Privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).
Last updated: 21 July 2026.
1. Data controller
The Data Controller is Alessandro Sannini, Via delle Moline 6, 40126 Bologna, Italy. For data-protection enquiries, email alessandro@sannini.net.
2. Personal data processed
When you use the contact form, we may process your name, email address, organisation, subject and message, together with technical information strictly required to secure and transmit the request. The website does not request special-category data; please do not include such information in your message.
Hosting systems may create technical logs according to their own configuration. The theme does not store contact-form messages in the WordPress database and uses only a non-reversible fingerprint of the IP address, for a short period, to limit abusive submissions.
3. Purposes and legal bases
- Responding to enquiries: steps taken at your request before entering into a contract, or the Controller’s legitimate interest in managing professional correspondence, depending on the nature of the enquiry.
- Security and abuse prevention: the Controller’s legitimate interest in protecting the website, systems and recipients against spam, fraud and misuse.
- Legal compliance and claims: compliance with legal obligations or the establishment, exercise or defence of legal claims.
The checkbox in the form records that you have read this notice and are asking to be contacted; it is not used for marketing subscriptions or newsletters.
4. Required information
Name, email, subject, message and acknowledgment of the notice are necessary to send the enquiry. Organisation is optional. Without the required data, the form cannot be submitted.
5. Processing and security
Data is processed electronically in accordance with the principles of lawfulness, fairness, transparency, minimisation and confidentiality. Proportionate organisational and technical safeguards include server-side validation, security tokens, anti-spam fields, submission limits and input sanitisation.
6. Recipients and international transfers
Data may be processed by the Controller, authorised persons and hosting, maintenance and email providers acting, where applicable, as processors. If you choose to play a video, your browser also connects to YouTube/Google services under that provider’s terms and privacy notice. The Controller neither sells nor publicly discloses personal data.
Where a provider processes data outside the European Economic Area, the transfer must rely on an adequacy decision or appropriate GDPR safeguards, including Standard Contractual Clauses where required.
7. Retention
Enquiries and related correspondence are retained only as long as needed to manage them and normally no longer than 24 months after the last contact, unless a contractual relationship, legal obligation or legal claim requires longer retention. Technical data used by the theme to limit repeated submissions is retained for only a few minutes.
8. Your rights
Where the GDPR applies, you may request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing.
To exercise your rights, email alessandro@sannini.net. You may also lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority in your country.
9. Cookies and similar technologies
In its base configuration, the theme uses only technical website functions and does not install advertising, profiling or newsletter tools. WordPress may set technical cookies for authenticated administrators. The video library initially displays local controls and poster images: the player on youtube-nocookie.com is created only after you choose to play a video. From that point, YouTube/Google may receive technical data, including IP address, device information and interactions, and may use cookies or similar technologies under its privacy policy. Before publication, the Controller should verify with a privacy adviser whether prior consent is required under the actual configuration and applicable law.
10. Automated decision-making
Data collected through the website is not used for profiling or solely automated decisions producing legal or similarly significant effects.
11. Updates
This notice may be updated following regulatory, technical or organisational changes. The current version and update date are published on this page.