Privacy Policy

⚠ Draft — to be reviewed by a professional before publication. Placeholders in [brackets] must be completed.

Information pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR). Last updated: [dd/mm/yyyy].

1. Data controller

Barbara Cavallaro, sole proprietor / freelance professional
Address: [Address], Catania (CT), Italy
VAT no.: [to be added — available from January 2027]
Email: barbaracavallaro.cvl@gmail.com
PEC: [if available]

No Data Protection Officer has been appointed, as it is not required for this activity [to be verified].

2. What data I collect

a) Data you provide through the brief form

Name, email address, company or project name and, if you choose to provide them, website, phone number and country; the information you enter about your objectives, target audience, style and references, available content, timeline, optional budget range and any notes; your choices on the consent checkboxes and the date and time of submission.

Please do not include special categories of data (e.g. health data) or personal data of other people that are not necessary.

b) Technical data

When you visit the site, the hosting provider (Cloudflare) processes technical data such as your IP address, browser type and requested pages, in order to deliver the site and protect it from abuse. The site does not use profiling cookies or tracking pixels — see the Cookie Policy.

c) Communications

The content of the emails we exchange.

3. Purposes and legal bases

Purpose	Legal basis	Is providing data mandatory?
Replying to your brief and preparing a proposal or quote	Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract	Name, email and the required brief fields are necessary to reply; without them I cannot process your request
Performing the contract, if we work together, and managing invoicing and payments	Art. 6(1)(b) and 6(1)(c) GDPR	Necessary
Complying with legal obligations (accounting, tax)	Art. 6(1)(c) GDPR	Necessary
Sending occasional emails with tips and news (only if you tick the optional box)	Art. 6(1)(a) GDPR — consent, which you can withdraw at any time	Optional; not ticking it does not affect your brief
Site security and defence of legal claims	Art. 6(1)(f) GDPR — legitimate interest	—

4. How data is processed

Data is processed electronically with appropriate security measures. Form submissions are stored in a protected database on the hosting provider’s infrastructure, accessible only to me. No automated decision-making or profiling takes place.

5. Recipients

Data may be processed by providers acting as processors under Art. 28 GDPR [keep only those actually used]:

• Cloudflare, Inc. — hosting, content delivery, security and storage of form submissions;
• Google LLC / Google Ireland Ltd — email (Gmail), used to reply to you;
• [Newsletter tool — only if used];
• [Accountant / tax advisor], for clients only.

Data is not sold or disseminated. It may be disclosed to authorities where required by law.

6. Transfers outside the EEA

Some providers (e.g. Cloudflare, Google) may process data in the United States or other non-EEA countries. Transfers take place on the basis of the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the provider is certified, or of the Standard Contractual Clauses [to be verified for each provider].

7. Retention

Data	Retention period [to be confirmed]
Briefs and enquiries not followed by a contract	[24 months] from submission, then deleted
Client data (contract, invoices, correspondence)	Duration of the relationship + 10 years for civil and tax obligations
Marketing consent	Until withdrawn, or [24 months] of inactivity
Technical logs	As configured by the hosting provider

8. Your rights

At any time you can exercise your rights under Articles 15–22 GDPR: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and withdrawal of consent (without affecting the lawfulness of processing before withdrawal). Write to barbaracavallaro.cvl@gmail.com. I will reply within one month, extendable where permitted by law.

9. Right to lodge a complaint

You can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome), or with the authority of the EU country where you live or work.

10. Minors

This site is aimed at businesses and professionals, not at minors.

11. Changes

This policy may be updated. The date of the last update is shown at the top.