## Who is responsible

The data controller is Gianluca Pavone, reachable at gianluca@cagliostro.dev.

## Visiting a page

Loading a page requires the visitor's IP address: without it there is no connection and nowhere to send the page back to. The browser also sends the user agent and the path requested, and the server records the time.

• Data: IP address, browser and operating system, the page requested, date and time.
• Purpose: delivering the site, keeping it available, and protecting it from abuse.
• Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
• Retention: none. Request logging is not enabled.
• Recipients: Cloudflare, Inc., which hosts the site, acting as my processor under Art. 28 GDPR. Nobody else.

  your device              in between                     the website
 +---------------+        +----------------------+        +----------------+
 | your computer | req->  | Cloudflare           | req->  | cagliostro     |
 | or phone      |        | delivers the page    |        | plain pages    |
 |               | <-page | and filters abuse    | <-page |                |
 +---------------+        +----------------------+        +----------------+

 what travels: your IP address, your browser type,
               the page you asked for, the date and time

Light and dark themes follow the setting in the visitor's own browser or operating system. That choice is applied inside the browser: the same page is served to everyone, and nothing about it reaches the site.

## Cookies

This site sets no cookies of its own.

Cloudflare's network may set a strictly technical cookie in front of the site, typically __cf_bm, which distinguishes automated traffic from human traffic, or cf_clearance if a visitor is shown a challenge.

These are technical cookies under Art. 5(3) of the ePrivacy Directive: strictly necessary to deliver the site, so no consent is required. The processing rests on legitimate interest, Art. 6(1)(f) GDPR.

## Transfers outside the EEA

Cloudflare, Inc. is based in the US, so serving this site is a transfer under Chapter V of the GDPR. Cloudflare adheres to the EU-US Data Privacy Framework, so the transfer rests on Art. 45 GDPR. Its data processing addendum carries the Standard Contractual Clauses as a fallback.

## Writing to me

Writing to gianluca@cagliostro.dev means I process that address and whatever the message contains, for the single purpose of replying. Legal basis: legitimate interest in answering correspondence somebody chose to send me (Art. 6(1)(f) GDPR). Messages are deleted once the exchange has run its course, and within 12 months at the outside.

## Visitor rights

Visitors in the EU/EEA, the UK, or any jurisdiction with comparable data protection law have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). Email me to exercise any of them.

There is also the right to lodge a complaint with a supervisory authority (Art. 77). Mine is the Italian Garante per la protezione dei dati personali; a complaint can also go to the authority for the place where the visitor lives or works.

## Reporting a security issue

Reports of vulnerabilities in this site are welcome. Write to gianluca@cagliostro.dev. I would rather hear it from you than from a scanner.

## Changes

If this notice changes materially, I will update the "last updated" date above and, where appropriate, note the change in commit history.