This policy explains how personal data is processed when users visit giuliomarinelli.com, use its features or submit information through its forms.
It also provides information about cookies, local storage and similar technologies used by the website.
Personal data is processed in accordance with Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 ("Italian Privacy Code") and, as regards cookies and similar technologies, Article 122 of the Italian Privacy Code.
1. Data Controller
The Data Controller is:
Giulio Marinelli
VAT No. 03198070306
Website: giuliomarinelli.com
Email: privacy@giuliomarinelli.com
Requests concerning privacy, data processing or the exercise of data protection rights may be sent to the email address above.
2. Scope of this Policy
This Policy applies to personal data processed through:
- browsing
giuliomarinelli.com; - localized versions of the website;
- any contact forms available on the website;
- communications voluntarily initiated by the user;
- technical tools used for security, operation and abuse prevention;
- analytics and measurement tools configured in accordance with the user's consent preferences.
Any website features, services or research questionnaires that provide their own specific privacy notice remain additionally subject to that dedicated notice.
3. Categories of Data Processed
3.1 Technical browsing and security data
During normal website operation, the technical infrastructure may process information including:
- IP address;
- date and time of a request;
- requested URL or resource;
- technical HTTP request information;
- browser and operating system information;
- device information;
- information necessary for network security and the prevention of automated or abusive traffic;
- technical identifiers strictly necessary to provide the services used by the website.
These data are used to make the website available, protect it against abuse, diagnose technical problems and preserve its integrity and security.
3.2 Website preferences
The website may locally store certain preferences chosen by the user, including:
- preferred language;
- light or dark visual theme;
- cookie and analytics preferences.
These data are used solely to provide the relevant functionality and are not used to profile the user.
3.3 Direct communications
When a person voluntarily contacts the Controller by email or through other channels indicated on the website, the information provided by the sender is processed to the extent necessary to respond to the request and continue the related communication.
4. Purposes and Legal Bases
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Providing the website and its features | Technical and browsing data | Legitimate interest and technical necessity |
| Security, abuse prevention, diagnostics and infrastructure protection | Technical data, IP address and security signals | Legitimate interest — Article 6(1)(f) GDPR |
| Storing required language, theme and consent preferences | Technical preferences | Provision of functionality requested by the user |
| Responding to enquiries and communications | Voluntarily supplied information | Pre-contractual measures and/or legitimate interest, depending on the request |
| Compliance with legal obligations | Required information | Legal obligation — Article 6(1)(c) GDPR |
| Statistical analysis using analytics storage and identifiers | Browsing data and analytics identifiers | Consent — Article 6(1)(a) GDPR |
| Cookieless measurement while consent is denied | Technical signals and event data without persistent analytics cookies | Technical configuration designed to minimise data and respect the user's choice |
| Measuring conversions originating from Google Ads campaigns | Analytics and attribution data, according to consent state | Consent where required — Article 6(1)(a) GDPR |
Consent to analytics tools that use storage and persistent identifiers is optional.
Refusing or subsequently withdrawing consent does not prevent users from browsing the website or using its essential features.
5. Specific Privacy Notices
Some website features involve additional processing activities described in dedicated privacy notices.
For personal data processed when booking and managing a call, please see the Privacy Notice for Call Bookings.
6. Security and Cloudflare
The website uses services supplied by Cloudflare, Inc. for infrastructure and security functions which, depending on configuration, may include:
- web traffic delivery and protection;
- DNS and networking;
- hosting and server-side functions;
- databases and application services;
- abuse prevention;
- Cloudflare Turnstile;
- server-side management of measurement tools through Cloudflare Zaraz.
Cloudflare may therefore process technical information necessary to deliver and protect these services, including IP addresses, request information and browser or device signals.
Cloudflare Turnstile
The website may use Cloudflare Turnstile on features that accept user submissions, in order to distinguish legitimate requests from automated traffic and prevent spam and abuse.
Turnstile may process technical signals relating to the browser, device and connection in order to perform this verification.
The Controller uses this information for security purposes and not for advertising or commercial profiling.
Further information:
Cloudflare Data Processing Addendum
7. Google Analytics 4 and Measurement
The website uses Google Analytics 4 ("GA4") through Cloudflare Zaraz with a configuration based on Google Consent Mode v2.
