Privacy notice

The data controller is Angelo Romano, trading as Angelo Romano Studio, VAT number IT18449281007. For information about the processing of your data or to exercise your rights, write to angeloromano.2405@gmail.com.

Browsing: the systems serving the website receive your IP address, browser and device information, requested page, date and time, request status and other technical metadata needed for the connection.

Contact form: your name, email address, requested service and message are required to submit and handle the enquiry. Phone number and budget are optional. We also receive the language and submission page path; the source field sent by the website excludes URL query parameters and fragments.

Call request: we receive your name, email, preferred day, time slot and contact method. A phone number is required for telephone or WhatsApp calls and optional for video calls; the topic is optional. This is an appointment request, subject to confirmation by email.

Providing information is voluntary. Without the fields marked as required, you cannot submit the relevant form; you can still contact us by email. Do not include passwords, identity documents, health information or other confidential details that are unnecessary to describe your project.

We respond to requests for quotations, arrange contact and take steps you request before a possible engagement under Article 6(1)(b) GDPR. For general correspondence or communications with company representatives, processing relies on the legitimate interest in responding to incoming enquiries and managing professional relationships, under Article 6(1)(f).

Technical data are used to make the website available, prevent abuse and investigate faults. The legal basis is the legitimate interest in the security and operation of the service, Article 6(1)(f). Where the law requires retention or disclosure, the legal basis is Article 6(1)(c).

Enquiries are not used for marketing, and submitting a form does not subscribe you to a newsletter. Reading this notice is not consent: we use the legal bases above to respond to your request.

Optional analytics and advertising trackers are disabled. The website does not load Google Analytics, advertising pixels or tools to record visitors’ sessions.

Vercel Inc. hosts the website and operates its delivery and security infrastructure. Normal browsing requests and associated technical data pass through this service.

Forms send data to Web3Forms, operated by Web3Creative from India, which delivers submissions to the controller’s inbox. It uses AWS, Cloudflare and Hetzner infrastructure and may share IP and email addresses with CleanTalk and Akismet for spam checks. Its data processing agreement governs submissions processed on the controller’s behalf.

Correspondence is received and managed in the controller’s Gmail inbox. Google processes data under the service’s terms and privacy policy. The personal Gmail account is not covered by the data processing agreement offered for Google Workspace.

Data are accessible to the controller and providers involved in delivering the services. They may be disclosed to professionals engaged for compliance or the protection of rights, and to authorities, only where necessary and supported by an applicable legal basis. Enquiry data are not published on the website.

These services may involve processing outside the European Economic Area, particularly in the United States and India. Web3Forms incorporates the European Commission’s Standard Contractual Clauses in its data processing agreement. Google describes its use of applicable adequacy decisions, including the EU–US framework for participating entities, and Standard Contractual Clauses.

Vercel states that it participates in the EU–US Data Privacy Framework for transfers covered by that framework; its terms also provide for Standard Contractual Clauses where applicable. To learn about the safeguards relevant to your data and obtain the corresponding information, consult the linked documents or contact the controller.

Enquiries without an engagement: the controller retains correspondence for no more than 12 months after the last relevant contact, then deletes messages and unnecessary copies. If a specific dispute arises, only the information needed to protect legal rights is retained separately until resolution and the end of applicable limitation periods.

If an enquiry leads to an engagement, necessary documentation is handled to perform the relationship and meet applicable contractual, tax and legal obligations. Not every message becomes an accounting record: unnecessary data are deleted under the rule above. Any additional processing associated with the engagement is described separately.

The copy held by Web3Forms is retained separately from email: the provider’s published DPA specifies a technical lifespan of up to three years for submissions. A shorter dashboard visibility period does not necessarily mean deletion. You may contact the controller about erasure, including requests requiring the provider’s involvement.

Infrastructure data follow Vercel’s criteria for service delivery, incident handling and legal obligations; the website does not create its own additional IP address archive. These operations are separate from message retention in the email inbox.

WhatsApp links open the service only when selected; the prefilled message is not sent automatically. If you choose WhatsApp, your data are also processed by WhatsApp Ireland Limited under its privacy policy. Agreed video calls may use Google Meet: the invitation and call take place after the website request.

Links to LinkedIn, GitHub and project websites lead to independent services with their own privacy policies. Website videos, images and fonts are served directly by this website; the chat demo is a local simulation and does not send conversations to an artificial intelligence service.

Write to angeloromano.2405@gmail.com to request access, correction, erasure, restriction and, where applicable, portability of your data. You can object to processing based on legitimate interests on grounds relating to your particular situation. Rights apply within the conditions and limits of Articles 15–22 GDPR.

Where processing relies on consent, you can withdraw it at any time. We normally respond within one month of receiving a request; any extension permitted by the GDPR will be explained. Requests are normally free, and identity checks are limited to what is necessary.

You can lodge a complaint with the Italian Data Protection Authority (Garante) or the competent authority where you habitually live or work, or where you believe an infringement occurred. The website does not use data for solely automated decisions producing legal or similarly significant effects on an individual.

This notice covers website visitors and contacts. If an engagement requires further processing, including data handled on a client’s behalf, its purposes, roles and terms are defined in the documents for that service. Updates to this page carry a new date; changing this text alone does not authorise new processing requiring consent.