PRIVACYPOLICY

The data controller for personal data collected through this website is:

Giulio Malaguti — freelance web developer
Portomaggiore (FE), Italy
VAT No. IT02214860385
Email: zul.developer.io@gmail.com
Phone: +39 348 8732280

• Data you send through the contact form: name, email, message and any details about the service you are interested in.
• Data you send by contacting me directly by email, phone or WhatsApp.
• Technical browsing data: IP address, browser and device type, requested page, date and time. They are logged automatically by the hosting provider to run the website.
• If an engagement follows: the data needed for the contract and invoicing (tax code or VAT number, address, recipient code or certified email).

The website does not use cookies, does not store information on your device and does not use analytics tools or third-party trackers.

• Replying to requests for a quote or to start a project — Art. 6(1)(b) GDPR: pre-contractual measures taken at your request.
• Replying to general enquiries (information, collaborations) — Art. 6(1)(f) GDPR: legitimate interest in replying to people who contact me.
• Running and protecting the website, including against abusive form submissions: for this check your IP address is used only in pseudonymised form (hash with a random key) and in memory; the hosting provider instead records the IP in its own technical logs (see point 5) — Art. 6(1)(f) GDPR: legitimate interest in the security and availability of the service.
• Managing any engagement that follows and the related tax and accounting obligations — Art. 6(1)(b) and 6(1)(c) GDPR.

I do not send newsletters or promotional messages, and I do not carry out profiling or automated decision-making.

Providing your data is optional and not required by law. Name, email and message are, however, needed to reply: without them I cannot follow up on your request. If an engagement follows, invoicing data is required by law.

• Requests that do not lead to an engagement: 12 months from the last message exchanged. Every three months I review and delete expired ones from all channels (email, WhatsApp, contacts).
• If an engagement follows: for its duration and then for the periods required by civil and tax law (usually 10 years).
• Copy of the email held by the delivery service (Resend): 30 days.
• IP address used against abusive submissions: pseudonymised (hash), in memory only. The entry expires after 10 minutes and is deleted at the latest when the server instance shuts down; it is never written to disk.
• Hosting provider runtime logs: up to 1 day, according to Vercel's documentation.

Your data is processed by the following providers on my behalf:

• Vercel Inc. (USA): website hosting, contact form execution, technical logs.
• Plus Five Five, Inc. — Resend (USA): delivery of the email generated by the form.
• If an engagement follows, my accountant and the Italian Revenue Agency, through the e-invoicing exchange system, for invoicing and tax obligations.

I receive messages in a Gmail mailbox: Google Ireland Limited processes them as an independent controller under its own terms and privacy policy, including transfers to Google LLC (USA), which participates in the Data Privacy Framework.

If you choose to message me on WhatsApp, the message goes through WhatsApp Ireland Ltd (Meta group), which processes it as an independent controller under its own privacy policy. If you use the WhatsApp button in the form, your name, email and message are placed in the link and reach WhatsApp as soon as you open it, even before you send the message.

Your data is not sold or shared with third parties for marketing purposes.

Vercel and Resend are based in the United States. The transfer relies on Commission Implementing Decision (EU) 2023/1795 of July 10, 2023 (EU-U.S. Data Privacy Framework), which both have joined (see dataprivacyframework.gov), and, where applicable, on the standard contractual clauses in their data processing agreements. You can request a copy by writing to zul.developer.io@gmail.com.

This website does not use cookies, technical or otherwise, does not store data in your browser and does not use analytics tools. For this reason no consent banner is needed. Links to WhatsApp and social profiles open external services, subject to their own rules.

Under Arts. 15–22 GDPR you can ask at any time to:

• access your personal data
• rectify inaccurate data
• erase your data
• restrict processing
• receive your data in a portable format

Right to object — You can object at any time, on grounds relating to your particular situation, to processing based on my legitimate interest (replying to general enquiries, protecting the website), by writing to zul.developer.io@gmail.com. I will stop processing your data for these purposes unless there are compelling legitimate grounds or it is needed to defend a legal claim.

To exercise them, write to zul.developer.io@gmail.com. I will reply within one month, extendable by two months for complex requests (Art. 12 GDPR).

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

I may update this notice to reflect legal or website changes. The current version is always on this page, with the date of the last update.