Privacy notice

This notice is provided under Article 13 of Regulation (EU) 2016/679 (GDPR). No data protection officer has been appointed.

What data I process

• Contact form

  Your name, email address and message, including anything else you choose to write. Please leave out health data, political or religious opinions and other special categories of data.

• Form protection

  The IP address you send the message from, used only to limit repeated or automated submissions.

• Browsing

  Like any website, the server receives your IP address and the technical details of each request: page, date and time, browser.

• Optional analytics

  When enabled and only with your consent, Google Analytics 4, loaded through Google Tag Manager, processes page visits, session and device information, referral information and cookie identifiers to describe use of the site. It is not used for advertising or remarketing. The contact form’s name, email and message are not sent to Analytics.

Browser storage, optional analytics cookies and your choices are described in the cookie policy. Google also explains how it uses information from sites that use its services.

Why I process it, and on what legal basis

• Replying to your message

  Legal basis

  Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) when you write about work or a collaboration; otherwise my legitimate interest in replying to people who contact me (Art. 6(1)(f)).

• Protecting the form

  Legal basis

  Legitimate interest in keeping the site safe from abuse and automated submissions (Art. 6(1)(f)).

• Serving the site

  Legal basis

  Legitimate interest in delivering the site and keeping it running securely (Art. 6(1)(f)).

• Understanding use of the site

  Legal basis

  Your consent (Art. 6(1)(a) GDPR), when analytics is enabled. You may refuse or withdraw it through Cookie preferences in the footer without affecting access to the site.

Using the form is optional. Without your name, email and message, though, I cannot receive your request or reply to it.

How your message is sent

The form sends your data to the site’s server, which forwards it to me as a plain-text email through Resend. The server does not store the message in a database or write its content to logs. Your email address is used only to reply to you.

Who receives the data

These providers process the data on my behalf, as processors. I do not sell or publish your data.

• Vercel Inc.

  Role

  Hosting for the site and for the server that receives the form

  Country

  United States

• Plus Five Five, Inc. (Resend)

  Role

  Email delivery

  Country

  United States

• Google Ireland Limited

  Role

  Optional analytics through Google Analytics 4 and tag delivery through Google Tag Manager, only when enabled and accepted

  Country

  Ireland, with possible processing in the United States and other countries

• Provider of my email mailbox

  Role

  Receiving and storing the messages sent through the form

Transfers outside the European Union

Vercel and Resend process data in the United States. These transfers rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914); both providers are also certified under the EU-U.S. Data Privacy Framework. When you accept optional analytics, Google may also process data outside the EU. Google relies on the EU-U.S. Data Privacy Framework for covered transfers to Google LLC in the United States, and on Standard Contractual Clauses where applicable. You can ask me about these safeguards at marco [at] marcoianni.com.

How long I keep the data

• Messages received

  Retention

  12 months after our last exchange, then deleted. If the conversation leads to a professional engagement, I keep what that relationship needs for as long as the law requires.

• Copy held by Resend

  Retention

  30 days, for the email content and delivery data.

• IP address for the submission limit

  Retention

  At most one hour, in the server’s memory only. It is never written to disk.

• Hosting technical logs

  Retention

  Up to one day, the standard retention of Vercel’s runtime logs.

• Analytics preferences and cookies

  Retention

  The consent choice is valid for 6 months. If persistent storage is unavailable, it lasts for the tab or current page only. Google Analytics cookies last up to 2 years under its standard settings, subject to browser limits; see the cookie policy.

• Analytics reports

  Retention

  When analytics is enabled, detailed event and user data have a 2-month retention period, without restarting it when you return. Google deletes expired data in its monthly deletion cycle. This limit does not apply to aggregated reports.

Your rights

You can ask at any time to access, correct or delete your data, to restrict its processing or to receive it in a portable format. You can also object to processing based on legitimate interest (Articles 15–22 GDPR). You can withdraw analytics consent through Cookie preferences; this does not affect the lawfulness of processing before withdrawal. Write to marco [at] marcoianni.com and I will reply within one month.

If you believe your data is processed in breach of the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority, or with the authority where you live or work.

Automated decisions

I do not use your data for profiling or automated decision-making.

Changes

If the way I process data changes, I will update this page and its date.