Privacy Policy

This notice explains, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), how the personal data of people who visit derrigo.it and use its services are processed.

Data controller

Filippo Francesco D’Errigo
Via Valonne Petrara 113, Reggio Calabria
Email: filippo@derrigo.it

No data protection officer (DPO) has been appointed, as this controller is not required to have one (Art. 37 GDPR).

Where data are processed

The website, database, email and backups are hosted by Aruba S.p.A., with servers in Italy, acting as data processor (Art. 28 GDPR). Backups are encrypted and rotated: data deleted from the site also disappear from backups within 12 months.

Data processed and purposes

Browsing the site

When you visit the site, the server automatically records in its logs your IP address, date and time, the page requested, the response code, the referring page and the browser type. The purpose is to keep the site working and secure and to detect abuse. The legal basis is the controller's legitimate interest in the security of the site (Art. 6(1)(f) GDPR). Logs are deleted automatically within 14 days, unless they are needed to establish an offence.

Some site libraries (styles, icons, animations and the cookie banner) are downloaded by your browser from third-party content delivery networks: jsDelivr, cdnjs (Cloudflare, Inc.) and cdn.kiprotect.com (KIProtect GmbH). These providers receive your IP address in order to deliver the files, without cookies. The legal basis is the legitimate interest in a fast and reliable website (Art. 6(1)(f) GDPR). Fonts are hosted on the site itself: no request is sent to Google Fonts.

Contact form

When you fill in the form and send a message, I collect your name, your email address, your phone number and subject if you provide them, and the content of the message. The message reaches me by email. The purpose is to reply to your enquiry. The legal basis is the performance of pre-contractual measures or the controller's legitimate interest in replying to the communications received. Data is kept only for as long as strictly necessary to handle the communication, and in any case for no longer than 24 months.

Google reCAPTCHA

The contact form and the login and registration forms are protected by Google reCAPTCHA v3, provided by Google Ireland Limited and Google LLC. reCAPTCHA is loaded only on pages containing one of these forms and analyses technical data (IP address, browser information and interaction with the page) to tell people apart from automated programs. The legal basis is the controller's legitimate interest in protecting the forms from spam and abuse (Art. 6(1)(f) GDPR); for this reason it is listed as necessary in the cookie panel. If you do not want it to be loaded, you can write to me directly at the email address above. Google's privacy policy and termini di servizio apply.

User account

If you create an account, I process your email address, your password (stored only as a non-reversible cryptographic hash) and the data you choose to add to your profile: first name, last name, address and, for invoicing, VAT number, tax code, PEC and SDI code. The purpose is to manage your account and speed up orders and bookings. The legal basis is the performance of the service contract you accept when registering (Art. 6(1)(b) GDPR). The data are kept for as long as you keep the account; you can ask for their deletion at any time.

Orders and bookings

For orders and bookings I process the data needed to carry them out: name, contact details, shipping address, billing details, items or services chosen, amounts and payment status. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR). Accounting records are kept for 10 years, as required by Article 2220 of the Italian Civil Code.

Payments are made through PayPal: card or account details are entered directly on PayPal and never reach the site, which only receives the outcome and the transaction reference. PayPal (Europe) S.à r.l. et Cie, S.C.A. processes the data as an independent controller, under its own privacy statement.

«AI in the Public Administration» path

While you answer the questions of the path, your answers stay in your browser. To calculate the outcome they are sent to the site, processed and not stored.

If you request the full report, I process your email address, the name of your organisation if you provide it, your answers, the date of the request, the version of the notice shown and the accesses to the report (date and count). The purpose is to send you the personal link to the report and allow you to view and download it. The legal basis is the performance of a service you requested (Art. 6(1)(b) GDPR). The address is not used for newsletters, promotional communications or profiling and is not shared with third parties; the data are processed only by the technical providers of the hosting and email services used by the site.

The link stays active for 30 days; email, organisation and answers are deleted automatically after 365 days, or earlier if you ask. The link contains a random, unguessable code and only a cryptographic hash of it is stored in the database; the report page loads no analytics or pixels and tells the browser not to share its address with external sites. To limit abuse, the IP address is used temporarily in memory and is not stored. The form uses a technical security cookie against forged requests.

Google Analytics

With your consent the site uses Google Analytics 4, provided by Google Ireland Limited, for aggregate statistics on visits: pages visited, visit duration, referral source, device and browser type, approximate location. Google Analytics 4 does not log or store IP addresses; it uses the _ga and _ga_* cookies to distinguish visits. The purpose is purely statistical, to understand how the site is used. The legal basis is consent (Art. 6(1)(a) GDPR), which you can refuse or withdraw at any time with no effect on browsing. The Google Analytics script is not loaded until you give your consent.

YouTube videos and Google maps

Some pages may contain YouTube videos or Google Maps maps (Google Ireland Limited). This content is loaded only after your consent, given in the cookie panel or directly on the content: before consent your browser does not contact Google. Once loaded, Google may set its own cookies and collect data about your viewing under its own privacy policy. Videos use YouTube's privacy-enhanced mode (youtube-nocookie.com).

Cookies

The site uses technical cookies, needed for it to work, which do not require consent: browsing session and cart, protection of forms against forged requests, keeping account holders signed in, chosen language (lang cookie, valid for one year), storing your cookie choices (klaro-consent cookie, valid for 180 days). Other tools (statistics, videos, maps and any marketing) are enabled only with your consent. On your first visit a banner lets you accept all, decline all or choose by purpose; until you choose, only technical cookies are active. You can change your mind at any time from the «Manage cookies» link at the bottom of every page (open the settings now).

Who receives the data

Data are not sold or shared with third parties for their own purposes. Only the providers listed in this notice may receive them, within the limits of the service they provide, and public authorities where required by law.

Transfers outside the EU

Google, Cloudflare and Meta may also process data in the United States. The US companies involved participate in the EU-US Data Privacy Framework, found adequate by the European Commission in Implementing Decision (EU) 2023/1795 of 10 July 2023 (Art. 45 GDPR).

Whether providing data is mandatory, and automated decisions

Providing data is optional, but without the data required in the forms it is not possible to reply, create the account, carry out orders or send the requested report. The site does not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR): the outcome of the «AI in the PA» path is for information only.

Your rights

Under Articles 15–22 of EU Regulation 2016/679 (GDPR), you have the right to access your data, request its rectification or erasure, object to processing, and request restriction of processing and data portability. You can object at any time to processing based on legitimate interest and withdraw any consent given, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR). You can exercise these rights by writing to filippo@derrigo.it. I reply within one month of the request (Art. 12 GDPR). You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): garanteprivacy.it.

Changes to this notice

This notice may be updated when the site's services or the law change; the date at the top shows the latest version.