PRIVACY POLICY
1. DATA CONTROLLER
This professional design portfolio is operated by Stefano Pallotta, based in Italy.
Website: stefanopallotta.it
VAT Number: IT14391160968
For privacy enquiries and requests concerning personal data, write to stefanopallotta25@gmail.com. Contact details are also available on the CONTACT page.
2. PERSONAL DATA PROCESSED
The website has no account registration or contact forms. Its application does not use advertising pixels, marketing analytics or profiling tools. Images and fonts are served locally.
Website delivery and security involve technical connection information, such as IP addresses, requested resources, request times, browser information and response data.
If you contact Stefano Pallotta by email or telephone, your contact details and the information you provide may be used to answer your enquiry and manage professional communications. Providing these details is voluntary; insufficient information may prevent a response. Please send only information relevant to your request.
3. PURPOSES AND LEGAL BASES
- Delivering and securing the website: legitimate interests in maintaining an accessible portfolio and preventing abuse, subject to the protection of visitors' rights (Article 6(1)(f) GDPR).
- Responding to requests for professional engagements: steps taken at your request before a contract, or performance of a contract where applicable (Article 6(1)(b) GDPR). Other ordinary enquiries are handled on the basis of legitimate interests in responding to communications you initiate (Article 6(1)(f) GDPR).
- Meeting applicable professional or legal obligations: Article 6(1)(c) GDPR, where required.
The portfolio application does not make automated decisions producing legal or similarly significant effects.
4. HOSTING AND EMAIL SERVICES
The hosting platform selected for this website is Cloudflare Pages. Hosting and infrastructure providers may process technical information for delivery, operation and security. Cloudflare describes its processing on behalf of customers and relevant transfer safeguards in its Data Processing Addendum.
Email is handled through a free personal Gmail account. Google processes information under the terms and privacy notices applicable to that service. Its published notice identifies Google Ireland Limited for users of the covered services in the European Economic Area, unless a service-specific notice states otherwise. See Google's Privacy Policy. No Google Workspace agreement is implied.
These providers operate internationally, and information may be processed outside the European Economic Area. Their published explanations describe applicable transfer mechanisms, including adequacy decisions and standard contractual clauses. Further information and the means of obtaining information about safeguards are available in the Cloudflare document above and Google's data-transfer information. This does not imply storage exclusively within the European Union or a separate agreement signed by Stefano Pallotta.
5. COOKIES AND BROWSER STORAGE
The portfolio application does not set cookies or write persistent localStorage. It uses first-party sessionStorage to carry selected Archive filters, remember dismissal of the Shuffle hint and preserve the current Shuffle image and pause state during responsive changes.
This storage supports interface functions and is not sent by the application to a tracking service. Values are removed when consumed or normally expire with the tab's browsing session, subject to browser session restoration. Blocking storage may prevent these preferences from being retained.
No consent banner is used for these technical functions. Hosting security services may use technical cookies necessary for the service; the application does not use optional marketing or advertising technologies.
6. DATA RETENTION
Communications are currently retained for the management of enquiries and professional relationships. A periodic review of concluded communications is planned, with deletion of information no longer needed. This describes the intended review practice, rather than a review procedure already in operation.
Relevant criteria include whether the enquiry is concluded, whether follow-up or an ongoing engagement still requires the information, and whether specific professional, tax or legal obligations require retention. Communications and documents subject to those obligations will be kept for the applicable terms. Technical records depend on the hosting services used and their operational and security purposes; no single retention period is asserted for all records.
7. DATA SUBJECT RIGHTS
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction and, where applicable, portability of personal data. You may object on grounds relating to your particular situation to processing based on legitimate interests.
Send requests to stefanopallotta25@gmail.com. Requests are generally free and must be answered without undue delay, normally within one month; any permitted extension must be communicated within that first month.
You may lodge a complaint with the competent supervisory authority, including the Italian Garante per la protezione dei dati personali, without first contacting the controller.
8. UPDATES
This policy may be updated to reflect changes to the website or relevant processing.
Last updated: 30 October 2026.