If the user has not consented to the optional Analytics and measurement purpose, GA4 may receive measurement events in cookieless mode, without using the first-party analytics cookies listed in section 9.3 and with the relevant Google consent signals set to denied.
When the user consents to the Analytics and measurement purpose, analytics_storage is set to granted and the GA4 integration may use first-party storage and identifiers for more complete measurement. In the current configuration, ad_storage, ad_user_data and ad_personalization remain set to denied even after analytics consent is granted.
Information processed may include, for example:
- pages visited;
- page title and URL;
- referrer;
- approximate date and duration of a visit;
- interaction events;
- browser and device information;
- approximate geographical information;
- technical identifiers associated with the session, where permitted;
- attribution information relating to advertising campaigns, to the extent permitted by the configuration and consent state.
The website is not intentionally configured to send names, surnames, email addresses, telephone numbers or form contents to GA4.
Behaviour according to consent
Google Analytics is associated with the optional Analytics and measurement purpose.
If the user does not give consent:
- the analytics cookies
cfz_google-analytics_v4andcfzs_google-analytics_v4are not installed or retained; - measurement may continue in cookieless mode;
analytics_storage,ad_storage,ad_user_dataandad_personalizationremain set todenied.
If the user consents to Analytics and measurement:
analytics_storageis set togranted;- analytics cookies may be created from the first subsequent measurement event;
ad_storage,ad_user_dataandad_personalizationremaindeniedin the current configuration.
If consent is later withdrawn, the website sets analytics_storage back to denied, clears the analytics cookies and returns to cookieless measurement.
Users may change or withdraw their choice at any time through the Manage cookies control available on the website.
8. Google Ads and Conversion Measurement
The website's Google Analytics property may be linked to Google Ads in order to measure campaign effectiveness and attribute certain actions, consistently with the user's consent choices, to advertising campaigns that generated a visit.
When a user reaches the website through a Google advertisement, the URL may contain technical identifiers associated with the advertising click.
Conversion measurement may receive events in cookieless mode while analytics storage is denied; any use of persistent storage and identifiers remains subject to the applicable consent preferences.
In the current configuration, the website keeps ad_storage, ad_user_data and ad_personalization set to denied and does not use collected data to build its own remarketing audiences or to provide personalized advertising based on browsing behaviour recorded on this website.
Further information about Google's processing practices:
Google Business Data Responsibility
9. Cookies and Similar Technologies
The website distinguishes between technical tools, which are necessary or functional to a user's request, and analytics tools. Analytics measurement may operate in cookieless mode when consent is denied; first-party analytics cookies are used only after consent to the Analytics and measurement purpose.
9.1 Technical and functional cookies
| Name | Type | Purpose | Duration |
|---|---|---|---|
locale | First-party technical cookie | Stores the user's selected language | 12 months |
theme | First-party functional cookie | Stores the selected light/dark theme where explicitly chosen by the user | 12 months |
zaraz-consent | First-party consent cookie | Stores preferences selected through the cookie control | Persistent; according to CMP configuration |
The consent cookie is used only to remember the user's choice and avoid unnecessarily asking for the same preference on every visit.
The choice can nevertheless be changed at any time through Manage cookies.
9.2 Technical local storage
The website may also use:
| Key | Technology | Purpose | Duration |
|---|---|---|---|
tw_theme_pref | Local Storage | Maintains the visual-theme preference and associated state | Until changed or website data are deleted |
The local storage item above is not used for advertising or cross-site tracking.
9.3 Analytics cookies
Only when the user accepts the Analytics and measurement purpose may the Google Analytics 4 integration managed through Zaraz use first-party identifiers including, in the current configuration:
| Name | Type | Purpose | Duration |
|---|---|---|---|
cfz_google-analytics_v4 | First-party analytics cookie | Stores information required for GA4 measurement when analytics storage is permitted | Persistent |
cfzs_google-analytics_v4 | First-party session analytics cookie | Stores analytics information relating to the current session when analytics storage is permitted | Session |
Without consent, these cookies are not created or retained and any measurement takes place in cookieless mode.
The names, structure or retention periods of technical identifiers used by service providers may change following updates to those services or to website configuration. This Policy will be updated where such changes are material.
