Who processes your data
The data controller is Michele Laurelli, based in Savona, Italy. You can contact me about anything related to your personal data at ciao@michelelaurelli.it.
I have not appointed a data protection officer (DPO), because the law does not require one for a site of this size and with this kind of processing (article 37 GDPR). Requests come straight to me.
Which sites it covers
This policy applies to:
- michelelaurelli.it, my personal website;
- blog.michelelaurelli.it, the blog, in Italian and English.
Other sites I link to, including those of my books and of the companies I founded, have their own policies. The same goes for LinkedIn, GitHub, the publications in the press section and the sources cited in articles: when you open an external link, that site's rules apply.
If we start working together, the data we exchange for that work is processed under our contract and a dedicated notice, which I give you at that point.
What data I collect
Browsing data
Like every website, the server automatically logs some technical information for each page requested: IP address, date and time, page address, referring page, browser and operating system, outcome of the request. It is not meant to identify you, but in particular cases it could, if combined with other data.
Data you give me
If you write to me through the contact form or by email, I receive your name, email address, the topic you chose and the text of your message, plus anything else you decide to include. Please do not send me special categories of data, such as health information or political or religious opinions, unless they are truly needed for your request.
Analytics data, only with your consent
If you accept analytics, Google Analytics 4 collects in pseudonymous form: a random identifier stored in a cookie, the pages and sections you visit, time spent, the site you came from, device type, browser, language and an approximate location at city or country level. Google derives the location from your IP address and then discards it: Analytics 4 does not log or store the IP addresses of European visitors.
Preferences
Your browser remembers your cookie choice and whether the site audio is on. This is technical information that does not identify you.
Why I use it and on what basis
Each processing activity has a specific purpose and a legal basis under article 6 GDPR. Here they all are, with retention periods.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running the site and protecting it from abuse and attacks | Browsing data | Legitimate interest in security (art. 6.1.f) | Up to 30 days, unless needed to investigate an offence |
| Answering your messages and following up on your requests | Name, email, topic, message | Pre-contractual steps at your request (art. 6.1.b) and legitimate interest in replying (art. 6.1.f) | 24 months from the last contact, unless a professional relationship follows |
| Understanding, in aggregate, how many people visit the sites and what they read | Google Analytics data | Consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code) | Cookies up to 2 years, data in Analytics for 14 months |
| Remembering your cookie and audio choices | Preferences | Strictly necessary tools, exempt from consent (art. 122 of the Italian Privacy Code) | Cookie choice 6 months, audio until you clear your browser data |
| Defending or enforcing a right, including in court | Only the data strictly needed | Legitimate interest (art. 6.1.f) | For the duration of the proceedings and until the relevant rights lapse |
I do not use your data for any other purpose. If I ever need to, I will tell you first and, where required, ask for your consent.
What is required and what is not
- Browsing data: needed to show you the pages; without it the site cannot be visited.
- Name, email and message in the form: needed to reply to you. The topic is optional.
- Analytics: entirely optional. If you decline, the site works exactly the same.
Who I share data with
I do not sell, rent or disclose your data. Only these providers process it on my behalf, as processors bound by a contract under article 28 GDPR:
| Provider | Service | Where the data is |
|---|---|---|
| OVH SAS | Hosts the sites and the server that logs browsing data | European Union |
| Formspree, Inc. | Delivers messages sent through the contact form to my inbox | United States, under standard contractual clauses |
| Google Ireland Limited | Google Workspace: runs the mailbox where I receive your emails and form messages | European Union and United States (Google LLC), under the Data Privacy Framework |
| Google Ireland Limited | Google Analytics, only if you consent | European Union and United States (Google LLC), under the Data Privacy Framework |
Data may be disclosed to public authorities only when the law requires it, for example at the request of a court. The up-to-date list of providers is always available on request.
Transfers outside the European Union
Two providers may process data in the United States. In both cases the transfer is covered by the safeguards required by the GDPR:
- Google LLC, for Google Workspace and Google Analytics, participates in the EU-U.S. Data Privacy Framework, found adequate by the European Commission in its decision of 10 July 2023 (article 45 GDPR). Google also applies standard contractual clauses.
- Formspree, Inc. processes form messages under the standard contractual clauses approved by the European Commission (article 46 GDPR).
You can request a copy of these safeguards at ciao@michelelaurelli.it. If you prefer your message not to go through a US provider, email me directly instead of using the form.
How I protect data
The sites are served only over encrypted HTTPS connections. Access to the servers, mailbox and analytics tools is restricted to me and protected by personal credentials. I keep only the data I need, for as long as I need it, and delete it when it is no longer necessary.
I make no automated decisions and do no profiling on this data within the meaning of article 22 GDPR. In the event of a data breach likely to put your rights at risk, I will notify the Italian supervisory authority within 72 hours and, where the law requires it, you as well.
Your rights
The GDPR gives you real control over your data. At any time you can:
- Art. 15Access
Find out whether I process data about you and get a copy.
- Art. 16Rectify
Have inaccurate data corrected or incomplete data completed.
- Art. 17Erase
Have your data deleted when there is no longer a reason to keep it.
- Art. 18Restrict
Ask for your data to be stored only, with no other use, for example while you contest it.
- Art. 20Port
Receive it in a machine-readable format and pass it to another controller.
- Art. 21Object
Object to processing based on legitimate interest, on grounds relating to your situation.
- Art. 7.3Withdraw consent
Withdraw your analytics consent at any time, without affecting what happened before.
- Art. 77Complain
Lodge a complaint with a supervisory authority if you think your data is mishandled.
How to exercise them
Just send an email to ciao@michelelaurelli.it, no formalities needed. It is free. I reply within one month, which may be extended by two further months for complex requests: in that case I will tell you and explain why (article 12 GDPR). If I have reasonable doubts about your identity I may ask for some information to verify it, only to avoid handing your data to the wrong person.
To withdraw analytics consent you do not need to write to me: open the and turn the switch off.
The Italian supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it. If you live in another EU country you can contact your local authority.
Children
The sites are not intended for children under 14 and I do not knowingly collect their data. If you are a parent and think your child has written to me, contact me at ciao@michelelaurelli.it and I will delete their data.
Changes to this policy
If the services I use or the rules change, I update this page and the date at the top. If the changes affect how I use data collected with your consent, the banner will ask you to choose again.
Version history
- 2.06 October 2026
Complete rewrite. Extended to the blog, in-house consent management replacing iubenda, cookie policy and terms of use as separate documents.
- 1.xUntil October 2026
Policy generated with iubenda.