Information notice pursuant to Article 13 of Regulation (EU) 2016/679 (the "GDPR") and Legislative Decree no. 196 of 30 June 2003, as amended (the "Italian Privacy Code"), concerning the processing of personal data of users of the website paolo.scaramuzza.me (the "Website").

This notice is also available in Italian. In case of discrepancy between the two versions, the Italian version prevails.

1. Data controller

The data controller is Paolo Scaramuzza, a self-employed engineer established in Italy and registered with the Ordine degli Ingegneri della provincia di Gorizia under no. 942, Section A, information sector (the "Controller"), who may be contacted at engineering@scaramuzza.me.

The Controller has not designated a data protection officer, as no such designation is required under Article 37 of the GDPR.

2. Categories of personal data processed

2.1 Navigation data

The systems used to operate the Website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols, in particular the IP address of the device used to access the Website.

According to the hosting provider, the IP address is processed solely for the time strictly necessary to deliver the requested content and is not recorded in access logs. The Controller does not receive access logs.

The Website uses an audience measurement service. When a page is loaded, the browser downloads the measurement script and the badge shown at the foot of the page from the servers of the provider and of its content delivery network; like any Internet request, these requests transmit the device's IP address and user agent to the provider. When a page is viewed and when it is left, the script also sends the provider the address of the page visited excluding any query parameters, the referring website, the date and time of the visit, the browser's time zone (used only to derive the country of origin), the browser's user agent (type of browser, operating system and device), the browser language, the size of the screen and of the browser window, the time spent on the page and how far it was scrolled. According to the provider's documentation, the IP address is discarded without being stored or hashed, no cookies or local storage are used, these properties are not combined into an identifier of the device, and no page view is recorded for browsers transmitting a Do Not Track signal (the script and the badge are nonetheless downloaded). The Controller views these data only as aggregate statistics, which do not permit the identification of users.

2.2 Data provided voluntarily by the user

Sending an email to the address indicated on the Website entails the acquisition of the sender's email address, which is necessary in order to reply, and of any other personal data contained in the message.

3. Purposes and legal bases of the processing

Personal data are processed for the following purposes:

1. delivering the Website and ensuring its security, on the basis of the Controller's legitimate interest in operating the Website (Article 6(1)(f) GDPR);
2. measuring the audience of the Website in aggregate form, on the basis of the Controller's legitimate interest in understanding how the Website is used (Article 6(1)(f) GDPR);
3. replying to requests received by email: where the request concerns a professional engagement, on the basis of steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR); in all other cases, on the basis of the Controller's legitimate interest in handling correspondence (Article 6(1)(f) GDPR);
4. where a professional engagement follows, compliance with the tax and accounting obligations to which the Controller is subject (Article 6(1)(c) GDPR).

Personal data are not used for marketing purposes.

4. Nature of the provision of data

Processing of the IP address by the hosting provider is necessary in order to access the Website. Audience measurement is not necessary, and access to the Website does not depend on it: users who do not wish their visits to be measured can enable the Do Not Track setting in their browser (see section 2.1). The provision of personal data by email is optional; failure to provide it makes it impossible to reply.

5. Recipients of the data

Personal data are processed, on behalf of the Controller, by providers belonging to the following categories, acting as processors pursuant to Article 28 GDPR:

• website hosting providers;
• audience measurement providers;
• email hosting providers.

These providers are established in the European Economic Area or in a country recognised by the European Commission as ensuring an adequate level of protection of personal data (see section 6). Apart from these providers and their sub-processors, personal data are not disclosed to other parties and are not disseminated.

The names of the providers are available on request.

6. Transfers of personal data outside the European Economic Area

Email correspondence is processed by a provider established in Switzerland, a country recognised as ensuring an adequate level of protection by Commission Decision 2000/518/EC.

7. Retention period

Navigation data are not retained by the hosting provider beyond the time necessary to deliver the requested content. The audience measurement service stores one record per page view, with no IP address, no cookie and no visitor identifier, and, according to the provider, deletes it automatically 30 days after the visit. Email correspondence is retained for the time necessary to handle the request to which it relates or, where it leads to a professional engagement, for the period required by the applicable Italian tax and civil-law record-keeping obligations.

8. Cookies

The Website does not use cookies, local storage or similar technologies to store information on the user's device. The audience measurement script reads the browser properties listed in section 2.1 solely to produce aggregate statistics on the use of this Website; the IP address is not stored and the provider does not combine the data with other information or transmit them to third parties. Pursuant to Article 122 of the Italian Privacy Code and paragraph 7.2 of the "Guidelines on cookies and other tracking tools" adopted by the Italian Data Protection Authority on 10 June 2021 (published in the Gazzetta Ufficiale no. 163 of 9 July 2021), analytics tools with these characteristics are treated in the same way as technical tools, and no consent is therefore required.

9. Rights of the data subject

The data subject may, at any time, exercise the rights provided by Articles 15 to 22 GDPR, and in particular obtain access to their personal data, their rectification or erasure, the restriction of processing, and data portability.

Right to object. Pursuant to Article 21 GDPR, the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data based on the Controller's legitimate interest.

Audience measurement data are not associated with any identifier, so the Controller is generally unable to identify the data subject to whom they relate; in that case Articles 15 to 20 GDPR do not apply unless the data subject provides additional information enabling identification (Article 11 GDPR). Objection to audience measurement can be exercised at any time as described in section 4.

Requests may be sent to the email address indicated in section 1. The Controller responds without undue delay and in any event within one month of receipt; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case the data subject will be informed within one month of receipt, pursuant to Article 12(3) GDPR.

10. Right to lodge a complaint

The data subject has the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement, pursuant to Article 77 GDPR.

11. Automated decision-making

Personal data are not subject to automated decision-making, including profiling, within the meaning of Article 22 GDPR.

12. Changes to this notice

The Controller may amend this notice. The version in force is published on this page.

Last updated: 28 September 2026.