Privacy Policy

Privacy information pursuant to art. 13 of Regulation (EU) 2016/679

Responsible for data processing

Fabio Campilongo’s Technical Design Studio — Data Controller
Headquarters in Via Gregorio Leti 9, 20157 Milan
privacy@fabiocampilongo.it
3444101122

1. Data you provide voluntarily (contact form and published contact details)
When you fill in the contact form or write to the published contact details, we collect your first name, last name, e-mail address and any information you choose to include in your message. We also collect the data needed to carry out any professional assignment.
Messages sent through the contact form are forwarded by e-mail to the Studio, and a copy is stored in the website database together with the date and time of submission, IP address and browser type.
Purpose: to reply to enquiries and to provide consultancy services.
Legal basis: performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c)). For the technical data of the submission: legitimate interest in the security of the website (Art. 6(1)(f)).
Retention: enquiries that do not lead to an assignment are deleted, including from the website archive, within 12 months of submission. Data relating to an assignment are kept for the period required by civil and tax law (normally 10 years).

2. Comments and avatars (Gravatar)
When you leave a comment, the website collects:

• the name, e-mail address (not published) and any website you enter in the form;
• the text of the comment;
• your IP address and browser type, to detect spam.

If you choose to, your browser can store your name and e-mail address in a cookie so that you do not have to enter them again. The cookie lasts one year.
Purpose: to publish and moderate comments.
Legal basis: consent, given by voluntarily submitting the comment (Art. 6(1)(a) GDPR).
Retention: comments and the related data are kept for as long as they remain published. You may request their deletion at any time.

Gravatar avatars. Next to comments, the website may display the profile picture provided by Gravatar, a service of Automattic Inc. (60 29th Street #343, San Francisco, CA 94110, USA). Avatars are loaded only after you consent to the “Avatar dei commenti (Gravatar)” option, which you can do from the banner or from “Preferenze privacy”. Until then, a generic image provided by the website is shown instead, and nothing is sent to Gravatar.
After consent:

• a hashed string derived from the commenter’s e-mail address is sent to Gravatar. The e-mail address itself is not transmitted;
• your browser downloads the images from Gravatar’s servers, which receive your IP address and your browser’s technical information.

Purpose: to display the commenter’s profile picture.
Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
Automattic privacy policy: https://automattic.com/privacy/

3. Browsing data and website statistics
During your visit, the website automatically records some technical information:

• pages visited, date and time, referring page;
• browser type, operating system and device;
• IP address, anonymised by setting its last part to zero.

These data are used solely to produce aggregate statistics on the use of the website and do not allow individual visitors to be identified. Statistics are processed directly on the website’s server, without cookies and without sending data to external analytics services.
Legal basis: the Controller’s legitimate interest in understanding and improving the use of its website (Art. 6(1)(f) GDPR).
Retention: 180 days, after which the data are deleted automatically.

4. Website security and spam protection
To protect the website against unauthorised access, cyber attacks and automated submissions, the website carries out the following activities.

• It records security events: attempts to access the reserved area (successful and failed), requests to the XML-RPC service, attempts to discover usernames, and requests for non-existent pages typical of automated scans. For each event it records the full IP address, date and time, any username entered and the declared browser type.
• It blocks IP addresses that repeatedly fail to log in. These addresses are denied access to the login page, while the rest of the website remains accessible.
• It filters spam in the contact form and in comments. It does so with automated checks carried out entirely on the website’s server, without external services and without cookies, such as a hidden field and a minimum time to complete the form. For messages identified as spam, it records the IP address, the e-mail address entered, the date and the reason for blocking.

Purpose: to detect and block malicious activity and automated submissions, and to protect the integrity of the website and the data it contains.
Legal basis: the Controller’s legitimate interest in network and information security (Art. 6(1)(f) and Recital 49 GDPR).
Retention: security events and the spam log are kept for 180 days, after which they are deleted automatically. Blocked IP addresses remain on the list for the duration of the block. Data may be kept longer where needed to establish or defend legal claims.

5. Google Maps
To show the location of the Studio, the website may display an interactive Google Maps map, provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), a company of the Google LLC group (USA). When the map is activated, your browser connects to Google’s servers, which receive your IP address and your browser’s technical information and may set cookies.
The map is loaded only after you consent to the “Mappe (Google Maps)” option, which you can do from the banner, from the button on the map or from “Preferenze privacy”. Until then, a placeholder box is shown in its place, and nothing is sent to Google.
Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
Google privacy policy: https://policies.google.com/privacy

6. Consent log
When you make a privacy choice (accept, reject or customise), the website records:

• a random consent code;
• date and time;
• the choices made for each option;
• your anonymised IP address;
• your browser type;
• the page on which you made your choice.

The code is shown in the “Preferenze privacy” window and allows your choices to be retrieved if you ask about them.
Purpose: to demonstrate that consent has been properly obtained (Art. 7(1) GDPR).
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
Retention: 24 months, after which the data are deleted automatically.

7. Cookies and third-party services
The website uses:

• technical cookies, necessary for the website to work, which do not require consent:
  • fc_consent: stores your privacy choices, lasts 180 days;
  • WordPress cookies for access to the reserved area, used only by those who administer the website;
  • optional comment cookies (section 2);
• third-party services activated only with your consent, option by option:
  • “Mappe (Google Maps)”, which may set cookies (section 5);
  • “Avatar dei commenti (Gravatar)” (section 2).

The website does not use profiling cookies for advertising purposes or statistics cookies: the statistics described in section 3 work without cookies.
You can change or withdraw your choices at any time, even for a single option, using the “Preferenze privacy” button at the bottom of every page. You can also block or delete cookies in your browser settings.

8. Disclosure and dissemination of data
Data are not disseminated, except for the name and text of published comments. They may be accessed by:

• the Studio’s collaborators, who are authorised to process them;
• technical service providers acting as Processors under Art. 28 GDPR, in particular the hosting provider IONOS SE, whose servers are located in the European Union;
• Google and Automattic, only if you consent to the relevant options: the map (section 5) and Gravatar avatars (section 2).

Data may be disclosed to judicial or police authorities where required by law or to report a cyber attack.

9. Transfers outside the EU
Only if you consent to the “Mappe (Google Maps)” or “Avatar dei commenti (Gravatar)” options, some data, such as your IP address and the hash of commenters’ e-mail addresses, may be transferred to the United States. Google LLC and Automattic Inc. participate in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023 (Art. 45 GDPR). Without your consent, no data leave the European Union.

10. Rights of the data subject
Under Articles 15 to 22 GDPR you may request at any time:

• access to your personal data;
• rectification and erasure;
• restriction of processing;
• data portability.

You may also object to processing based on legitimate interest and withdraw any consent you have given, without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, write to privacy@fabiocampilongo.it
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

11. Whether providing data is mandatory
Providing data in the contact form and in comments is optional, but without them we cannot reply to you or publish your comment. Browsing, security and anti-spam data are collected automatically and are necessary for the secure use of the website.

Last updated: 29 September 2026