Privacy policy and data protection

Notice under articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code). Last updated: 2 November 2026. This is a translation: if anything differs, the Italian version prevails.

In short

I only collect the data you send me through the contact form, so I can reply.
Visit statistics are anonymous, cookie-free, run on my own server and only start if you accept them.
I don’t sell or share your data, and I don’t use it for advertising or profiling.
You can ask me at any time to see, correct or delete your data.

1. Who the data controller is

Alessio Davì, Lazise (VR), Italy. Email: info@davialessio.dev. No data protection officer (DPO) has been appointed, as one isn’t required for a personal website: for any question, write to the address above.

2. What data I process and why

Contact form

Data: name, email address, topic and text of your message, date and time it was sent.
Purpose: reading your request and replying, including preparing a quote.
Legal basis: your request and the pre-contractual steps that follow from it (art. 6(1)(b) GDPR) and the consent you give by ticking the box before sending (art. 6(1)(a)).
Retention: for as long as needed to handle your request and in any case no longer than 24 months after the last message exchanged, unless we start working together: in that case the data follows the related legal obligations (for example, tax rules).
Required or optional: name, email, message and consent are needed to reply to you. The topic is optional.

Protecting the form from abuse

Data: an encrypted fingerprint (hash) of your IP address, which can’t be turned back into it, and the verification code from the image.
Purpose: preventing automated submissions and spam by limiting the number of messages per hour.
Legal basis: legitimate interest in protecting the site and the mailbox (art. 6(1)(f)).
Retention: the IP fingerprint for one hour at most; the verification code for 30 minutes at most, and it is deleted as soon as you use it.

Anonymous visit statistics

Tool: Umami, open-source software running on my own server (stats.davialessio.dev), with no cookies and no third parties.
Data: in aggregate form, the page visited, referring site, country, region and approximate city, device type, operating system, browser, language and screen size. Your IP address isn’t stored.
Purpose: understanding how many people visit the site and what they read, so I can improve it.
Legal basis: your consent (art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code), which you give from the banner or the preferences and can withdraw at any time.
Retention: the aggregate data stays in the statistics database for as long as it helps compare how the site does over time, and in any case no longer than 25 months.

Technical server logs

Like any website, the server hosting this one automatically records some technical details of each request (IP address, date and time, page requested, browser) to keep it running and secure. These logs are managed by the hosting provider, kept for short periods and only looked at in case of faults or attacks (legitimate interest, art. 6(1)(f)).

Preferences saved in your browser

Theme, animations, recruiter mode and your consent choice stay on your device only and are never sent to any server. Details are in the cookie policy.

3. Who I share data with

Nobody, for commercial purposes. The technical providers of hosting and email may process it, only on my behalf and to keep the service running, as data processors (art. 28 GDPR). If a provider ever processed data outside the European Economic Area, this would only happen with the safeguards set out in articles 44–49 GDPR, such as adequacy decisions or the European Commission’s standard contractual clauses.

Data may be disclosed to authorities only when required by law.

4. How I protect your data

The site uses an encrypted connection (HTTPS) and security rules that prevent scripts from being loaded from unauthorised sources. The form is protected by a verification code, a check on how quickly it’s filled in and a limit on submissions. I don’t use third-party tracking services. Only I can read the messages.

5. Your rights

At any time you can ask:

whether I process your data, and for a copy of it (access, art. 15);
for it to be corrected or completed (rectification, art. 16);
for it to be deleted (art. 17);
for its use to be restricted (art. 18);
to receive it in a machine-readable format (portability, art. 20);
to object to processing based on legitimate interest (art. 21);
to withdraw your consent, without affecting anything done before you withdrew it (art. 7(3)).

Just write to info@davialessio.dev. I reply within 30 days. You can also withdraw consent to statistics yourself, from “Preferences” in the footer.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (art. 77), or with the authority in your own EU country.

6. Children

The contact form is meant for people aged 14 or over, the age set in Italy for consenting to data processing in online services (art. 2-quinquies of the Italian Privacy Code). If you’re under 14, ask a parent to write to me for you.

7. Automated decisions

I don’t make decisions based solely on automated processing, including profiling.

8. Changes

If this notice changes, the date at the top is updated. If the changes concern statistics or consent, the banner will ask for your choice again.

Privacy