Privacy policy

Data controller

CTRL® by Michel Branche, Valle d'Aosta, Italy. Contact for any privacy request: ctrlragency@gmail.com.

What we process and why

Contact form. Your name, email, topic and message, plus the page language and the date and time you sent it. We use them only to reply and handle your request. Legal basis: steps taken at your request before a contract, and our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).

Journal newsletter. Your email, language and sign-up date, plus a random code used to unsubscribe you. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Abuse protection. To limit automated submissions we compute a fingerprint of your IP address (a hash with a salt that changes every day) and count attempts for one hour. We never store the plain IP address. Legal basis: legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).

Visit statistics. We use Vercel Web Analytics, which sets no cookies and does not track you across sites. It collects aggregated data such as the page visited, referring site, country, device type and browser; a visitor is recognised only by a hash of the request that resets every day. We see nothing that identifies you. Legal basis: legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).

Technical logs. Like any host, Vercel briefly logs technical request data (for example IP address, time, page requested) to run and protect the service.

Site assistant. Questions typed into the assistant are processed on the spot to pick an answer from our FAQ and are not stored.

We do not use your data for profiling or automated decisions, and we do not sell it.

Who processes data for us

• Vercel Inc. (USA): site hosting, visit statistics, image storage (Vercel Blob).
• Turso / ChiselStrike Inc. (USA): database holding contact requests and newsletter subscribers.

They act as processors under agreements that meet Art. 28 GDPR. Some data may be transferred outside the European Union; such transfers rely on the safeguards the GDPR provides (the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses).

How long we keep it

• Contact requests: up to 24 months after the last exchange, then deleted. If a request becomes a project, the data needed is kept for the periods required by Italian tax and civil law.
• Newsletter: while you are subscribed. After you unsubscribe we delete the address within 30 days.
• Abuse-protection IP fingerprints: 48 hours at most.
• Visit statistics: aggregated data kept by Vercel according to the plan in use (about one month).

Your rights

You can ask at any time for access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest (Arts. 15-22 GDPR). You can withdraw newsletter consent with no consequences. Write to ctrlragency@gmail.com: we reply within 30 days.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority where you live.

Cookies

The public site uses no cookies. The only cookie is a technical one for the private admin area. Details in the cookie policy.

Changes

If we change how we handle data we update this page and the date below.