Privacy noticePrivacy notice

The controller is Simone Dal Forno, Udine, Italy. For data protection requests: hello@simonedalforno.com.

The form requires name, email, phone, business, project type and message. Fields stay in the page until submission; the browser does not store a request archive. The server forwards the request to hello@simonedalforno.com through Resend and to the controller’s private Telegram chat through a bot.

Data is used to answer and assess your service request: pre-contractual steps requested by you are the legal basis (Article 6(1)(b) GDPR). Without the required fields the form cannot be submitted; direct email remains available. Do not include unnecessary sensitive information. The privacy checkbox acknowledges reading, not marketing consent; requests are not added to advertising/newsletter lists.

Vercel hosts the website and may process IP addresses, requests, timestamps and device details for operation/security. The form server validates requests and uses temporary rate-limit/deduplication caches; it does not write message content to application logs. Legal basis: legitimate interests in operation and security (Article 6(1)(f)).

Theme and cookie choices stay on the device; the technical NEXT_LOCALE cookie communicates the language preference to the site.

GA4 loads only when configured and after consent to Statistics. Without consent no Google measurement tag or cookieless measurement signals are sent. Legal basis: consent (Article 6(1)(a)).

Google may process pseudonymous identifiers, visited pages, device/browser details, sessions and referrals. The site does not add contact-field values to measurements. The initial URL passed to the tag excludes query/fragment; automatic events depend on GA4 settings. Notice: https://policies.google.com/privacy.

Enhanced measurement may automatically record scrolling, clicks, downloads, video interactions and form-interaction metadata according to the GA4 property settings. The site does not add contact-field values to Analytics data.

Google Signals and advertising personalization, if enabled in the property, are permitted by the tag only after separate consent to Google advertising features, available with Statistics. These may provide cross-device analysis and demographic/interest information relating to Google users who have authorized those features. Legal basis: consent, withdrawable in the footer. External-media or statistics-only consent is not sufficient.

YouTube players and Apple/iTunes audio previews load after external-content consent and the relevant opening/play action. Providers may receive IP addresses, technical data and interaction information. YouTube uses youtube-nocookie, which does not eliminate all personal-data processing.

External-content consent does not enable GA4. Audio covers are local files; YouTube thumbnails use the site’s image optimization. Instagram, LinkedIn and other links open independent services. Policies: https://policies.google.com/privacy and https://www.apple.com/legal/privacy/.

Recipients/services include the controller, Vercel for hosting/security, Resend for sending email, the mailbox provider and Telegram for private notification. Telegram bot notifications are cloud messages, not end-to-end encrypted secret chats. Consented statistics involve Google; external media involve their providers.

Providers may process data outside the EEA. Applicable processing locations, roles and transfer safeguards must be checked in the agreements for the services used; you can request details from the controller. No identical role or safeguard is presumed for all providers. Policies: https://resend.com/legal/privacy-policy, https://telegram.org/privacy and https://vercel.com/legal/privacy-policy.

Requests with no follow-up are kept for at most 12 months after the last contact, then removed from email and Telegram, except documented needs to defend rights. The controller must manage deletion of these copies; the website does not delete them automatically. Contracts and tax records follow separate applicable legal obligations.

Cookie choices remain valid for six months. This integration sets GA4 cookies to at most 180 days without refreshing them at every visit. The selected GA4 user/event retention rule is 2 months; aggregate reports may follow different service rules. This requires matching settings in the Analytics property. Technical logs depend on security needs and provider configuration. If renewal on new activity stays enabled, the retention of user identifiers can restart; the effective period must match the account settings.

Search Console helps the controller manage indexing and search performance. DNS or ownership-meta-tag verification does not install an Analytics tag or visitor cookies. Search Console verification does not enable GA4.

You may request access, correction, erasure, restriction, portability where applicable and object; withdraw consent without affecting prior lawful processing. Contact hello@simonedalforno.com. You may complain to the Italian authority at https://www.garanteprivacy.it or your competent supervisory authority.

Use Cookie preferences in the footer to change/withdraw optional choices. Analytics withdrawal disables the tag, removes accessible first-party GA4 cookies and reloads the page. It does not automatically delete data already sent to providers; you can exercise your rights for that data. No automated decisions with legal or similarly significant effects are made.

Service/purpose changes require an updated notice. The date above identifies this version.