Privacy policy
Last updated: 8 September 2026
This site is a professional shop window: it has one contact form and no accounts. Fonts, stylesheets, scripts and images are hosted on my own domain, so your browser does not contact any outside server in order to display the pages.
The only third party tools are the analytics and marketing ones described in section 3, and they do not start until you allow them from the banner shown on your first visit.
1. Data controller
Alessandro Cataldo, self-employed professional, Montevarchi, Italy.
VAT number IT02459880510.
Email: info@alessandrocataldo.it
Phone: +39 339 4255390
2. Data the server records automatically
Like every web server, the hosting records technical access logs: IP address, date and time of the request, page requested, type of browser and operating system. These are used only to keep the site running, to diagnose faults and to defend against attacks. They are distinct from cookies and are processed for the technical purposes described.
- Legal basis: legitimate interest in the security and correct operation of the site (art. 6.1.f GDPR).
- Retention: for as long as the hosting provider's settings allow, normally a few days.
- Recipients: the hosting provider, acting as data processor, with servers in the European Union.
3. Analytics and marketing (only with your consent)
On your first visit a banner offers three choices: accept everything, refuse everything, or choose category by category. Before you decide, none of these tools is loaded and no profiling cookie is installed. Refusing is as immediate as accepting, and you can change your mind at any time from the "Cookie preferences" button at the foot of every page.
- Analytics. Google Analytics 4, switched on through the Google Tag Manager container, tells me how many people visit the site, where they come from and what they read. I use this to judge the content of the site.
- Marketing. The Meta pixel, installed today, measures the results of campaigns on Facebook and Instagram and makes it possible to show ads to people who have already visited. The Google Ads equivalents come into play only if I run campaigns on that channel.
- Legal basis: your consent, freely given and revocable (art. 6.1.a GDPR and art. 122 of the Italian privacy code).
- Controllership: for this processing Google and Meta act as independent or joint controllers. The details, with the list of individual cookies and their durations, are in the cookie policy.
Transfers outside the European Union. Google and Meta may also process data in the United States. The transfer relies on the adequacy decision of the EU-US Data Privacy Framework and on the standard contractual clauses adopted by the two providers. If you refuse these categories, the site does not load the corresponding tracking tools.
4. The contact form
The form at the foot of the home page asks for your name, email, any company or project, the situation you are in and your message. I use this to handle your enquiry, not to sign you up to a newsletter.
- Where it goes: the form sends an email straight to my mailbox, hosted on my own hosting. It does not pass through outside services such as Formspree or Mailchimp, and it is not saved in any database.
- Legal basis: your consent, given by ticking the box, together with pre-contractual steps (art. 6.1.a and 6.1.b GDPR).
- Retention: I keep the email to handle the enquiry and any professional relationship that follows. Documents subject to legal obligations are kept for the applicable periods. You can ask for deletion, within the limits of those obligations.
- Anti-spam: the form uses the time the page was opened and your IP address to limit automated submissions. The IP is included in the email sent to the controller. A technical file tied to an identifier derived from the IP is created on the server, to keep submissions at least 60 seconds apart.
5. Data you send me through other channels
If you email me, call me or reach me on WhatsApp, LinkedIn or Instagram, I process what you tell me (name, contact details and what you say about your project) in order to reply and, if we decide to work together, to manage the professional relationship.
- Legal basis: performance of a contract or pre-contractual steps (art. 6.1.b GDPR).
- Retention: for the duration of the discussion or the relationship and, after that, for the period required by tax and legal obligations.
- Disclosure to third parties: providers of the services used to handle communications, tax and accounting advisers where necessary, and authorities in the cases provided for by law. I do not sell your data.
If you contact me through WhatsApp or LinkedIn, the conversation happens on those providers' platforms, which process your data under their own policies, over which I have no control.
6. Your rights
You can ask me at any time to give you access to your data, to correct it, to delete it, to restrict its processing, to receive it in a readable format, to object to processing, and to withdraw the consent given for analytics and marketing cookies. Just write to info@alessandrocataldo.it: I reply within thirty days.
If you believe your data is being handled improperly, you can lodge a complaint with the Italian data protection authority (garanteprivacy.it).
7. Security
The site is served only over an encrypted HTTPS connection and is made of static pages: no database, no admin area, no login. The only place where data is entered is the contact form, which checks what it receives and sends it by email. The anti-spam system uses the technical file described in section 4.
Fonts, images and page code are hosted on the site itself. External analytics and marketing tools are loaded according to consent. The details are in the cookie policy.
8. Changes
If the site changes, for instance with a newsletter or a new measurement tool, this page is updated before the new thing goes live, and the date at the top is changed.