Domenico Martinelli

Privacy Policy

Last updated: 16 October 2026

1. Data Controller

The data controller is Domenico Martinelli (the “Controller”), who can be contacted on any matter relating to the protection of personal data at domenico.martinelli@protonmail.com. The Controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 of Regulation (EU) 2016/679 (“GDPR”) are not met.

2. Scope of this notice

This notice is provided pursuant to Articles 13 and 14 GDPR and Italian Legislative Decree no. 196 of 30 June 2003 (the “Italian Personal Data Protection Code”), as amended by Legislative Decree no. 101 of 10 August 2018, to anyone who visits the website www.domenicomartinelli.it (the “Website”) and/or uses its contact form. It does not apply to other websites that may be reached via hyperlinks.

3. Personal data processed

  • Data you provide voluntarily: first name, last name, e-mail address, phone number (including international dialling code) and the content of the message entered in the contact form. Please do not include in your message any special categories of data (Art. 9 GDPR), data relating to criminal convictions and offences (Art. 10 GDPR), or data relating to third parties.
  • Technical data related to the submission: date and time of submission and the IP address of your device, recorded for security and abuse-prevention purposes; the IP address is automatically anonymised after 30 days.
  • Browsing data: the IT systems that operate the Website collect, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP address, date and time of the request, resource requested, response code, browser type and operating system). These data are processed by the hosting provider in server logs for security purposes and to ensure the proper functioning of the Website.
  • Anonymous statistical data: to understand, in aggregate form, how the Website is used (number of visits, pages viewed, referring site, device type, browser and operating system, time spent), the Website uses the Burst Statistics tool, installed on the Website’s own server, in “cookieless” mode: no cookies are set and no fingerprinting techniques are used; the IP address is used only transiently to generate an anonymous code that changes every day and is not stored. These data do not allow you to be identified and are not disclosed to third parties. No statistical data are collected from browsers that send a “Do Not Track” signal.

4. Purposes and legal bases

  • a) Assessing your request and, where appropriate, contacting you by phone call or message at the number provided, or by e-mail at the address provided. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for requests that are not pre-contractual in nature, the Controller’s legitimate interest in responding to communications received (Art. 6(1)(f) GDPR). Submitting the form does not create any obligation to contact you: the Controller reserves the right to decide, at its discretion, whether to follow up on the request.
  • b) Website security and abuse prevention (e.g. automated submissions, spam, unauthorised access attempts). Legal basis: the Controller’s legitimate interest (Art. 6(1)(f) GDPR).
  • c) Compliance with legal obligations and, where necessary, the establishment, exercise or defence of legal claims. Legal basis: Art. 6(1)(c) and (f) GDPR.
  • d) Anonymous, aggregate statistics on the use of the Website, in order to improve its operation. Legal basis: the Controller’s legitimate interest (Art. 6(1)(f) GDPR), to the extent that such information may still qualify as personal data.

The balancing test between the Controller’s legitimate interest and your rights and freedoms has taken into account the minimal nature of the data collected, the reasonable expectations of a person who spontaneously fills in the form, and the security measures in place.

5. Whether providing data is mandatory

Providing your data is voluntary. However, the fields marked with an asterisk are required to submit the request: without them, the form cannot be sent and you cannot be contacted.

6. Processing methods

Data are processed electronically in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation (Art. 5 GDPR), and are protected by appropriate technical and organisational measures pursuant to Art. 32 GDPR (including HTTPS encryption, access control and protection of the Website against intrusion). No automated decision-making or profiling takes place (Art. 22 GDPR). The Controller periodically makes security copies (backups) of the Website, which may contain the data entered in the contact form and are stored on the hosting provider’s server.

7. Recipients

Data are processed by the Controller and may be disclosed only to the following parties, acting as data processors pursuant to Art. 28 GDPR:

  • Aruba S.p.A., with registered office at Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, provider of the Website’s hosting service;
  • Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland), provider of the encrypted e-mail service on which the Controller receives notifications of requests submitted through the form;
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), provider of the mailbox on which the Controller receives only the Website’s technical system notifications (e.g. security alerts, which may contain IP addresses).

Data are not made public, nor transferred to third parties for their own purposes, and may be disclosed to public authorities only where required by law.

Usage statistics and backup copies are stored exclusively on the hosting provider’s server and are not shared with external analytics or storage providers.

8. Transfers outside the EU

The data entered in the form are sent to Proton AG, based in Switzerland, a country recognised by the European Commission as ensuring an adequate level of protection (Decision 2000/518/EC; Art. 45 GDPR). Only the technical system notifications may be transferred to Google group companies in the United States of America, on the basis of the European Commission’s adequacy decision of 10 July 2023 concerning the EU-U.S. Data Privacy Framework (Art. 45 GDPR), to which Google LLC has self-certified, and in any case of the standard contractual clauses approved by the European Commission (Art. 46 GDPR). The hosting provider processes data in its own data centres located in the European Union.

9. Retention period

  • Data entered in the form: kept for as long as necessary to assess the request and in any event for no longer than 12 months from receipt, after which they are automatically deleted from the Website; the Controller deletes the related notification e-mail within the same period. If the request leads to a contractual or professional relationship, the data will be kept for the duration of that relationship and for the applicable statutory limitation periods.
  • IP address associated with the submission: anonymised after 30 days.
  • Browsing data in server logs: kept for the period set by the hosting provider in accordance with its security policies and legal obligations, unless needed to investigate unlawful acts.
  • Anonymous statistical data: kept for no longer than 12 months.
  • Backup copies: kept on a rotating basis (only the two most recent copies are retained), so that the data they contain are overwritten in the normal rotation cycle and in any event deleted within the periods stated above.

10. Your rights

You may exercise at any time the rights set out in Articles 15–22 GDPR: access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest (Art. 21 GDPR). Requests may be sent to the Controller at domenico.martinelli@protonmail.com and will be answered without undue delay and in any event within one month (Art. 12 GDPR).

If you believe that the processing infringes the law, you also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it) pursuant to Art. 77 GDPR, or with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement, or to seek a judicial remedy (Art. 79 GDPR).

11. Minors

The Website and the contact form are not intended for persons under the age of 14 (Art. 2-quinquies of the Italian Personal Data Protection Code). The Controller does not knowingly collect data relating to minors and will delete any such data upon becoming aware of them.

12. Cookies

For information on the use of cookies, please see the Cookie Policy.

13. Changes

The Controller may amend this notice, including as a result of changes in the law or in the services offered. The current version is always published on this page, together with the date of the last update.

This notice is a translation of the Italian original. In the event of any discrepancy, the Italian version shall prevail.