Information on the processing of personal data
Why this information
I will briefly tell you how I manage the personal data I process in my daily work. The criteria with which I manage data are based on the regulations governing the matter (EU Regulation 2016/679 "GDPR", Legislative Decree 196/2003 "Privacy Code" as amended by Legislative Decree 101/2018) and, more generally, on the principles of transparency, confidentiality, and fairness.
Data controller
The Data Controller is Guglielmo Pepe (Tax Code: PPEGLL79D24G596F - VAT Nr: 04502840616), professional practice carried out pursuant to the law of January 14, 2013, n. 4, with registered office at via Laviano 168, IT-81100 Caserta (CE), Italy. It is possible to contact the Data Controller by sending an e-mail to the e-mail address info@guglielmopepe.com.
Purposes and legal bases of the processing
Browsing data
The processing of browsing data is necessary to pursue the legitimate interest of the Data Controller in ensuring the proper technical functioning, optimization, and security of the services provided on the guglielmopepe.github.io domain, as well as the judicial protection of rights and interests in the event of computer crimes or legal disputes (pursuant to Article 6, paragraph 1, letter f of the GDPR).
Contact details
The processing of contact data (such as the sender's name and e-mail address) is necessary to respond to information or assistance requests sent spontaneously by the user, an activity that relies on the legitimate interest of the Data Controller to reply to received communications (Article 6, paragraph 1, letter f of the GDPR). If the communication is sent to request professional services, the processing is necessary for the performance of pre-contractual measures taken at the data subject's request (Article 6, paragraph 1, letter b of the GDPR). Data may also be processed for the judicial protection of the Data Controller's rights.
Data for the execution of pre-contractual measures or contracts
The processing of personal data required to establish or execute a professional relationship is strictly based on the performance of a contract to which the data subject is party or the implementation of pre-contractual measures (such as preparing a commercial quotation) taken at the data subject's request (pursuant to Article 6, paragraph 1, letter b of the GDPR). Where required by applicable laws, data will also be processed to comply with legal, tax, and accounting obligations (Article 6, paragraph 1, letter c of the GDPR).
Description of the categories of personal data
Browsing data
The category of browsing data includes data whose transmission is implicit in the use of electronic communication protocols. This category includes, by way of example and not limited to, the IP addresses or domain names of computers used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. Please note that these technical data are automatically collected and stored by the hosting infrastructure of GitHub for exclusive purposes of security, maintenance, and server protection, and are not accessible, searchable, or readable in any way by the Data Controller.
Contact details
The category of contact data includes the sender's name and all personal data included in communications and related attachments. This category includes, but is not limited to, the sender's e-mail address, an eventual nickname, the sender's first and last name, carbon copy recipients (Cc), as well as any personal data included within the message text or attached to it.
Data for the execution of pre-contractual measures or contracts
The category of data required for the execution of pre-contractual or contractual measures includes personal data strictly necessary for establishing and managing the professional relationship. By way of example and not limited to, this category includes: first name, last name, company name, tax code, VAT number, REA registration number (if applicable), ordinary or professional e-mail address, registered office address, residence, or domicile address, and any further fiscal or personal data transmitted for the correct execution of services or billing.
Data source
Browsing data
Browsing data originates automatically from the use of electronic communication protocols by computer systems and software procedures used to operate the website on the guglielmopepe.github.io domain, which implicitly transmit technical personal data during their normal operation. Therefore, simply consulting the website involves the processing of data relating to identified or identifiable natural persons.
Contact details
Contact data originates from the direct and spontaneous sending of communications by the user to the contact details present on the website. Receiving such messages involves the acquisition and subsequent processing of the personal data voluntarily provided by the sender.
Data for the execution of pre-contractual measures or contracts
The data required for the execution of pre-contractual or contractual measures originate directly from the economic, commercial, and professional relationships established between the data subject and the Data Controller, or from explicit requests made by the client before the conclusion of the contract (such as requests for quotation).
