Privacy Policy
Last updated: 20 August 2026
This Privacy Policy describes how personal data relating to visitors of Matteo Papetti's website and users of its contact features is processed.
Personal data is processed in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection legislation.
1. Data Controller
The Data Controller is:
Matteo Papetti
Email: papteo@hotmail.it
For any questions concerning the processing of personal data or the exercise of rights under the GDPR, users may contact the Data Controller at the email address indicated above.
2. Personal Data Processed
Browsing Data
During normal use of the website, the systems and services required for its operation may process technical information such as:
IP address;
browser and device information;
information relating to requests made to the website;
other technical data necessary for the operation and security of the website.
The website is built and hosted using Framer B.V., which may process personal data on behalf of the Data Controller in its capacity as a Data Processor.
The website may use Framer's built-in analytics tools to obtain aggregate information regarding website usage. These tools are designed to operate without persistent cookies or identifiers intended to track individual users over time.
Data Submitted Through the Contact Form
If users choose to contact the Data Controller through the website's contact form, the following data may be collected:
first name;
last name;
email address;
content of the message;
any additional information voluntarily provided by the user.
Users are requested not to submit information that is unnecessary for the purpose of their enquiry and, in particular, not to provide special categories of personal data as defined under Article 9 of the GDPR unless strictly necessary.
Data Submitted by Email
When users voluntarily send an email to an address displayed on the website, the sender's email address and any other personal information contained in the message may be processed solely to the extent necessary to manage and respond to that communication.
3. Purposes and Legal Bases for Processing
Personal data may be processed for the following purposes.
Managing Enquiries and Professional Requests
Personal data submitted through the contact form or by email is used to:
respond to enquiries;
evaluate proposals for professional collaboration;
provide requested information;
manage professional communications.
Where the communication concerns a potential professional or contractual relationship, processing is based on Article 6(1)(b) GDPR, as it is necessary to take steps at the request of the data subject prior to entering into a contract.
Where the communication is not pre-contractual in nature, processing may be based on the legitimate interest of the Data Controller in responding to communications received, pursuant to Article 6(1)(f) GDPR.
Website Operation and Security
Technical data may be processed to ensure the proper functioning and security of the website, prevent misuse and protect the website from malicious or unauthorised activity.
The legal basis is the legitimate interest of the Data Controller in maintaining the security and functionality of the website pursuant to Article 6(1)(f) GDPR.
Compliance with Legal Obligations
Personal data may be processed or retained where required to comply with legal obligations or lawful requests from public authorities.
The legal basis is Article 6(1)(c) GDPR.
4. Methods of Processing
Personal data is processed using electronic means and appropriate technical and organisational measures designed to protect it against unauthorised access, accidental loss, disclosure, alteration or unlawful use.
Processing is limited to the personal data reasonably necessary for the purposes described in this Privacy Policy.
The website does not carry out automated decision-making or profiling activities.
5. Data Retention
Personal data received through contact enquiries will generally be retained for no longer than 12 months from the most recent communication, unless:
a longer retention period is necessary for an ongoing professional or contractual relationship;
applicable legal, accounting, tax or administrative obligations require longer retention;
retention is necessary for the establishment, exercise or defence of legal claims.
Where a contractual or professional relationship is established, personal data required for administrative, accounting and tax purposes will be retained for the periods required by applicable law.
6. Recipients and Service Providers
Personal data may be processed by service providers supplying technical services necessary for the operation of the website.
In particular, the website uses:
Framer B.V.
Rozengracht 207B
1016 LZ Amsterdam
The Netherlands
Framer provides website creation, hosting and technical infrastructure services and may act as a Data Processor on behalf of the Data Controller.
Personal data is not sold, commercially disclosed or distributed to third parties.
Data may be disclosed to public authorities or other authorised entities where required by applicable law.
7. Transfers Outside the European Economic Area
In connection with the technical services used by the website, certain data may be processed by sub-processors located outside the European Economic Area (“EEA”).
Where such transfers occur, they are carried out in accordance with Chapter V of the GDPR and on the basis of recognised safeguards, which may include adequacy decisions adopted by the European Commission or Standard Contractual Clauses approved by the European Commission.
8. Cookies and Tracking Technologies
The website does not directly use advertising or profiling cookies or tracking technologies.
Framer's built-in analytics tools are designed to operate without persistent cookies or identifiers intended to profile individual visitors.
The website may use technical technologies that are strictly necessary for its security and proper operation.
If third-party services using non-essential cookies or tracking technologies are introduced in the future — including advertising technologies, third-party analytics tools or similar services — the website will be updated to provide the information and consent mechanisms required under applicable law.
9. Voluntary Provision of Personal Data
Providing personal data through the contact form or by email is voluntary.
However, failure to provide information necessary to process an enquiry, such as a valid email address, may make it impossible for the Data Controller to respond.
10. Data Subject Rights
Under Articles 15 and following of the GDPR, data subjects may, where applicable:
obtain confirmation as to whether personal data concerning them is being processed;
request access to their personal data;
request the correction of inaccurate or incomplete data;
request the deletion of personal data;
request restriction of processing;
object to processing where permitted by law;
request data portability where applicable.
Requests relating to these rights may be sent to:
papteo@hotmail.it
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if they believe that the processing of their personal data infringes applicable data protection legislation.
11. Third-Party Content and Embedded Media
The website may contain links to third-party websites or embedded audiovisual content.
Where third-party content is embedded, the relevant provider may process technical information relating to the user's device or connection in accordance with its own privacy practices.
Where possible, privacy-oriented configurations will be used to minimise third-party tracking.
The Data Controller is not responsible for the privacy practices of external websites accessed through links contained on this website.
12. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in applicable law, the technical configuration of the website or the services used.
The most recent version will always be available on this page together with the date of the latest update.