Privacy Policy

Last updated: 16 October 2026.

This is a translation of the Italian original. In case of any discrepancy, the Italian version prevails.

This notice explains what personal data I process when you visit filippovaragnolo.design or write to me through the form, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Data controller

Filippo Varagnolo, via Circonvallazione 64, 35028 Piove di Sacco (PD), Italy. VAT number 04415890245. Email: hello@filippovaragnolo.design. Phone: +39 340 522 4341.

I have not appointed a Data Protection Officer (DPO): for any questions, write to me at the address above.

What data I process and why

Contact form enquiries

When you fill in the form I process the data you send me: name, email and message (required) and, if you add them, company, phone number, subject, services of interest, budget and timing. Along with the enquiry I also receive the address of the page you sent it from.

Purpose: to reply to you, prepare a quote and arrange a meeting if needed.
Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). Without your name and email I cannot reply to you.
Retention: up to 24 months from our last exchange. If the enquiry becomes an engagement, the necessary data is kept for the duration of the relationship and for the 10 years required by tax and accounting obligations (Art. 6(1)(c) GDPR).

The form has a hidden field that is used only to detect automated submissions: it does not collect any data.

Email, phone and WhatsApp

If you write to me or call me directly, I process the data you give me for the same purposes, on the same legal basis and with the same retention periods as form enquiries. If you use WhatsApp, the service is run by WhatsApp Ireland Ltd as an independent controller, under its own privacy notice.

Browsing and website security

The server that hosts the website logs the technical data of requests for a few days, such as IP address, page requested, date and time, to keep the website running and protect it from abuse.

Legal basis: legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

When you choose which cookies to accept, I save your choice in your browser and, as proof of consent, a record containing a random code, the version of the notice, the categories chosen and the date and time. The record does not contain your IP address, name or email.

Legal basis: the obligation to demonstrate consent (Art. 7(1) and Art. 6(1)(c) GDPR).
Retention: 24 months, after which the entries are deleted automatically.

Visit statistics

I measure visits with my own tool, hosted on Cloudflare. Without your consent I only collect aggregate data: page, referring site, country, device type and browser. I use no cookies and do not keep your IP address, which is only used to compute a code that changes every day and is then deleted. If you accept statistics, a cookie (_tba_id) lets me recognise returning visits.

Legal basis: without the cookie, my legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR); you can object by writing to me or by turning on the Global Privacy Control signal in your browser. With the cookie, your consent (Art. 6(1)(a)), which you can withdraw from “Cookie preferences”.
Retention: raw data for 30 days on Cloudflare, then 25 months in my analytics tool.

For the cookies and similar technologies used by the website, see the Cookie Policy.

Who I entrust the data to

I do not sell or transfer your data. It is processed on my behalf, as data processors (Art. 28 GDPR), only by the providers needed to run the website:

Cloudflare, Inc. (United States) hosts the website and handles the form, the consent log and the collection of visit statistics.
Resend (Plus Five Five, Inc., United States) delivers the messages sent through the form to my inbox.
Google Ireland Ltd (Google Workspace) runs my email and stores the emails I receive and send.

I have a data processing agreement with each of them. Cloudflare and Resend are based in the United States and Google may also process data outside the European Union: the transfer takes place on the basis of the EU-US Data Privacy Framework, in which all three participate, and of the standard contractual clauses approved by the European Commission (Arts. 45 and 46 GDPR).

I may disclose the data to tax advisers or authorities only when required by law.

Your rights

You can ask me at any time to access your data, correct it, erase it, restrict its processing, object to processing based on legitimate interest or receive it in a machine-readable format (Arts. 15-22 GDPR). You can also withdraw your consent to cookies whenever you like, from the “Cookie preferences” link at the bottom of every page: withdrawal does not affect what happened before.

Write to me at hello@filippovaragnolo.design: I will reply within one month.

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it).

Automated decisions

I do not make decisions based solely on automated processing and I do not create profiles.

Changes

If I change the way I process data, I will update this page and the date at the top. If the change concerns cookies, the website will ask for your preferences again.