Here, your privacy is not a banner to dismiss.

That said, the law rightly requires transparency even on the little that remains. And that's what you'll find below, written so it can actually be understood... because an incomprehensible privacy notice is a useless one. This page is the information notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and to Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018. It applies to this website only: external sites reachable through links are governed by their own privacy notices.

Data controller

What data we process, and why

1. If you write to me. When you contact me by email or phone, I process the data you yourself provide... your name, contact details and the content of your message. I use them only to reply to you, handle your request and manage any relationship that may follow (legal basis: pre-contractual measures and performance of a contract, Art. 6(1)(b) GDPR). Providing your data is optional, but without it I cannot reply. I keep it for as long as needed to handle your request and, if a professional relationship arises, for its duration and for the retention periods required by law. I do not share it with anyone and I do not use it to send you advertising. One piece of advice: in the messages you send me, avoid including particularly sensitive data (the special categories under Art. 9 GDPR, such as health data) unless it is truly necessary.

2. If you fill in the contact form. In the contact form on this site and on the NIS2 consultancy page you can leave me your first name, surname, email, phone number and an optional message. The data you enter is processed by electronic means and used solely for the purpose of B2B commercial contact, that is to get back to you, handle your request and manage any professional relationship that follows (legal basis: pre-contractual measures and performance of a contract, Art. 6(1)(b) GDPR). To verify that the address is really yours, I send you a confirmation email with a link... it is an anti-abuse measure that protects us both. Providing the data is optional, but without it I cannot contact you back. I keep the data for as long as needed to handle the request and, if a professional relationship arises, for its duration and for the periods required by law, after which it is deleted. I do not share it with anyone, I do not use it for advertising, and there is no profiling.

3. Server logs. Like every website in the world, the server hosting these pages automatically records technical access logs (IP address, date and time, page requested, and other technical parameters whose transmission is inherent in Internet protocols). We do not use them to identify you or to analyse traffic... they exist only for the security and proper functioning of the service (legal basis: legitimate interest of the controller, Art. 6(1)(f) GDPR) and are kept for the strictly necessary technical time, except where needed to investigate computer crimes against the site, after which they are deleted.

4. Technical cookies. This website installs technical cookies only, i.e. those strictly necessary to deliver the pages you are visiting. For these cookies, the law does not require consent (Art. 122 of Italian Legislative Decree 196/2003 and the Guidelines on cookies and other tracking tools adopted by the Italian Data Protection Authority — Garante per la protezione dei dati personali — on 10 June 2021). You can manage or block them at any time through your browser settings; blocking them may prevent some features of the site from working properly. There are no profiling cookies and no third-party cookies.

5. The only exception: the NIS2 campaign pages. The two advertising pages under /nis2/ contain a Google tag (Google Ads and Analytics) used to measure campaign results. On those pages, and only there, third-party cookies for statistical and marketing purposes may be installed. The tag runs in Consent Mode and stays disabled until you give consent through the dedicated banner: if you decline, no profiling cookies are installed. You can change your mind at any time by clearing cookies in your browser. This involves a transfer of data to Google LLC, carried out on the basis of the standard contractual clauses approved by the European Commission. These tools are not present anywhere else on the site.

6. Nothing else. Outside the campaign pages there is no profiling, no automated decision-making (Art. 22 GDPR), and no transfer of your data outside the European Union.

Who can see your data

Your data may be processed by internal staff who are authorised and instructed pursuant to Art. 29 GDPR, and by the providers that make this website technically possible. In particular, these pages are hosted by Serverplan S.r.l., a hosting provider with servers located in Italy, acting as a data processor pursuant to Art. 28 GDPR. Your data is not disclosed or communicated to any other party, except where required by law or requested by the judicial authorities.

Your rights

At any time you may exercise the rights provided for by Articles 15-22 of the GDPR: access, rectification, erasure, restriction, objection and portability of any data you have provided to us. Just write to consulenza@nicolacasto.it... a person replies, not a form, within one month of your request as required by Art. 12 GDPR.

If you believe the processing infringes the law, you have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), pursuant to Art. 77 GDPR, or to bring the matter before the courts.

Links to other websites

From these pages you can reach external sites... my social profiles, GitHub, the book's page. Once there, their privacy notices apply, not this one. My advice is the same as always: before you click, know where you're going.