Who the controller is
The data controller is Carlo Feller, Italian VAT number IT04313460612.
For anything about your data, including exercising the rights listed below, write to our : a person answers, not an autoresponder.
This page does not give a postal address. The controller is uniquely identified by name and VAT number, and the email address above is a working route for any request, including exercising your rights. If you need the registered address for a complaint or a formal communication, write to that address and we will give it to you.
We have not appointed a data protection officer: none of the cases in which the GDPR requires one applies here.
What we handle
This is a site that describes two products. It has no account area, no contact form, sells nothing, and receives no data you have not decided to send us. There are three cases.
1. If you write to us
The only way to contact us from this site is a link that opens your own mail programme. If you write, we handle your email address, whatever name appears on the message, and what you tell us — typically what you organise and how you run it now. We use it to reply and to carry the conversation forward, and for nothing else. It does not go on a list and you will not get anything you did not ask for.
2. Technical connection data
The site runs on a server of our own rather than a third-party platform. Every request that reaches it leaves a line in an access log — every page, every image, every file — and it is worth saying exactly what that line holds.
Your IP address is truncated before it is written: for IPv4 the last block is zeroed, for IPv6 only the first 32 bits remain. Beside it are the date and time, the site name, the method, the path without anything after the question mark, the outcome, how long the request took, the browser your software reports and — if you arrived from a link — the page you came from. Cookies and authentication headers are stripped before writing, so they never enter the file.
The log exists to keep the server up and safe — to see what is broken, whether somebody is trying to force it, how much load it carries. We do not use it to learn who you are or to count visits: that is what the statistics are for, and those ask consent and can be refused. The files rotate and are not kept beyond 30 days.
3. Statistics, only if you agree
If you consent to statistics we load Google Analytics through Google Tag Manager. It collects data about your visit — pages viewed, how long, where you came from, language, device type, and approximate location derived from your IP address — and ties it to an identifier stored in a cookie on your device.
If you do not consent, none of that happens. Google's code is not loaded at all: it is not present in the page and no request is made to Google's servers. This is not reduced or anonymous collection, it is no collection. Which cookies are involved, and for how long, is set out in the cookie policy.
On what legal basis
- Replying to your messages
- Our legitimate interest in following up a request you sent us (Article 6(1)(f) GDPR); and, if the conversation becomes a contractual relationship, performance of that contract or the steps leading to it (Article 6(1)(b)).
- Visit statistics
- Your consent, and nothing else (Article 6(1)(a) GDPR, and Article 122 of the Italian Privacy Code for the storage on your device). You can give it, refuse it and withdraw it at any time, with no effect on how the site works.
- The access log
- Our legitimate interest in keeping the server that is serving you this page running and secure (Article 6(1)(f) GDPR). Truncating the address before it is written is how that interest is balanced against yours: the log stays useful for understanding what is happening to the server and says very little about you.
- Legal obligations
- If you become a customer, the data that ends up in accounting and tax records is handled to comply with a legal obligation (Article 6(1)(c)).
Who we share it with
We do not sell data, trade it or pass it on. The only parties that may handle it on our behalf, as processors, are:
- Google — Google Ireland Limited and Google LLC, for Google Analytics and Google Tag Manager, and only if you consented to statistics.
- The provider of the email service we use to receive and keep messages, if you write to us.
Data may also be disclosed to judicial or supervisory authorities where the law requires it.
Transfers outside the European Economic Area
If you consent to statistics, the data Google Analytics collects may be transferred to the United States. The transfer relies on the adequacy decision adopted by the European Commission on 10 July 2023 for the EU-US Data Privacy Framework, to which Google LLC is certified, and in addition on the Commission's standard contractual clauses. If you do not consent there is no transfer, because nothing is collected.
How long we keep it
- Email — for as long as it takes to deal with the request and, if a relationship comes of it, for the life of that relationship. Records with tax and accounting significance are kept for ten years, as Italian law requires.
- Google Analytics data — for the period configured in the Analytics property, currently 14 months. The cookies on your device last as long as the cookie policy says, and you can delete them sooner.
- The access log — rotated, not kept beyond 30 days.
- Your cookie choice — stays in your browser's local storage until you clear this site's data. It is never sent to us and we do not hold it.
No profiling, no automated decisions
We run no advertising on this site, do not follow you across other sites and build no profiles. We take no automated decisions about you within the meaning of Article 22 GDPR.
Children
This site addresses people who organise cultural activities and is not directed at children. We do not knowingly collect data about anyone under fourteen.
Your rights
You may exercise the rights in Articles 15 to 22 GDPR at any time:
- access — find out whether we hold data about you and get a copy;
- rectification — correct data that is wrong or incomplete;
- erasure — ask for it to be deleted;
- restriction — ask that it be set aside rather than used;
- portability — receive the data you gave us in a machine-readable format;
- objection — object to handling that rests on our legitimate interest;
- withdrawal of consent — take back your consent to statistics, without making what was collected beforehand unlawful. Use Cookie preferences, which takes the same two clicks that giving it did.
Writing to us is enough. We reply without undue delay and in any case within one month.
Complaining to the authority
If you believe the handling of your data breaches the GDPR you can complain to the Italian supervisory authority — Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it — or to the authority in your own country of residence, or go to court.
If this notice changes
If what the site does changes, this page changes with it, and the date at the top says when. Where a change affects something based on consent, we ask again rather than treating the old answer as covering it.