Privacy notice

Version 3, in force since 26 October 2026

This notice explains how the personal data of visitors to davide.debernardi.dev are processed, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Legislative Decree 196/2003 ("Privacy Code").

1. Data controller

The data controller is Davide Debernardi, self-employed professional, Via Libertà 18, 13856, Vigliano Biellese (BI) Italy, VAT no. IT02709310029, email davide@debernardi.dev.

The controller has not appointed a data protection officer (DPO), as one is not required for the processing described here (Art. 37 GDPR).

2. What data we process, why, and on what legal basis

2.1 Browsing data

Like any website, the systems running this site record some technical data about each request: IP address, date and time, requested page, response status and browser type. They are needed to run and secure the site (for example to detect abuse or attacks). The legal basis is the controller’s legitimate interest in running and securing the site (Art. 6(1)(f) GDPR). These data are kept for no longer than 30 days, unless they are needed to investigate a crime.

2.2 Contact by email

The site has no contact forms or newsletter sign-ups. If you write to the email address on the Contact page, we process the data you send (email address, name and message) to reply and, if you ask, to assess or carry out a professional engagement. The legal basis is taking steps at your request before entering into a contract, or performing it (Art. 6(1)(b) GDPR), and, for general enquiries, our legitimate interest in replying (Art. 6(1)(f)). Messages are kept as long as needed to handle the request; if a professional relationship follows, for its duration and for the periods required by law (for example 10 years for accounting records under Art. 2220 of the Italian Civil Code).

2.3 Record of your cookie choices

When you make a choice in the cookie banner (accept, reject or customise), the site keeps a record of it: a pseudonymous identifier, the categories accepted or rejected, the date and time and the version of the notice in force. This lets the site respect your choice and demonstrate consent, as required by Art. 7(1) GDPR and the Italian Data Protection Authority’s cookie guidelines of 10 June 2021. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR). The record is kept on the site’s own servers, with no external service, for 12 months after the choice expires.

2.4 Usage statistics (only with your consent)

Only if you accept the "Measurement" category does the site load Google Tag Manager, which runs Google Analytics 4 to produce aggregate statistics about visits (pages viewed, referrers, device and browser type, approximate location at city or country level). For users in the European Union, Google states that it uses the IP address only to derive the approximate location and does not log or store it. The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time from "Cookie preferences" at the bottom of every page, with no consequences. Google Analytics data are kept for 14 months. Details are in the cookie notice.

3. Whether you must provide your data

Browsing data are needed to display the site. Writing to us by email is optional; without your data we cannot reply. Consent to statistics is optional: if you refuse, the site works just the same.

4. Who receives the data

Your data are not published or sold. They may be received by:

  • Hetzner Online GmbH (Germany), which provides the servers the site runs on, as a processor (Art. 28 GDPR);
  • Google Ireland Limited, for Google Tag Manager and Google Analytics 4, only if you consent to statistics;
  • the controller’s advisers (for example the accountant), if a professional relationship follows;
  • public authorities, when required by law.

5. Transfers outside the European Economic Area

The site and the consent records are hosted in Germany. With Google Analytics, data may be processed by Google LLC in the United States. The transfer relies on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), in which Google LLC participates, and on the standard contractual clauses in Google’s terms. The adequacy decision is under appeal before the Court of Justice of the European Union (case C-703/25 P): if it is annulled, this notice will be updated.

6. Automated decisions

There is no profiling and no automated decision-making (Art. 22 GDPR).

7. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR). You can withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal. To exercise your rights, write to the email address in section 1. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) under Art. 77 GDPR.

8. Changes

This notice may be updated. Its version and effective date are shown at the top; if a change concerns cookies, the banner will ask for your choice again.