10. Consent Management
On the user's first visit, where required, the website presents a control that allows the user to:
- reject non-essential tools;
- accept optional tools;
- read this Policy;
- manage individual preferences.
Optional purposes authorising analytics storage are disabled by default.
Consent is provided through a positive action by the user.
Simply continuing to browse the website is not treated as consent to analytics tools that require storage or persistent identifiers.
The selected preference is stored so that the user is not unnecessarily asked to make the same choice on every visit.
Users may change or withdraw consent at any time through Manage cookies.
If the Analytics and measurement purpose is withdrawn, analytics cookies are cleared and subsequent measurement returns to cookieless mode with the relevant Google consent signals set to denied.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
11. Recipients of Personal Data
To the extent required for the purposes described above, data may be processed by technical providers supporting the operation of the website.
These may include:
- Cloudflare, Inc., for infrastructure, security, hosting, application services, Turnstile and Zaraz;
- Google Ireland Limited and other Google group companies, for Google Analytics and, where applicable, Google Ads measurement;
- professionals or service providers subject to confidentiality obligations where their involvement is necessary;
- public authorities or other entities where disclosure is required by law.
Providers processing personal data on behalf of the Controller are used within the framework of the applicable contractual agreements and data-protection safeguards.
Personal data are not sold to third parties.
12. Transfers Outside the EEA
Some service providers used by the website are part of international groups and may involve the processing of personal data outside the European Economic Area.
Where applicable, these transfers take place using mechanisms available under Chapter V of the GDPR, including:
- adequacy decisions;
- the Data Privacy Framework, where applicable;
- Standard Contractual Clauses approved by the European Commission;
- additional contractual and technical safeguards adopted by the relevant provider.
Information on the mechanisms used by individual providers is available in their respective privacy and data-processing documentation.
13. Data Retention
Personal data are retained only for as long as necessary for the purpose for which they were collected.
In particular:
- technical preferences: according to the period specified in the cookie section or until deleted by the user;
- consent preferences: for the period required to record and respect the user's choice;
- enquiry and direct-communication information: for the time necessary to manage the request and subsequently, as a general rule, for no longer than 24 months after the last meaningful contact, unless a contractual relationship is established or longer retention becomes necessary;
- contractual, tax or administrative records: for the periods required by applicable law;
- security data and logs: for a period proportionate to security, diagnostics, abuse prevention and website-protection requirements;
- analytics data with storage permitted: according to the retention period configured in the Google Analytics property and the rules applicable to aggregated reporting data;
- cookieless measurements: according to the processing and retention rules applied by the relevant providers to signals received without analytics storage.
When the relevant purpose ceases to apply, data are deleted, anonymized or retained only where another legal basis requires further retention.
14. Whether Providing Data Is Mandatory
Technical data required for normal browsing are generated as part of the operation of Internet protocols and the infrastructure used by the website.
Consent to analytics storage is always optional, and refusing it does not restrict the use of essential website features. Without consent, measurement may continue in cookieless mode as described in section 7.
15. Automated Decision-Making
The Controller does not use information collected through the website to make solely automated decisions producing legal effects or similarly significant effects on individuals.
Automated systems may be used to identify abusive, automated or potentially harmful traffic solely for security purposes.
16. Data Subject Rights
Where provided for by the GDPR, data subjects may exercise their rights under Articles 15–22, including the right to:
- obtain confirmation as to whether personal data relating to them are being processed;
- access their personal data;
- request rectification;
- request erasure;
- request restriction of processing;
- object to processing where the applicable requirements are met;
- receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
- withdraw previously given consent at any time.
Requests may be sent to:
Data subjects also have the right to lodge a complaint with the competent supervisory authority and, in Italy, with the Garante per la protezione dei dati personali — Italian Data Protection Authority:
Italian Data Protection Authority
17. Data Security
The Controller adopts technical and organisational measures proportionate to the nature of the website and the risks involved in processing, with the aim of protecting personal data against loss, unauthorised access, alteration, disclosure or unlawful use.
No information system can, however, guarantee absolute security.
18. Changes to this Policy
This Policy may be updated when there are changes to:
- website features;
- processing activities;
- service providers;
- analytics or advertising configurations;
- applicable legal requirements.
The date of the latest revision is shown at the beginning of this document.
Where material changes affect purposes or tools requiring consent, users may be asked to provide their preferences again.