Privacy notice
Under Article 13 of Regulation (EU) 2016/679 ("GDPR"). Last updated: 3 November 2026.
1. Data controller
Gianni Vitale, a private individual who runs this personal portfolio website. Azzano San Paolo (BG), Italy. Email: help@giannivitale.com.
No Data Protection Officer (DPO) has been appointed, as one is not required.
2. What data I process, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Data you send me through the contact form or by email: name, email address, message | Reading and replying to your request (e.g. job or collaboration offers) | Art. 6(1)(b) GDPR, where you write about a job, project or collaboration (steps taken at your request before a contract); Art. 6(1)(f) GDPR for any other message (legitimate interest in replying to people who write to me). |
| Data you send me if you write to me on WhatsApp: phone number, profile name, messages | Reading and replying to your request | Art. 6(1)(b) GDPR, where you write about a job, project or collaboration (steps taken at your request before a contract); Art. 6(1)(f) GDPR for any other message (legitimate interest in replying to people who write to me). |
| Technical browsing data (IP address, date/time, requested page, browser/device) logged automatically by the server | Running the website, keeping it secure and preventing abuse | Art. 6(1)(f) GDPR (legitimate interest in website security) |
The contact form's "Send" button opens your own email app with the message filled in: the website stores nothing, and the message only reaches me when you send it.
Providing your data is optional, but I need a way to reach you (an email address or your WhatsApp number) to reply. I don't use your data for marketing, newsletters, profiling or automated decision-making. If I ever offer a newsletter, it will be strictly opt-in (separate, optional consent) and I will update this notice.
3. Cookies
This website uses no cookies: no profiling, analytics or third-party cookies. That is why no cookie banner is shown (Italian Data Protection Authority, cookie guidelines of 10 June 2021). Fonts are hosted on this website (no requests to Google Fonts). The LinkedIn, GitHub, Instagram, Facebook and WhatsApp icons are plain links: those services only process your data if you open them, under their own privacy policies.
The WhatsApp link loads nothing from WhatsApp until you click it and does not pass on which page you came from. If you open it, you leave this site: WhatsApp's own pages (wa.me / api.whatsapp.com) may set their own cookies under WhatsApp's cookie policy.
4. Who receives the data
I don't sell or share your data. The processors acting on my behalf (Art. 28 GDPR) are:
- Hostinger International Ltd. (Cyprus): website hosting and mailbox; website server in Germany (Frankfurt), mail in EU data centres.
- WhatsApp Ireland Limited (Ireland, Meta group): only if you write to me on WhatsApp, for the contact details I keep in WhatsApp Business (WhatsApp Business Data Processing Terms). For everything else WhatsApp acts as an independent controller (see below).
Data may be disclosed to public authorities only where the law requires it.
If you choose to write to me on WhatsApp, the service is provided by WhatsApp Ireland Limited (Meta group), Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes your account and usage data as an independent controller under its own privacy policy. For the contact details I keep in WhatsApp Business, it acts on my behalf as a processor under the WhatsApp Business Data Processing Terms. Messages are end-to-end encrypted: WhatsApp cannot read them. I use WhatsApp only to reply to you.
5. Transfers outside the European Union
The website and my mailbox are hosted in the EU (see section 4), so for them I do not transfer data outside the EU/EEA. Only if you choose to write to me on WhatsApp may WhatsApp Ireland Limited (part of Meta) transfer data outside the EU, for example to the United States, under its own safeguards: the EU-US Data Privacy Framework (a European Commission adequacy decision) and standard contractual clauses. You can find the details in its privacy policy. Any backup of WhatsApp chats is end-to-end encrypted.
6. How long I keep the data
- Messages and related correspondence (form, email or WhatsApp): up to 12 months after our last exchange, then deleted (including WhatsApp chats on my phone and in any backup). If the contact leads to a job or collaboration, the data needed are kept for as long as that relationship lasts and for any period required by law.
- Technical server logs: for the period set by the hosting provider, unless needed to investigate abuse.
7. Your rights
You can ask at any time to access, correct, delete, restrict or port your data, and object to processing based on legitimate interest (Articles 15–21 GDPR), by writing to help@giannivitale.com. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live.
For data that WhatsApp processes as an independent controller, you can also contact WhatsApp directly (in-app 'Request account info' or its privacy contact form); its lead authority is the Irish Data Protection Commission.
8. Security
The website only uses encrypted connections (HTTPS).
9. Changes
Any changes will be published on this page with a new "last updated" date.