Privacy and legal notice

Who processes your data

The data controller is me, Giorgio Contenti, through my sole proprietorship Acacia Technologies Giorgio Contenti, with registered office at Strada Pino Torinese 22/13, 10020 Baldissero Torinese (TO), Italy, VAT no. 07350950486. For any privacy matter you can email me at dev [at] giorgiocontenti.com.

I have not appointed a data protection officer (DPO), because it isn't required for a business like mine.

What data I collect

• Data you send me through the contact form: full name, email and, if you provide them, company, phone, link to the app or code, project information and your message.
• Data you send me by email, if you write to me directly.
• Technical browsing data: IP address, browser type, page visited, date and time. It's recorded automatically by Cloudflare, the service that hosts the site.

Please don't enter passwords, access keys or personal data of your app's users in the form. If I need them for the work, we'll handle them later, securely and with a written agreement.

Why I use it

• Replying to your request and preparing a quote. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• Running the site and protecting it from abuse and attacks. Legal basis: my legitimate interest in the security of the site (Art. 6(1)(f) GDPR).
• Complying with legal obligations, for example tax obligations if you become a client. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

I don't use your data for newsletters or advertising, I don't sell it and I don't use it to profile you. No decision about you is made automatically.

What happens if you don't provide it

Your name and email are needed so I can reply: without them, I can't follow up on your request. All other fields are optional.

Who else can see it

Your data is not published or passed on. Only the following can access it:

• the providers that help me run the site, the contact form and email, who process it on my behalf as data processors, under a written agreement (Art. 28 GDPR);
• the developers on my team, independent professionals, some of whom work outside the European Union. To assess your request I only show them the technical information, that is the description of the problem and the code, without your name, email, phone or company. If you become a client and the work requires access to personal data, they process it on my behalf as data processors, under a written agreement (Art. 28 GDPR);
• public authorities, only when required by law.

The providers I currently use are:

• Cloudflare (Cloudflare, Inc.): hosts the site and protects it from abuse and attacks;
• Web3Forms (Web3Creative): receives the contact form data and forwards it to me by email;
• Namecheap (Namecheap, Inc.): runs my email inbox.

If I change providers, I update this list.

Data outside the European Union

Some providers and collaborators process data outside the European Union. Transfers only take place with the safeguards provided by the GDPR (Articles 45 and 46):

• United States, Cloudflare: the company participates in the EU-US Data Privacy Framework, which the European Commission recognises as adequate; its data processing agreement also includes the standard contractual clauses;
• United States, Namecheap (email): standard contractual clauses approved by the European Commission, included in its data processing agreement;
• India, Web3Forms (contact form): standard contractual clauses approved by the European Commission, included in its data processing agreement;
• Team developers working outside the EU: they only receive personal data if you become a client and the work requires it, under the standard contractual clauses approved by the European Commission.

You can ask me for a copy of the safeguards in place by emailing dev [at] giorgiocontenti.com.

How long I keep it

• Requests that don't become a job: 12 months from the last contact, then I delete them.
• If you become a client: for the whole duration of our relationship. I keep contracts and tax documents for 10 years, as required by law (Art. 2220 of the Italian Civil Code).
• Technical browsing data: normally no longer than 30 days, unless needed to investigate abuse.

How I protect it

The site uses an encrypted connection (HTTPS). Your contact details are accessible only to me, through protected accounts. I only show the team developers what they need for the work.

Your rights

At any time you can ask me to:

• access your data and receive a copy;
• correct or update it;
• delete it;
• restrict its use;
• receive it in a machine-readable format, to pass it on to others (portability).

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on my legitimate interest, that is processing for the security of the site (Art. 21 GDPR).

To exercise your rights, just email me at dev [at] giorgiocontenti.com. I'll reply within one month, as required by the GDPR, and usually much sooner. If you think your data is being processed unlawfully, you can lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali), at garanteprivacy.it.

Cookies

This site doesn't use profiling cookies, analytics tools that track you or third-party content such as videos, maps or social buttons. Even the fonts are loaded from the site itself and not from external servers. Only technical cookies essential for the site to work and stay secure may be used, and by law they don't require your consent. That's why you don't see a cookie banner.

If in the future I add tools that require consent, I'll ask you before enabling them and update this page.

Changes to this policy

If I change the way I process data, I'll update this page and the date shown at the top.