Privacy policy

The data controller is Enrico Stefanello, an individual based in Padua (PD), Italy.

For any question about how your data is processed you can write to hello@stefanelloenrico.com.

I only process the data needed for the purposes below.

• Contact form and guided request. Data: name, email address, company (optional), the type of service and budget range you choose, your message and, where present, the source of the link («ref» parameter). Purpose: replying to your request and, if you ask for it, preparing a quote. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• Visits from links with a parameter. If you arrive from a link with «?ref=name» (for example the QR code on a business card), the site increases by one a daily counter tied to that name. The counter does not store your IP address, cookies or any other data that identifies you. Purpose: understanding how many visits come from each channel. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Booking a call. If you load the calendar, the data you enter (name, email, chosen time) is processed by Cal.com. Purpose: scheduling the appointment. Legal basis: Art. 6(1)(b) GDPR.
• Technical browsing data. Data: IP address, browser and device type, requested pages, date and time, logged by the hosting provider. Purpose: running the site, keeping it secure and preventing abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Anti-spam protection. The form uses a honeypot field, a limit on submissions per IP address and, when enabled, Cloudflare Turnstile verification. Purpose: preventing automated submissions. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Usage statistics. Google Analytics 4, only if you accept statistics cookies. Purpose: understanding which pages are useful and improving the site. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can withdraw it at any time from «Manage cookies» in the footer.

I do not send newsletters or promotional messages and I do not profile users.

The reviews shown on the site come from my public Upwork profile; I do not publish clients’ names or other data.

Data is processed by me and by the providers that make the site work. Each acts as a data processor or as an independent controller, under its own terms:

• Vercel Inc.: site hosting and delivery.
• Supabase: database storing the requests received through the form and the site content (European Union region, Frankfurt).
• Resend: sending the email that notifies me of a new request.
• Cal.com: calendar for booking a call, only if you load it.
• Cloudflare: Turnstile anti-spam check, when enabled.
• Google Ireland Limited and Google LLC: Google Analytics, only with your consent.

Data is not sold or passed on to third parties for their own purposes.

Some providers are based in, or have infrastructure in, the United States. Transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on the standard contractual clauses approved by the Commission, as stated by each provider.

• Contact form requests: for as long as needed to handle them and, if no collaboration follows, up to 24 months, after which they are deleted. If a contractual relationship begins, data is kept for its duration and for the periods required by law (including tax law).
• Technical logs: for the period set by the hosting provider, normally limited in time.
• Google Analytics data: 14 months at most.
• Your cookie choice: 6 months, after which you are asked again.

Name and email in the form are needed to be able to reply to you; the other fields are optional. Browsing the site does not require you to provide any data.

You have the right to access your data, rectify it, erase it, restrict its processing, object to processing based on legitimate interest, receive it in a readable format (portability) and withdraw consent at any time, without affecting the lawfulness of earlier processing.

To exercise them, write to hello@stefanelloenrico.com: I reply within one month.

If you believe the processing breaches the rules you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your own country.

There is no automated decision-making and no profiling.

The site is not aimed at people under 14 and I do not knowingly collect their data.

I use encrypted connections (HTTPS), a restricted-access management area and database access rules that limit who can read requests. No system is one hundred percent secure, but I apply measures appropriate to the risk.

I update this policy when the way I process data changes. The date at the top shows the latest version.