Privacy Policy

1. Data controller

The data controller for this website is:

For any question about how your data is handled, feel free to write to me directly at that address.

2. What data I collect and how

I only collect data you voluntarily submit through the forms on this site. I don't use trackers, pixels, or any automatic personal data collection.

Contact form

Fields collected: name, email, phone number (optional), city, and your message. Purpose: to respond to your request or start a conversation about a potential collaboration.

Newsletter subscription

Fields collected: first name, last name, email address, and the topic area you select. Purpose: to send you periodic updates on subjects you're interested in. You can unsubscribe at any time.

CV / résumé request

Fields collected: first name, last name, and email address. Purpose: to deliver my CV and, if relevant, follow up about potential opportunities.

Technical browsing data

Like any website, the server and the content delivery network may automatically log technical data such as IP address, browser type, operating system, and pages visited — for security and diagnostic purposes only. This data is handled by Cloudflare (see section 5) and is not used by me for profiling.

3. Legal basis and purposes of processing

I process your data exclusively on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): for newsletter subscriptions and CV downloads, which arise from an explicit request on your part.
• Pre-contractual measures (Art. 6(1)(b) GDPR): for responding to contact requests related to assessing a collaboration or project.
• Legitimate interest (Art. 6(1)(f) GDPR): for site security and spam/abuse prevention.

I don't use your data for purposes other than those you provided it for, don't sell it, and don't share it with third parties for marketing.

4. How long I keep your data

Data is kept only as long as necessary for the purpose it was collected:

• Contact requests: for the time needed to handle the request and, if a professional relationship begins, for its duration plus any applicable legal/tax obligations.
• Newsletter: until you unsubscribe or request deletion.
• CV request: while your interest or candidacy is active, or until you ask for deletion.
• Technical logs: managed by Cloudflare in accordance with their own Privacy Policy.

You can request deletion of your data at any time by writing to francesco.sguotti03@gmail.com.

5. Who I share data with

Data is never sold or transferred to third parties for commercial purposes. The entities that may access your data as data processors are:

Cloudflare, Inc.

The site is hosted on Cloudflare Workers and delivered through the Cloudflare CDN. Cloudflare handles network traffic, security (DDoS protection, WAF, bot management), and email forwarding via Email Routing. Cloudflare is based in the US and operates under the Standard Contractual Clauses for international data transfers. More info: cloudflare.com/privacypolicy.

Google (Gmail)

Emails forwarded through Cloudflare Email Routing reach my Gmail inbox (Google LLC). Google processes data according to its own Privacy Policy and participates in the EU–US Data Privacy Framework.

I currently don't use any CRM platforms, third-party email marketing services, or analytics tools that collect personal user data.

6. International data transfers

Cloudflare and Google are based in the United States. Data transfers comply with GDPR requirements: both companies participate in the EU–US Data Privacy Framework and/or use Standard Contractual Clauses approved by the European Commission. See their respective privacy policies for details.

7. Data security

I apply appropriate technical and organisational measures to protect your data from unauthorised access, loss, or disclosure:

• All communications happen over HTTPS with a TLS certificate provided by Cloudflare.
• Forms include multi-layer anti-spam and anti-bot protection (honeypot field, time-trap, Origin/Referer validation).
• I don't store form data on my own databases — once forwarded by email, it lives only in my inbox.
• The Cloudflare network provides DDoS protection and a Web Application Firewall at the infrastructure level.

8. Automated decision-making and profiling

I do not carry out any automated profiling or decision-making that produces legal or similarly significant effects on individuals, as defined under Art. 22 GDPR.

9. Your rights

As a data subject, you have the following rights under GDPR (Arts. 15–22):

• Access (Art. 15): find out whether I hold your data and get a copy of it.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): request removal of your data ("right to be forgotten").
• Restriction (Art. 18): ask that data be stored but not further processed.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdrawal of consent: revoke consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, write to francesco.sguotti03@gmail.com. I'll respond within 30 days as required by GDPR. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante): garanteprivacy.it.

10. Cookies and similar technologies

For detailed information about cookies and localStorage on this site, see the Cookie Policy.

11. Changes to this policy

This policy may be updated to reflect regulatory changes or updates to how the site works. The "Last updated" date at the top of this page always shows the current version. If I make material changes that affect data you've already provided, I'll notify you directly by email.