send information entered in the contact form to Google.
The website does not ask users to provide special categories of personal data. Users should avoid including sensitive information that is not necessary for their enquiry.
When the contact form is used, the following information may be processed:
- full name;
- company or organisation, if provided;
- email address;
- telephone number;
- message content;
- preferred callback time;
- page language and technical metadata strictly required for the operation and protection of the form.
4. Purposes and legal bases
Depending on the circumstances, processing is based on pre-contractual steps requested by the data subject, performance of a contractual relationship, compliance with legal obligations or the controller's legitimate interest in managing communications and protecting its systems.
The contact form does not request consent for marketing purposes and submitted information is not automatically used for newsletters or promotional communications.
Processing through Google Analytics 4 is carried out exclusively for statistical purposes and analysis of website usage and is based on consent. Rejection does not restrict access to the website, and consent can be withdrawn at any time through “Cookie settings”.
Personal data is processed in order to:
- respond to enquiries and callback requests;
- take pre-contractual steps requested by the data subject;
- manage correspondence and any subsequent professional relationship;
- protect the website and systems against abuse, spam and improper use;
- comply with legal obligations;
- establish, exercise or defend legal claims.
- produce aggregate website usage statistics, exclusively after consent.
5. Contact form
Information entered into the contact form is transmitted to the server over HTTPS and processed by the website's contact endpoint.
The content of the enquiry is not stored in a website database. After validation and security checks, the message is sent by email to the recipient configured on the server.
Anti-abuse and rate-limiting controls are applied. The IP address may be processed temporarily for these purposes; the rate-limiting state uses an HMAC-derived identifier and does not store the IP address in clear text.
Application logs for the contact form contain technical information and do not record the message content, name, email address, telephone number or clear-text IP address. The current technical configuration automatically retains these logs for 30 days.
6. Email and Gmail
Messages addressed to email accounts on the marcofranceschi.com domain are initially handled through the mail infrastructure associated with the controller's server.
Correspondence may also be automatically forwarded to a Gmail account used by the controller to manage and archive email.
The service used is the consumer version of Gmail and is subject to Google's Terms of Service and Privacy Policy.
Google Analytics 4 is used, after consent, to produce statistics about website usage. The data stream is identified by Measurement ID G-GTHJSE2518. Information about Google's processing through sites and apps that use its services is available at https://policies.google.com/technologies/partner-sites.
Archived correspondence is not subject to an automatic fixed deletion deadline and may therefore be retained for extended periods where it remains useful for managing professional relationships, reconstructing correspondence or protecting the controller's rights. Messages that are no longer necessary for the purposes for which they were collected may be deleted.
7. Telephone and WhatsApp
The website provides links that allow users to initiate a telephone call, email message or WhatsApp conversation.
The WhatsApp link is activated only following an action by the user. The website does not embed a WhatsApp widget and does not transmit data to WhatsApp simply as a result of visiting the page.
When a user chooses to use WhatsApp, subsequent processing by the service is governed by the applicable WhatsApp terms and privacy information.
8. Service providers and recipients
The website and related services currently use, in particular:
Fasthosts Internet Limited
Provider of the server infrastructure hosting the website, Plesk environment and email services. In connection with hosting services, it may process personal data on behalf of the controller under the applicable contractual terms and Data Processing Agreement.
Register.it S.p.A.
Provider used for registration and maintenance of the domain name and management of DNS records.
Consumer Gmail may be used to receive forwarded messages, manage them and archive correspondence addressed to professional mailboxes. Processing through Gmail is governed by Google's Terms of Service and Privacy Policy.
Personal data may also be disclosed to professional advisers, authorities or other parties where necessary to comply with legal obligations or to establish, exercise or defend a legal claim.
Personal data is not sold.
9. Technical logs and security
Server systems generate technical logs required for operation, troubleshooting and infrastructure security.
Application logs associated with the contact form are automatically retained for 30 days.
The current server configuration rotates the main web and error logs daily and is configured to retain up to 90 rotated archives. The configured number of archives does not necessarily correspond to an identical mathematical number of days in every circumstance.
Access to systems and logs is restricted to authorised persons and to what is technically necessary for infrastructure management.
10. Location and international transfers
The hosting infrastructure used through Fasthosts is located in the United Kingdom.
The United Kingdom currently benefits from an adequacy decision adopted by the European Commission under Article 45 GDPR. Transfers covered by that decision may therefore take place without the additional safeguards otherwise required for non-adequate third countries.
Use of Gmail and, after consent, Google Analytics 4 may involve information being processed through Google infrastructure located in countries other than the user's own country. Google states that it uses the transfer mechanisms recognised by applicable data protection law, including adequacy decisions and, where required, other recognised safeguards. Further information is available at https://policies.google.com/privacy/frameworks.
The local backups described in this notice remain on local systems under the controller's control.
11. Data retention
Information received through contact requests is retained for as long as necessary to handle the enquiry and any relationship that may result from it.
Email correspondence archived through Gmail is not currently subject to automatic deletion and may be retained for extended periods depending on the nature of the communication and professional, administrative or legal requirements.
Where an enquiry develops into a professional relationship, certain information and documents may be retained for longer where required for contractual, administrative, tax or legal purposes or for the protection of rights.
Technical logs are retained according to the periods described in the previous section.
The Google Analytics 4 property is configured to retain user data for 14 months and event data for 14 months. These settings do not determine the retention of standard aggregated Analytics reports.
12. Backups and business continuity
The server infrastructure is subject to an incremental backup performed weekly through the Plesk environment. A separate archive of multiple weekly copies is not maintained for ordinary consultation.
Following significant infrastructure changes, full backup copies may also be created, including configurations, website content, data and email.
These full copies are stored on local systems within infrastructure controlled by the data controller. When a new full local copy is created, the previous local copy is deleted.
Backups are used exclusively for security, business continuity, disaster recovery and restoration purposes.
14. Data subject rights and updates
Where provided for by the GDPR, data subjects may ask the controller for access to their personal data, rectification of inaccurate data, erasure, restriction of processing, objection to processing and, where applicable, data portability.
Requests may be sent to:
info@marcofranceschi.com
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority.
This notice may be updated when processing activities, services or applicable law change. The updated version will be published on this page together with the date of revision.