Privacy

The data controller is Carlo Oriente. For anything about your data, write to the email address in the footer. No data protection officer has been appointed, as none is required for an activity of this size.

To send you a page or a photograph, the servers that host this site receive what every browser sends: your IP address, browser type, the address requested and the time. This data is used only to deliver the site and keep it secure, and it is never combined with anything else to identify you.

The site also counts visits with Cloudflare Web Analytics: which pages are viewed, the referring site, your country, browser and device type, and how quickly the page loaded. It sets no cookies, stores nothing on your device and doesn’t fingerprint your browser, so visits are never linked to each other or to you, here or on other sites. Carlo only ever sees totals.

Legal basis: legitimate interest in running a working, secure website and knowing which work is seen (art. 6(1)(f) GDPR). You can object at any time by writing to Carlo, or block the counting with any content blocker. Logs and visit data are deleted automatically after the period set by each provider.

If you email Carlo, he receives your address, your name and whatever you choose to write. It is used to reply and, if you commission a shoot, to carry out the work. His email provider stores the messages on his behalf. Writing is up to you; without your details, Carlo simply can’t reply.

Legal basis: steps you ask for before a contract, and the contract itself (art. 6(1)(b) GDPR). Messages are kept for as long as the conversation or the job needs them. Records tied to an invoice are kept for ten years, as Italian law requires (art. 2220 Codice civile).

The public site sets no cookies and loads no ads, social widgets or tracking analytics. Its typeface is served from this site, not from Google.

If the hosting provider’s firewall needs to check that a suspicious request comes from a real browser, it may set a short-lived security cookie. It is strictly necessary to protect the site and is never used to track you.

One value is kept in your browser’s session storage: the category you were browsing, so the next and previous links on a project stay in it. It never leaves your device and disappears when you close the tab. Because it is strictly necessary for something you asked for, it needs no consent.

The private admin area sets a login cookie for the site’s owner only.

• Netlify, Inc., United States: hosting and request logs. Privacy policy
• Cloudflare, Inc., United States: the domain’s name servers and anonymous visit counts. Privacy policy
• Cloudinary Ltd.: stores and delivers the photographs, and logs image requests. Privacy policy
• Turso (ChiselStrike Inc.), United States: the database for the site’s content. It holds no data about visitors. Privacy policy

They act as processors under data processing agreements. Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Instagram is only a link. Once you follow it, Meta’s privacy policy applies.

You can ask to access, correct or delete your data, to restrict or object to how it is used, and to receive it in a portable format (arts. 15–21 GDPR). Write to the email address in the footer and you’ll get an answer within one month.

Nothing here involves profiling or automated decisions, and no data is sold or shared for marketing. If you think your data has been mishandled, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority where you live.

If this notice changes, the date at the top changes with it.