Privacy Policy

Introduction

This privacy policy describes how personal data of users visiting the paolo.design website are processed, in accordance with Art. 13 of Regulation (EU) 2016/679 (GDPR).

The site is a personal portfolio that also presents design services. It does not require registration. It offers a contact form, which is the only place where you hand over data that identifies you, and only if you choose to write.

Data controller

The Data Controller is Paolo Frassato, freelance professional, VAT IT13496670012, based in Italy.

For any request relating to personal data you can write to: paolo.frassato@gmail.com

Types of data collected

The site collects only browsing data via Google Analytics 4, and only after your explicit consent. No data is collected if you refuse consent through the cookie banner.

The data collected include: • IP address (anonymized/truncated by Google Analytics) • Browser type, operating system and device • Pages visited, time on page and navigation path • Interaction events (button clicks, card swipes in the Match section) • Referrer source

If you send the contact form, the following are also processed, and only because you typed them in: • Name • Email address • What you do (optional) • The type of project and the indicative budget you select • The message you write

Alongside these, the form records the page you sent it from and the campaign parameters in its address (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid), so that a request can be traced back to the advertisement that brought you here. There is no registration and no login on the site.

Purposes of processing

The collected data are used exclusively for aggregated statistical purposes, in order to understand how users interact with the site and improve the experience. They are not used for individual profiling, direct marketing or automated decision making.

The data you send through the contact form are used for one purpose only: to read your request and reply to it. They are never used to send you newsletters or commercial communications you did not ask for, and they are never sold or handed to third parties for their own purposes.

Legal basis

The legal basis for processing is the free and informed consent given through the cookie banner on first visit (Art. 6(1)(a) GDPR).

Consent can be withdrawn at any time by clicking "Manage cookies" in the footer.

For the data you send through the contact form the legal basis is different: it is the performance of pre contractual measures taken at your request (Art. 6(1)(b) GDPR). No cookie consent is needed to write to me, and refusing cookies does not stop the form from working.

Data recipients

The data collected may be processed by the following third parties, as data processors or independent controllers: • Google LLC (Google Analytics 4). United States • Render Services Inc. (hosting). United States • Resend (Plus Five Five, Inc.), which delivers the contact form message to my inbox. United States

These providers process the data only to ensure the operation of the service, in accordance with their own privacy policies.

Transfer of data outside the EU

Some of the providers listed above are based in the United States. The transfer of data outside the EU takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.

Data retention

Data collected via Google Analytics are kept for a maximum of 14 months, after which they are automatically deleted. Your cookie consent (granted/denied) is stored in your browser until you withdraw it or clear it manually.

A message sent through the contact form reaches my email inbox and stays there as long as it is useful to the exchange it belongs to, and in any case no longer than 24 months from the last contact. You can ask me to delete it earlier at any time, at paolo.frassato@gmail.com.

Your rights

As a data subject you have the right, at any time, to: • Access your personal data (Art. 15 GDPR) • Request their correction (Art. 16 GDPR) • Request their deletion (Art. 17 GDPR) • Restrict processing (Art. 18 GDPR) • Object to processing (Art. 21 GDPR) • Receive your data in a structured format (Art. 20 GDPR) • Withdraw consent at any time • Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

You can exercise these rights by writing to paolo.frassato@gmail.com.

Contact

For any question or request regarding this notice or the processing of your personal data, you can write to: paolo.frassato@gmail.com

Changes to this notice

This notice may be updated over time. The last update date is shown at the top of the page. Please review it periodically.