Privacy notice

Data controller

Alberto Alunni, artist — 06026 Pietralunga (PG), Italy. VAT no. IT02817970540.

Email: alunnialberto@libero.it

The controller has not appointed a Data Protection Officer (DPO), as it is not required to under Art. 37 GDPR.

Which data I process

• Browsing data: IP address, date and time of the request, page visited, browser and operating system. They are collected automatically by the servers hosting the website to keep it running and secure.
• Contact form data: full name, email, phone and town (optional), reason for contact, any work of interest, any preferred day for a visit, and your message.
• Data you send me by email, phone or WhatsApp.
• Data collected through cookies and similar technologies, described in the Cookie Policy.
• Cookie consent register: a random identifier, the choice you made, date and time, the version of the notices, language and page, your truncated IP address (without its last part) and browser type.

Purposes and legal bases

• Answering your requests for information about the works, the exhibitions or a visit to the showroom, including an automatic email confirming I received your message — pre-contractual measures taken at your request (Art. 6.1.b GDPR).
• Complying with legal obligations, such as tax and accounting rules when a work is sold — legal obligation (Art. 6.1.c GDPR).
• Keeping the website secure and preventing abuse and spam (technical logs, anti-spam fields, rate limiting) — legitimate interest of the controller (Art. 6.1.f GDPR).
• Keeping proof of your cookie choices (consent or refusal), as required by Art. 7.1 GDPR — legal obligation and accountability principle (Articles 6.1.c and 5.2 GDPR).
• Producing aggregate statistics on website use with Google Analytics 4 — only with your consent (Art. 6.1.a GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time.
• I do not carry out profiling or take decisions based solely on automated processing. I do not send newsletters or promotional messages.

Whether you must provide your data

Fields marked as required in the form are needed to reply to you; without them I cannot follow up. Consent to statistics cookies is optional, and refusing it does not limit your use of the website in any way.

How data are processed and kept secure

Data are processed electronically, with appropriate technical and organisational measures: encrypted HTTPS connection, protected access, data minimisation and regular deletion. The contact form uses no external services: messages are sent directly by the server hosting the website.

Who receives the data

• Hostinger International Ltd. (Cyprus), provider of the website hosting and of the service that forwards form messages, as data processor.
• Italiaonline S.p.A., provider of the libero.it mailbox I use for correspondence.
• Google Ireland Limited, only with your consent, for Google Tag Manager and Google Analytics 4; for Google Maps and YouTube only if you choose to load the map or a video.
• WhatsApp Ireland Limited, if you choose to contact me via WhatsApp, as an independent controller under its own privacy notice.
• Advisers and professionals (e.g. an accountant) bound by confidentiality, and public authorities where required by law.
• Your data are never published or sold to third parties.

Transfers outside the European Union

Some providers (in particular the Google group) may process data in the United States. These transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which Google LLC is certified, and/or on the Standard Contractual Clauses approved by the Commission.

How long data are kept

• Information requests: as long as needed to reply, and in any case no longer than 24 months after the last contact. If you buy a work, data needed for tax purposes are kept for 10 years as required by law.
• Server logs: only as long as needed for security, normally no longer than 30 days, unless needed to investigate offences.
• Google Analytics 4 statistics: 2 months, according to the default retention setting; Google Analytics 4 does not log or store IP addresses.
• Cookie preferences in your browser: 6 months, after which you will be asked for consent again. Consent register on the server: 12 months, then deleted automatically.

Your rights

At any time you can request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Articles 15-22 GDPR). You can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal: for cookies, just use the “Cookie preferences” button that is always available on the website.

To exercise your rights write to alunnialberto@libero.it: I will reply without undue delay and in any case within 30 days.

Complaints to the supervisory authority

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) — Piazza Venezia 11, 00187 Rome — protocollo@pec.gpdp.it — www.garanteprivacy.it — or with the authority of the EU country where you live or work.

Children

The contact form is not intended for children under 14.

Changes to this notice

I may update this notice to reflect new regulations or changes to the website. The date of the latest update is shown at the bottom of the page.