Privacy notice
Notice under review — updated 16 October 2026. This English notice follows the current Italian notice. Retention periods for email, logs and backups, supplier agreements and international-transfer safeguards still require confirmation before release.
1. Data controller
The controller is Alessio Palmieri, VAT IT15690971005, Via Carlo Galassi Paluzzi 11, 00167 Rome, Italy. For personal data enquiries, contact ing.palmieri@pec.it (Italian certified email).
2. Enquiries and quotations
The form collects your name, email, professional role, service, timeframe and project details to answer your enquiry and prepare a quotation. Company, phone number, notes and photographs are optional. The basis is taking pre-contractual steps at your request under GDPR Article 6(1)(b). Reading the notice does not sign you up for marketing.
Only share relevant photographs you are authorised to provide. Avoid unnecessary personal information. Submitting the form does not automatically upload photographs to AI platforms; any use of AI services for commissioned work will be described before engagement.
3. Sending and storing enquiries
The enquiry form sends your request to Alessio. The form emails an enquiry notification to Alessio. Photographs are stored privately on the SiteGround server, outside the public website, with a download link valid for 14 days. Expired files are removed when a later form request triggers cleanup.
Retention of unanswered enquiries, email copies, attachments and backups must be confirmed before release. Contractual and legally required records may be retained separately for the applicable purposes.
4. Technical data and providers
Hosting, email and security require technical connection data, including IP address, browser details and resource requests. Necessary security processing is based on legitimate interests under GDPR Article 6(1)(f). The existing setup uses SiteGround hosting and SMTP, with notification delivery to the controller’s Gmail mailbox. Log and backup retention and supplier arrangements remain to be confirmed.
5. Optional Vimeo videos
Vimeo players load only after consent to Vimeo videos. Without consent, a local cover remains visible. Consent can be changed or withdrawn in Cookie preferences. Vimeo receives connection information when enabled. The player uses dnt=1, which does not remove every technical processing activity. Read Vimeo’s privacy policy.
6. Optional Google Analytics
Analytics loads only after separate consent to Site analytics. The current integration disables Google Signals and advertising personalisation. It records page views and interactions such as starting the form, confirmed enquiries and WhatsApp clicks. It does not send form names, email addresses, phone numbers, notes, filenames or photographs.
Browser cookies _ga and _ga_* are configured for 180 days without automatic renewal on each visit; browser limits may shorten this. Property-level retention is separate and still needs confirmation. Withdrawal disables measurement and removes accessible Analytics cookies on this domain; previously collected data remains subject to Google’s settings and procedures. Read Google’s privacy policy and Analytics data protection information.
7. Antispam and external links
The form uses Cloudflare Turnstile in its final step to distinguish people from automated submissions. Technical browser and connection signals are processed; the form sends the verification token without photographs, contact details or message content. See the Turnstile privacy notice and Cloudflare privacy policy.
WhatsApp and social links contact the external service only when opened. Fonts, icons and images are local. Any transfers outside the EEA and the relevant GDPR safeguards require verification against the actual supplier agreements.
8. Your rights
Subject to GDPR conditions and limits, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Contact the controller using the address above. You may complain to the Italian Data Protection Authority.
The form makes no purchase, does not subscribe you to marketing lists and does not make automated decisions with legal or similarly significant effects.
Language selection
On your first visit to the main address, your IP address is checked against a country database stored on this server: the main page always stays in Italian. Visitors from other identified countries may see a small popup offering the English version, without automatic redirects. If the country is unavailable, no suggestion is shown. A VPN is evaluated by its exit IP. This lookup does not send your IP address to external geolocation services, and does not create a separate location log. Existing hosting logs are described above.
If you choose IT or EN yourself, the technical cookie ap_language remembers that choice for six months across both versions. It prevents the language popup from being shown again. Closing the popup with its close button or Escape hides it for the current tab session, using the technical sessionStorage entry ap.language.prompt.dismissed.v1; this entry is removed when the tab session ends. The main address stays in Italian; the English version is available at /en/. You can change it with the language menu or remove it through your browser settings. Country data: the server-country database from the ip-location-db project, licensed under PDDL. The database is stored on this server and updated periodically.