Privacy Policy
Last updated: 20/10/2026 · Arts. 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003
This policy explains what personal data I collect through marcobagiacchi.it, why, how long I keep it and what rights you have. It covers this site only: external sites reached through links have their own policies.
Data controller
- Controller: Marco Bagiacchi, freelance web developer, Perugia (Italy)
- VAT no.: IT03882380540
- Email: ciao@marcobagiacchi.it
No Data Protection Officer (DPO) has been appointed, as one is not required for this activity.
What data I process
- Browsing data: the systems that run the site automatically record some technical data, such as IP address, date and time of the request, page requested, server response code, browser and operating system. It is needed for the site to work and stay secure, and is not used to identify you.
- Data you send me: through the contact form (name, email, phone if you add it, city, project type, budget and message), through the quote calculator (the options you chose and your contact details), or by writing to me by email or WhatsApp.
- Cookies and similar tools: technical cookies and, only with your consent, Google Analytics 4 analytics cookies. Details are in the Cookie Policy.
- Consent log: when you choose from the cookie banner I record a random identifier, date and time, your choice, policy version, language, page, shortened IP address and browser type.
- Client area: for clients with an active project, account data and the documents shared in the private area.
Please do not include special categories of data (for example health data) in your messages unless your request needs them. If you share them anyway, I will use them only to reply to you.
Why I process data, on what legal basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Running the site, remembering your preferences and protecting it from abuse (browsing data, technical cookies) | Legitimate interest in the operation and security of the site (art. 6(1)(f) GDPR) | Technical logs: as long as needed for the security of the service, up to 12 months. Technical cookies: see Cookie Policy |
| Replying to your contact or quote requests, including an automatic confirmation email | Pre-contractual measures taken at your request (art. 6(1)(b) GDPR) | 24 months from the last contact if no project follows; if one does, for the duration of the project |
| Managing the project, the client area and invoicing | Performance of a contract (art. 6(1)(b)) and tax and accounting obligations (art. 6(1)(c) GDPR) | For the duration of the relationship; accounting and tax documents for 10 years |
| Aggregate visit statistics with Google Analytics 4 | Consent, which you can withdraw at any time (art. 6(1)(a) GDPR and art. 122 of Italian Legislative Decree 196/2003) | Cookies: 2 years or until withdrawal. Data in Google Analytics: 14 months |
| Proving your cookie choice (consent log) | Legal obligation to demonstrate consent (arts. 6(1)(c) and 7(1) GDPR) | 24 months from recording |
| Handling requests about your privacy rights | Legal obligation (art. 6(1)(c) GDPR) | As long as needed to handle the request and up to 2 years afterwards |
| Establishing, exercising or defending legal claims | Legitimate interest (art. 6(1)(f) GDPR) | For the duration of any dispute and until the appeal deadlines expire |
When the retention period ends, data is deleted or anonymised. Backup copies are overwritten according to the hosting provider’s cycle.
Do you have to provide your data?
No. But without the data requested in the forms (name, email, message and acknowledgement of this policy) I cannot reply to you. Consent to analytics cookies is optional and the site works the same way if you refuse it.
How I process data
Data is processed with IT tools and appropriate security measures: encrypted HTTPS connection, password-protected admin area accessible only to the controller, regular backups. I do not make decisions based solely on automated processing and I do not carry out profiling.
Who I share data with
Data is not published or sold. Only for the purposes listed above, it may be processed by these providers, appointed as data processors:
| Provider | Service | Where |
|---|---|---|
| Hostinger International Ltd | Website hosting, database and email | Servers in the European Union |
| Google Ireland Limited | Google Analytics 4 and Google Tag Manager, only with your consent | EU; possible transfer to the USA (Data Privacy Framework) |
| Accountant and advisers | Tax and accounting obligations, for clients only | Italy |
If you choose to write to me on WhatsApp, the message goes through WhatsApp Ireland Limited, which processes it as an independent controller under its own policy. Upon a justified request, data may be disclosed to the competent authorities.
Transfers outside the European Union
The site and its data are hosted in the European Union. The only possible transfer concerns Google Analytics, if you turn it on: Google LLC participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023.
Your rights
Under articles 15-22 of the GDPR you can ask at any time for:
- access to your data and a copy of it;
- correction of inaccurate or incomplete data;
- erasure, when I no longer need to keep it;
- restriction of processing;
- portability of the data you provided;
- objection to processing based on legitimate interest;
- withdrawal of consent, without affecting processing already carried out: for cookies, just use the “Cookie preferences” link at the bottom of every page.
To exercise them, write to ciao@marcobagiacchi.it: I reply within 30 days.
Complaints
If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, garanteprivacy.it, certified email protocollo@pec.gpdp.it, or with the supervisory authority of the EU country where you live.
Minors
The site is aimed at professionals and businesses. I do not knowingly collect data from children under 14: if I become aware of it, I delete it.
Changes
I may update this policy, for example if the services used change. The date at the top shows the latest version; if the cookies or their purposes change, the banner will ask for your consent again.