Privacy Policy

This policy explains what personal data I process when you visit andreacerveson.com or contact me through the form: why I use it, who I share it with, how long I keep it and what your rights are. Cookies are covered in detail in the cookie policy.

Data controller

The data controller is Andrea Cerveson, VAT number IT05467130265.

For any privacy request, including exercising your rights, email me at andrea.cerveson@gmail.com.

What data I process and why

Browsing the site

The site is hosted on Cloudflare (Workers), which also handles content delivery (CDN), DNS and security. When you open a page, Cloudflare processes some technical data: your IP address, the browser and operating system you use (user agent) and request logs.

• Purpose: to deliver the pages and protect the site from abuse and attacks.
• Legal basis: my legitimate interest in keeping the site online, fast and secure (Art. 6(1)(f) GDPR).

Contact form

If you write to me through the form, I process what you enter:

• first and last name;
• email address;
• company, if you add it (it’s optional);
• your message.

To send the form, you need to tick the box “I have read the privacy policy”. It only confirms that you have read this page. It is not consent.

• Purpose: to reply to your request and handle any follow-up you ask for.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention: 24 months from our last contact, after which I delete the data.

The site doesn’t store messages. When you click “Send message”, your message reaches my Gmail inbox (Google) by email, through Cloudflare Email Routing.

To keep spam out, the form uses Cloudflare Turnstile. It checks a few technical signals from your browser, such as your IP address and user agent, to tell a person from a bot. The legal basis is my legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).

Filling in the form is optional, but I can’t reply without your name, email address and message.

Statistics (only with your consent)

If you accept statistics cookies, I use two tools:

• Google Analytics 4, to see how many people visit the site, where they come from and which pages they read;
• Microsoft Clarity, to see how the site is used through heatmaps and session recordings: clicks, mouse movements and scrolling. Form fields are masked, so Clarity doesn’t record what you type.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

A few more details about Microsoft Clarity. I use it to capture how you use and interact with the site through behavioral metrics, heatmaps and session replay, to improve the site and the way I present my services. Website usage data is captured using first- and third-party cookies and other tracking technologies, to understand which content is most popular and how people browse online. I also use this information for site optimization and for fraud and security purposes. Microsoft also collects or receives this personal data to provide Microsoft Advertising, which I don’t use, and as an independent controller it may use the data for any purpose described in its privacy statement, including building user profiles for advertising. For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement.

Marketing (only with your consent)

I don’t currently run ad campaigns or use advertising pixels, such as those from Google Ads or Meta. If you accept marketing cookies:

• when you send the form, your browser turns your email address and your first and last name into an unreadable string using the SHA-256 algorithm (hashing) and sends it to Google along with the Google Analytics 4 event that records your contact request. Google matches it against the data in its own accounts to measure contact requests more accurately, including across devices. Hashing doesn’t make the data anonymous: its whole point is to match it to an account;
• Google and Microsoft also receive your consent for advertising, so they may use Google Analytics 4 and Microsoft Clarity data for advertising purposes too, under their own privacy policies.

Without marketing consent, your browser doesn’t send the form data to Google.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Managing consent

The cookie banner runs on CookieScript. When you make a choice, CookieScript stores it in a technical cookie in your browser and keeps a record of it as proof: a random key, your choice, your anonymized IP address, the date and time, the page and your browser type.

• Purpose: to respect your choice and be able to prove consent.
• Legal basis: the legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR).

Statistics tools are loaded through Google Tag Manager and only run according to the consent you have given. For Google services, I use Google Consent Mode v2 in advanced mode. In practice, if you decline, Google tags may still send Google signals without cookies or identifiers (cookieless pings). They only carry technical information: the date and time, browser type, referring page, your consent status, whether you arrived from an ad, and a random number generated on each page load. Like any web request, they reach Google along with your IP address, which Google says it does not store in full. Google uses these signals to estimate visits and conversions in aggregate. Microsoft Clarity, on the other hand, doesn’t run at all without your consent.

You can change your choices at any time from the “Cookie settings” link in the site footer, which reopens the banner.

Who I share data with

I rely on these providers:

Cloudflare and CookieScript process data on my behalf, as processors. For Turnstile, Cloudflare also uses some technical signals as an independent controller, to improve its bot detection.

Google processes Google Tag Manager and Google Analytics 4 data on my behalf, as a processor. If you accept marketing cookies, it may also use the data as an independent controller for advertising purposes, under its own privacy policy. You can also read how Google uses information from sites that use its services. Gmail is provided by Google under its own terms and privacy policy.

For Microsoft Clarity, Microsoft and I are independent controllers.

Each provider explains how it handles data in its own privacy policy: Cloudflare, Google, Microsoft and CookieScript.

Transfers outside the EU

Cloudflare, Google and Microsoft may also process data in the United States. These transfers rely on the EU-US Data Privacy Framework and on Standard Contractual Clauses approved by the European Commission. You can check which companies take part in the Data Privacy Framework on the official list.

How long I keep data

• Form messages: 24 months from our last contact, then I delete them.
• Technical browsing data: Cloudflare keeps it for as long as it needs to deliver the pages and protect the site.
• Statistics: Google Analytics 4 keeps user-level and event data for 14 months. Microsoft Clarity keeps session recordings for 30 days and heatmap data for 13 months; Microsoft sets these periods.
• Marketing: data that Google and Microsoft use for advertising stays in their systems for the periods their services set.
• Cookies: each one lasts as long as stated in the cookie policy.
• Proof of consent: for as long as needed to show what you chose.

Your rights

Under Arts. 15–22 GDPR, you have the right to:

• access: find out whether I process data about you and get a copy (Art. 15);
• rectification: have inaccurate data corrected or incomplete data completed (Art. 16);
• erasure: have your data deleted (Art. 17);
• restriction: in some cases, ask me to only store your data and not use it otherwise (Art. 18);
• portability: receive your data in a structured, commonly used, machine-readable format, or have it sent to another controller (Art. 20);
• objection: object to processing based on my legitimate interest (Art. 21).

You can withdraw your consent to statistics and marketing at any time, from the “Cookie settings” link in the footer. Withdrawal applies from then on and doesn’t affect what was done before.

To exercise your rights, email me at andrea.cerveson@gmail.com. I’ll reply within one month.

If you believe the processing of your data breaches the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority in the EU country where you live or work.

Automated decisions

I don’t make automated decisions or carry out profiling that has legal or similarly significant effects on you (Art. 22 GDPR).

Changes to this policy

If the services I use or the rules change, I’ll update this page and its “last updated” date.