Privacy & cookies

Matteo Fiameni, private individual, Bergamo (Italy). Contact: mf@matteofiameni.com.

No Data Protection Officer has been appointed, as it is not required for this processing.

What: page and language, sections reached, links clicked, time on page and scroll depth, origin (referring site and campaign parameters), device type, operating system and browser, country and region derived from your IP address by Amazon CloudFront.

How: a script on the site sends this browsing data to my server (Amazon Web Services, Ireland). I use no cookies and store nothing on your device. Your IP address is truncated (last octet for IPv4, /48 for IPv6) and used only to compute a daily identifier together with a random value that is deleted after one day: the full IP is never stored and you cannot be recognised on later days.

Purpose and legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding, in aggregate, how the site is used. I consider this processing to fall within the analytics exemption of the Italian DPA cookie guidelines (§7.2): data used only in aggregate, for this site only, with no cross-referencing.

Retention: 13 months, then automatic deletion. To protect the data from accidental deletion there is a continuous backup of the last 35 days, in the same AWS region: deleted data stays there for at most 35 days. The daily random value is not included in the backup.

If you consent, your visit is also associated with: city and approximate coordinates (provided by Amazon CloudFront), the number of the network you connect from (ASN, provided by CloudFront) and the name of the provider or organisation owning that network, obtained by querying the public RIPEstat registry (RIPE NCC) with the ASN only.

Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from “Cookie preferences” with no consequences for using the site. Retention: 13 months. Only I access this data, including through an application hosted on my home server in Italy.

When I share the site with a person or a company I may use a personal link (with the ?r= parameter). If you open the site from one of these links, the visit is associated with that link and therefore with you as the recipient: I know the link was opened, how many times, and the data described in section 1 (and section 2 only if you consented).

Legal basis: legitimate interest in knowing whether the material I sent was viewed. Retention: 13 months. You can object by writing to me, or avoid it by removing “?r=…” from the address before opening it.

Necessary, always on: mf_consent (first party, 6 months) stores your cookie choice; after 6 months the banner is shown again.

The following tools are active only if they appear among the banner options and only after your consent. Without consent they are not loaded.

Microsoft Clarity (advanced statistics): provided by Microsoft Ireland Operations Limited, acting as an independent controller, with transfer to Microsoft Corporation (USA). It records how the page is navigated (heatmaps and session recordings), masking input fields, numbers and email addresses by default: the data is pseudonymous, not anonymous. Cookies: _clck (1 year) and _clsk (1 day) on this domain; MUID, CLID, ANONCHK, MR, SM on Microsoft domains. According to Microsoft, recordings are kept for 30 days, except flagged ones and a sample kept longer.

LinkedIn Insight Tag (marketing): provided by LinkedIn Ireland Unlimited Company. It collects page URL, referrer, IP, user agent and timestamp to measure visits and give me aggregated professional data (e.g. industry, role, company) about visitors who are LinkedIn members; LinkedIn may also use it for advertising. According to LinkedIn, the IP is truncated or hashed and direct identifiers are removed within 7 days, and I only receive reports that do not identify members. For the collection and transmission of data through the tag, LinkedIn and I may be considered joint controllers; further processing is LinkedIn's sole responsibility. Cookies: li_fat_id (30 days), bcookie (1 year), lidc (24 hours), UserMatchHistory (30 days), AnalyticsSyncHistory (30 days), li_sugr (90 days), lms_analytics (30 days) and other LinkedIn cookies.

Classification under the Italian DPA guidelines: mf_consent is necessary; detailed statistics and Clarity are analytics tools requiring consent; LinkedIn Insight Tag is a profiling/marketing tool.

If you write to me, I use your address and message only to reply, for as long as the conversation requires (legal basis: steps at your request, Art. 6(1)(b)).

Messages to mf@matteofiameni.com are received by Amazon Web Services in the Ireland region (eu-west-1), checked for spam and viruses and forwarded to my personal Gmail inbox; the copy on AWS is deleted automatically after 7 days. Gmail is provided by Google Ireland Limited; any transfer to Google LLC (USA) is covered by the EU-U.S. Data Privacy Framework, to which it adheres.

Amazon Web Services (processor): the site and the statistics are stored in the European Union, in the AWS Ireland region (eu-west-1). Pages are delivered through the global Amazon CloudFront network, which serves each visitor from the nearest point of presence (in Europe for European visitors) without storing the data. AWS is a US company: any access from the USA is covered by the EU-U.S. Data Privacy Framework, to which it adheres.

Telegram: I receive on my phone, through a Telegram bot, only aggregated statistical summaries and the number of times personal links were opened, never details of individual visits. Telegram Messenger Inc. is established outside the EU; data is stored in data centres in the Netherlands but may be accessible to group companies in countries without an adequacy decision (British Virgin Islands, United Arab Emirates).

Microsoft and LinkedIn (consent only): independent or joint controllers as described above; transfers to the USA rely on standard contractual clauses and, for LinkedIn Corporation, also on the EU-U.S. Data Privacy Framework.

RIPE NCC (Netherlands) receives only the network number, never personal data.

Providing data is optional: you can browse the site without giving any consent; refusing has no consequences.

I make no automated decisions about you (Art. 22 GDPR). The only profiling is the one LinkedIn may carry out, only with your consent.

The site is not intended for children under 14.

Security: encrypted connections (HTTPS), data encrypted at rest, access restricted to the controller.

Changes to this notice are published on this page, with the update date at the top.

You can request access, rectification, erasure, restriction and portability of your data (Arts. 15-20 GDPR) by writing to mf@matteofiameni.com. You can withdraw consent at any time from “Cookie preferences” at the bottom of the page (Art. 7(3)), without affecting the lawfulness of prior processing.

Right to object (Art. 21 GDPR): you can object at any time to processing based on legitimate interest (aggregated statistics and personal links) by writing to me.

You can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.

Amazon Web Services: aws.amazon.com/privacy/

Microsoft Clarity: learn.microsoft.com/clarity/setup-and-installation/clarity-cookies

Microsoft: www.microsoft.com/privacy/privacystatement

LinkedIn: www.linkedin.com/legal/privacy-policy · cookies: www.linkedin.com/legal/l/cookie-table

Telegram: telegram.org/privacy