Privacy policy

Last updated: 5 November 2026

This policy explains which personal data are processed when you visit this website or contact its owner, for what purposes and with what safeguards. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Italian Privacy Code"), as amended by Legislative Decree 101/2018.

In short

  • The website uses no cookies and does no profiling or advertising.
  • Visit statistics are anonymous and aggregated.
  • Your contact details reach the owner only if you decide to write to him, by email or WhatsApp.
  • Data are never sold or handed over to anyone.

Data controller

Alessio Toninello, Bologna (Italy), VAT number IT04270241203.

Email: alessio.toninello@gmail.com

The controller has not appointed a data protection officer (DPO), as this is not required for this activity (Article 37 GDPR).

What data are processed

Browsing data

When you visit the website, the service that hosts it automatically records some technical data, which are essential to show you the pages and to protect the website: IP address, date and time of the request, requested page, browser and device type, referring page. These data are not used to identify you.

Visit statistics

The website uses Vercel Web Analytics to learn, in aggregated form, how many visits it receives, which pages are read, from which kind of device and where visitors come from. Some links to the website contain a "ref" parameter, which only shows the channel the link comes from (for example LinkedIn) and contains no personal data.

The tool uses no cookies and stores nothing on your device. To tell visits apart, it creates an encrypted code (hash) from the request, which is deleted after 24 hours and cannot be used to follow you on other websites. The controller only sees aggregated data, which do not allow you to be identified.

Data you send

If you write to the controller by email or WhatsApp, he receives the data you choose to share: name, email address or phone number, the content of the message and any attachments (for example the description of a project or a job offer). Please do not send special categories of data, such as health data (Article 9 GDPR), unless strictly necessary.

CV download

Downloading the CV requires no data at all.

Purposes and legal basis

  • Replying to your messages and assessing collaboration or job proposals. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). For other kinds of messages: the controller's legitimate interest in replying to those who contact him (Article 6(1)(f)).
  • Managing a professional or employment relationship arising from the contact. Legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations, for example tax and accounting ones (Article 6(1)(c)).
  • Running the website and protecting it from abuse and cyber attacks. Legal basis: the controller's legitimate interest (Article 6(1)(f)).
  • Measuring the use of the website in anonymous and aggregated form, to improve its content. Legal basis: the controller's legitimate interest (Article 6(1)(f)). This processing uses no cookies and neither stores nor reads information on your device, so it does not require your consent (Article 122 of the Italian Privacy Code).
  • Establishing, exercising or defending legal claims, if needed. Legal basis: the controller's legitimate interest (Article 6(1)(f)).

Data are not used for marketing, newsletters or profiling. No decisions are made based solely on automated processing (Article 22 GDPR).

Providing your data

Browsing data are necessary to visit the website. Writing to the controller is optional; without your contact details, however, he cannot reply to you.

How data are processed

Data are processed with IT tools, only by the controller, with technical and organisational measures suited to protect them from unauthorised access, loss or disclosure, including an encrypted connection (HTTPS) and protected access to the accounts of the services used.

Who receives the data

Data are not disclosed to the public or sold. They may only be processed by:

  • Vercel Inc. (United States), which hosts the website and provides the visit statistics, as a processor on behalf of the controller (Article 28 GDPR).
  • Google, which provides the Gmail email service used by the controller, for messages received by email.
  • WhatsApp Ireland Limited (Meta group), if you write on WhatsApp. WhatsApp processes the data as an independent controller, under its own privacy policy.
  • Professionals engaged by the controller, for example his accountant, only if a professional relationship arises and for the related legal obligations.
  • Public authorities, where required by law.

Transfers outside the European Union

Vercel, Google and Meta may process some data in the United States. Transfers are based on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Article 45 GDPR), for the providers that participate in it, or on the standard contractual clauses approved by the European Commission (Article 46 GDPR).

How long data are kept

  • Messages and contact details: for as long as needed to handle the request. If no relationship arises, for no longer than 24 months from the last contact.
  • Data related to a professional relationship: for the whole duration of the relationship and then for 10 years, as required by Italian civil and tax law (Article 2220 of the Italian Civil Code).
  • Browsing data: for short periods, according to the settings of the hosting service, unless they are needed to establish abuse or offences.
  • Visit statistics: the code that tells visits apart is deleted after 24 hours; aggregated data identify no one.

When these periods end, data are deleted or anonymised.

Your rights

At any time you can ask the controller (Articles 15–22 GDPR):

  • for access to your data and a copy of them;
  • for the rectification of inaccurate or incomplete data;
  • for the erasure of your data;
  • for the restriction of processing;
  • for the portability of the data you provided, in a structured, commonly used format;
  • to object, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21 GDPR).

To exercise your rights, write to alessio.toninello@gmail.com. The controller replies within one month of the request; this period may be extended by two further months for complex requests (Article 12 GDPR). Requests are free of charge.

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work (Article 77 GDPR).

Children

The website is not aimed at children under 14, and the controller does not knowingly collect their data.

Links to other websites

The website contains links to external services, such as LinkedIn and WhatsApp. When you open them, the processing of your data is governed by the privacy policies of those services.

Cookies

The website uses no cookies. You can find all the details in the cookie policy.

Changes to this policy

This policy may be updated, for example if the services used by the website or the applicable rules change. The date of the last update is shown at the top. Any significant change will be published on this page.