Privacy and cookie policy

This page explains which personal data alessandrolattao.com processes, why, and how you can control it, under the EU General Data Protection Regulation (GDPR) and the cookie guidelines of the Italian Data Protection Authority.

Data controller

Alessandro Lattao, VAT IT13967010961, Cernusco sul Naviglio (MI), Italy. For any request about your data write to me@alessandrolattao.com.

Server logs

The site is served by Amazon CloudFront, the content delivery network of Amazon Web Services (AWS). Every request is logged with: IP address, date and time, requested page, response status, referring page, browser user agent, and the country and network (ASN) derived from the IP address.

• Purpose: keep the site secure and working, and count visits in aggregate, including visits by search engines and AI assistants.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Retention: 12 months, then deleted automatically.
• Processor and location: AWS, as data processor. Logs are stored in the AWS region in Frankfurt, Germany. CloudFront answers from the AWS location closest to you, which can be outside the European Union: transfers to the United States rely on the EU-US Data Privacy Framework, under which Amazon is certified, and on the standard contractual clauses of the AWS data processing addendum.

Google Analytics, only with your consent

If you choose Accept in the cookie banner, or turn on Statistics under Customize, the site loads Google Analytics 4 to count visits, see which pages are read and where visitors come from. If you close the banner with X, choose Reject or make no choice, Google Analytics is not loaded at all and no request reaches Google.

• Data: a random identifier stored in cookies, pages viewed, referring site, device and browser type, approximate location. Google Analytics 4 does not log or store IP addresses.
• Settings: Google signals, ad personalization signals and data sharing with Google products and services are off. Event data is kept for 2 months, then deleted.
• Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the cookie settings link at the bottom of every page: the analytics cookies are deleted and Google Analytics is no longer loaded.
• Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data can be transferred to Google LLC in the United States under the EU-US Data Privacy Framework, under which Google LLC is certified.

Cookies and similar storage

Technical storage does not need consent. The banner is shown again after 6 months, or earlier if this policy changes significantly.

Email and call booking

If you write to me or book a call, I use the data you send (name, email address, message, meeting details) only to answer you and arrange the call. Legal basis: steps taken at your request before a contract and legitimate interest in answering (Art. 6(1)(b) and (f) GDPR). Email and calendar run on Google Workspace, with Google as data processor. I keep the correspondence as long as needed for the relationship and for the legal obligations that follow from it.

What the site does not do

No advertising, no profiling, no social media widgets, no fonts or scripts from third parties before your consent. Personal data is not sold and is shared only with the processors listed above.

Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interest (Articles 15 to 21 GDPR). Write to me@alessandrolattao.com. You can also lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali.

You can change your cookie choice at any time: Cookie settings