Privacy Policy.

Last updated 29 September 2026

This page explains what personal data brunofrancesco.it collects, why, and what rights you have. It is written in plain language, but it is the privacy notice required by Articles 13 and 14 of the EU General Data Protection Regulation 2016/679 (GDPR). It is a translation of the Italian version, which prevails in case of doubt.

Who the data controller is

The data controller is Francesco Bruno. For any privacy question you can write to me at info@brunofrancesco.it.

I have not appointed a Data Protection Officer (DPO), because it is not required for a site like this one.

What data I collect

Data you give me

If you use the contact form I collect your name, email address and the text of your message. If you email me directly I receive your email address and whatever you choose to tell me. Please do not include data that is not needed to answer your request, especially special categories of data such as health information.

Data collected while you browse

Like any website, this one records some technical data when you visit, such as IP address, browser type, date and time of the visit and the pages requested. This data is needed to run the site and protect it from abuse and cyber attacks.

Fonts, images and scripts are hosted on my own server, so while you browse your browser does not connect to external services such as Google Fonts.

Why I use your data and on what legal basis

• To answer your requests. I use the data from the form or your email to reply, arrange an intro call if needed and assess a possible collaboration. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and the consent you give by ticking the box in the form (Art. 6(1)(a) GDPR).
• To keep the site secure. I use technical data to prevent spam, unauthorised access and other abuse. The legal basis is my legitimate interest in protecting the site and its visitors (Art. 6(1)(f) GDPR).
• To meet legal obligations. If a request turns into a project, some data is needed for tax and accounting purposes (Art. 6(1)(c) GDPR).

How the contact form works

When you send the form, the message reaches my inbox as an email and is not stored in the site database. To block automated submissions, the site keeps a code derived from your IP address with a one way function for 30 seconds, then deletes it automatically. The form also contains a hidden field that only serves to detect bots and collects nothing about you.

How long I keep data

• Emails and form messages stay in my inbox for as long as needed to handle the request, and in any case no longer than 24 months after the last contact, unless a collaboration starts.
• If a project starts, I keep the necessary data for the period required by Italian law for tax and accounting records, which is 10 years.
• Technical browsing data and security logs are kept only as long as strictly needed to protect the site, then deleted or anonymised.

Who else processes the data

I do not sell or share your data with anyone. To run the site I rely on a few providers that process data on my behalf as data processors (Art. 28 GDPR).

• Hosting and domain. The site and the brunofrancesco.it domain are managed by IONOS SE, a company based in Germany that uses data centres in Europe.
• Email. The info@brunofrancesco.it mailbox, where form messages arrive, is also managed by IONOS SE.
• Security. The site uses Wordfence, a security plugin that runs directly on the site server and analyses incoming requests to block attacks and unauthorised login attempts. To do this it records the IP address and technical data of the visit. With the current settings this data stays on the server and is not shared with Defiant Inc., the US company that develops the plugin.

Transfers outside the European Union

If one of the providers listed above processes data outside the European Economic Area, the transfer only takes place with the safeguards provided by the GDPR, such as European Commission adequacy decisions or standard contractual clauses, as described in each provider’s privacy notice.

Cookies

To find out which cookies the site uses and how to manage your preferences, see the Cookie Policy. The choices you make in the banner stay in your browser and are not sent to third parties.

Links to other sites

The site contains links to external websites, such as my LinkedIn profile and the websites of projects I worked on. When you open them, the privacy notices of those sites apply, and I have no control over them.

Your rights

At any time you can ask me to

• access your data and receive a copy (Art. 15 GDPR)
• correct or update it (Art. 16)
• delete it (Art. 17)
• restrict its processing (Art. 18)
• receive it in a machine readable format to transfer it to another controller (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw your consent, without affecting what was done before the withdrawal (Art. 7(3))

To exercise these rights write to me at info@brunofrancesco.it. I will reply within one month, as required by the GDPR. If you think your data is being processed incorrectly you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at garanteprivacy.it, or with the supervisory authority of the EU country where you live.

Mandatory data and automated decisions

Name, email and message are needed to send the form, and without them I cannot reply. I do not use your data for profiling or automated decision making.

Minors

The site is not intended for people under 14. If you notice that a minor has sent me personal data, write to me and I will delete it.

Changes to this notice

I may update this page when the site, the providers or the law change. The date at the top shows the last change.