Recipients and categories of recipients of personal data
The personal data collected may be communicated to third parties operating on behalf of the Data Controller as Data Processors (pursuant to Article 28 of the GDPR) or acting as independent Data Controllers. These subjects include:
- Providers of IT and hosting infrastructure services (specifically, GitHub, Inc.).
- External consultants regarding tax, accounting, and legal matters.
- Judicial authorities, law enforcement, or public administrative bodies, strictly in cases provided for by law.
Transfer of personal data to third countries or international organisations
This website is hosted via the GitHub Pages service provided by GitHub, Inc. (88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA). Consequently, browsing data (including IP addresses) are transferred to and stored on servers located in the United States. This transfer is legitimized by the fact that the provider operates in compliance with its Data Protection Agreement (DPA), which incorporates the European Commission’s Standard Contractual Clauses (SCCs) and its adherence to the EU-U.S. Data Privacy Framework, thereby ensuring a level of data protection equivalent to that of the European Union. Apart from this technical infrastructure, the Data Controller does not transfer personal data to other third countries or international organizations.
Retention period
Browsing data
Browsing data is retained for a maximum period of 12 months, except in cases where it becomes necessary for investigations of computer crimes by the judicial authority or legal disputes; in such events, the data will be stored for up to 10 years from the end of the dispute, in line with civil law provisions.
Contact details and data for the execution of contracts
Contact details, communication contents, and data related to contractual or pre-contractual relationships are retained for a period of 10 years starting from the last communication or the termination of the professional relationship. This term complies with the ordinary prescription periods and the retention obligations for accounting records and business correspondence imposed by Italian civil and tax law (Article 2220 of the Italian Civil Code).
Rights of the Data Subject
Right of access, rectification, erasure, limitation, opposition and portability
The data subject has the right to request from the Data Controller, in the cases provided for by Articles 15 and following of the GDPR, access to their personal data, the rectification of inaccurate information, the integration of incomplete data, the erasure of the same (right to be forgotten), the restriction of processing concerning them, or to object to their use, in addition to the right to data portability. The data subject may exercise these rights at any time by contacting the Data Controller at the e-mail address info@guglielmopepe.com.
Right to withdraw consent
If a specific processing activity is based on the data subject's express consent, the data subject has the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. The withdrawal can be communicated by writing to info@guglielmopepe.com.
Right to complain to a supervisory authority
If the data subject believes that the processing of their data violates the GDPR or national laws, they have the right to lodge a formal complaint with the competent supervisory authority, which for the Italian territory is the Garante per la Protezione dei Dati Personali (Piazza Venezia n. 11, 00187 Rome - www.garanteprivacy.it), or alternatively to seek appropriate judicial remedies.
Optional Nature and Consequences of Failure to Communicate Personal Data
Browsing data
The communication of browsing data does not constitute a legal or contractual obligation, nor a necessary requirement for the conclusion of a contract. The data subject has no obligation to provide such data; however, failure to provide it will result in the impossibility or severe difficulty in the proper functioning of the services available on the guglielmopepe.github.io domain.
Contact details
The provision of your contact data has a different nature depending on the context:
- For generic communications: If you are not a party to pre-contractual negotiations or a contract, the communication of data is entirely optional. Failure to provide it does not carry any consequences and will solely prevent you from receiving a reply to your communication.
- For contractual purposes or quotations: If you request the establishment of a professional relationship or the drafting of a quotation, the communication of personal and fiscal data becomes a necessary requirement for the execution of the contract or pre-contractual measures. In this case, the provision is mandatory: failure to provide or incomplete communication of the data will make it absolutely impossible for the Data Controller to follow up on your requests, process quotations, or perform the requested professional services.
Existence of an automated decision-making process
The Data Controller does not adopt any automated decision-making process on the collected personal data, including the profiling activity referred to in Article 22, paragraphs 1 and 4 of the GDPR, which produces legal effects concerning the data subject or similarly significantly affects them.