Privacy Policy

This website doesn't use automated decision-making that produces legal or similarly significant effects on users, and it doesn't carry out profiling.

The contact form's spam protection is automated and may block a message it considers suspicious. If this happens, you can still contact me by email or book a call.

When you visit a website, the servers your browser communicates with necessarily receive your IP address so they can respond to requests. This website's technical service providers may also process it as part of their services.

To count visits without cookies, Vercel Web Analytics groups the page views of the same visitor using a hash calculated from the request, which resets every 24 hours. As a result, visits can't be linked across different days or different websites, and the data it stores doesn't include your IP address.

According to Vercel's documentation, its performance metrics cannot be linked to a specific visit or IP address. The error reporting system is configured to exclude IP addresses from the data it collects.

For the contact form, your IP address is also used to limit repeated submissions within a short period and to carry out Cloudflare Turnstile's spam check.

In the record of privacy information provided, I don't store your original IP address. Instead, I store a hash calculated using a secret key kept separately. This makes it possible to compare records associated with the same address without storing the IP address in plain text. The hash is still considered pseudonymised personal data and is retained and deleted along with the record it belongs to.

The GDPR requires all processing of personal data to have a legal basis. The basis that applies on this website depends on why the information is collected and used.

Messages and calls. When you contact me through the form, by email or by booking a call, I use the information needed to handle your enquiry and respond. This processing is based on legitimate interests under Article 6(1)(f) of the GDPR. If your enquiry concerns a potential professional engagement or contractual relationship, Article 6(1)(b) may also apply, covering steps taken at your request before entering into a contract.

Record of privacy information provided. Keeping a record of the privacy information shown when you submit the form is based on the legitimate interest in demonstrating compliance with transparency obligations, in line with the accountability principle under Article 5(2) of the GDPR.

Security and spam protection. Cloudflare Turnstile checks and limits on repeated submissions are based on the legitimate interest in protecting the website against abuse and automated requests, under Article 6(1)(f) of the GDPR. This also takes account of Recital 49, which addresses network and information security.

Visit statistics, performance and error reporting. Any processing of personal data necessary to count visits, monitor performance and identify technical problems is based on the legitimate interest in understanding how the website is used and keeping it working, secure and reliable. Data collection is limited to what is necessary for these purposes, with settings designed to minimise the personal data processed.

Language and theme preferences. These settings are only stored when you choose to change them, and they're used solely to remember your preferences. Under these conditions, storing them is exempt from consent under Article 22.2 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), as they form part of a service explicitly requested by the user.

None of the processing described in this policy relies on consent as its legal basis. The checkbox on the contact form simply confirms that you've received the privacy information. If any future processing requires consent, I'll ask for it beforehand, and you'll be able to withdraw it at any time.

I use several external services to run this website. These providers process the information needed to perform their respective functions. The purposes and conditions of processing depend on each service and the provider's role.

In particular, Cloudflare processes data collected through Turnstile both to protect the contact form on my behalf and, as an independent data controller, to improve its own bot detection systems. These activities are explained in the Turnstile Privacy Addendum.

Brevo is a French company, while the contact form databases hosted by Neon are located in Frankfurt, Germany. Other providers, including Vercel, Sentry, Cloudflare and Notion, are US companies or belong to groups based in the United States. Neon is also part of a US-based group.

As a result, some personal data may be transferred or made accessible outside the European Economic Area (EEA). Where applicable, these transfers are covered by the standard contractual clauses approved by the European Commission under Implementing Decision (EU) 2021/914 or by the adequacy decision (EU) 2023/1795 concerning the EU-US Data Privacy Framework, provided the recipient meets the relevant requirements.

You can find information about the safeguards used by each provider in their respective privacy policies, linked in the previous section.

Messages submitted through the contact form are stored in the database for 12 months after receipt, then deleted. Records of the privacy information provided when the form was submitted are kept for 3 years to demonstrate compliance with transparency obligations, after which they're also deleted.

Emails, including copies of contact form messages delivered to my inbox, are kept for as long as necessary to manage the conversation and any related activities. Once they're no longer needed, they're deleted, unless an applicable legal obligation requires them to be retained.

Visit statistics, performance metrics and error reports are kept for the periods set by their respective providers and the configurations in use. Language and theme preferences remain on your device until you clear this website's data from your browser.

The GDPR gives you several rights concerning your personal data. You can ask what information is being processed and request a copy, ask for it to be corrected or deleted, and, where the law provides, object to processing or request that it be restricted. You may also exercise your right to data portability when the conditions set out in Article 20 of the GDPR are met.

To exercise these rights, you can email me at privacy@lucapipolo.com. You'll receive a response within one month of your request, subject to any extensions permitted under Article 12 of the GDPR. If an extension is needed, you'll be informed within the required timeframe.

These rights may apply, in particular, to messages you've sent through the contact form or by email, and their associated records. Where information is genuinely anonymous and cannot identify an individual, it's not possible to locate or retrieve data relating to a particular user.

If you believe your personal data hasn't been handled in accordance with the law, you can lodge a complaint with Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), or with the relevant supervisory authority in the country where you live, work or where the alleged infringement took place.

If the services used, the categories of data collected or the purposes of processing change, I'll update this policy before introducing those changes where necessary, and show the new last updated date at the top of the page.