PRIVACY
Notice provided pursuant to Articles 13 and 14 of the European Regulation on the protection of personal data no. 679/2016 (GDPR) and of Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
This page explains what data the website collects, why it collects it, who it is shared with and how long it is kept. It applies to this website only, and not to other sites reachable through links.
Data controller
The data controller is Clara Graziolino Studio, Via Silvio Pellico 15/A, 10125 Turin, Italy.
For any request concerning your data, you can write to info@claragraziolino.com.
No data protection officer has been appointed, as the conditions requiring one do not apply.
Browsing data
The computer systems and software procedures that run this website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of internet communication protocols: IP address, browser type and version, operating system and device type, date and time of the visit, referring page and pages visited, name of the internet service provider.
This data is used to deliver the website correctly, to keep it secure and to obtain statistical information about its operation. The IP address is personal data and is treated as such: it serves to identify unauthorised access attempts and automated attacks, and it is not cross-referenced with other information to identify visitors.
Legal basis: the controller’s legitimate interest in keeping the website running and secure (Article 6(1)(f) GDPR).
Data submitted through the contact form
The form on the contact page collects name, email address and the content of the message. Before sending, you are asked to confirm that you have read this notice.
This data is used solely to answer the request received. It is not used for marketing, it is not transferred and it is not sold to third parties under any circumstances. Messages received are sent by email to the controller and are also stored in the website database, so that requests remain available over time.
Legal basis: the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR).
Protection against automated messages
To prevent the form being used by automated systems, the website uses two services:
Google reCAPTCHA v3, which analyses browsing behaviour to tell a person from a program. The service is active on all pages where the form appears and transmits to Google the IP address and some information about the interaction with the page. The service is activated only when the form appears on screen. If you leave the page without scrolling near the form, no data is transmitted to Google.
Akismet, which checks submitted messages against an archive of spam reports. The name, email address and IP address of the sender are transmitted to the service.
Legal basis: the controller’s legitimate interest in protecting the website from abuse and automated submissions.
Visit statistics
The website uses Google Analytics 4 to understand how many people visit it, where they come from and which pages they read. The tool is activated only after you have given your consent through the cookie banner: if you do not accept, no statistical cookie is installed and no data is sent to Google.
Legal basis: your consent, which can be withdrawn at any time (Article 6(1)(a) GDPR).
Consent register
Every choice made on the cookie banner is recorded in an archive internal to the website, which stores the date and time of acceptance and the IP address in anonymised form, that is, stripped of its last portion and therefore not traceable to an individual device.
The register serves to demonstrate, if required, that consent was collected correctly. The data is not shared with anyone and remains on the server hosting the website.
Legal basis: the controller’s obligation to be able to demonstrate the consent given (Article 7(1) GDPR).
Who the data is shared with
In addition to the controller, access to the data may be available to the technical service providers used by the website, acting as data processors or as autonomous controllers:
- Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy: provides the web space hosting the website and keeps the server logs (service privacy policy). For any request: privacy@staff.aruba.it
- Google: provides the reCAPTCHA and Google Analytics services (how Google uses data).
- Automattic: operates the Akismet anti-spam service (service privacy policy).
- ManageWP: allows remote technical management and maintenance of the website, with access to the installation and to the database (service privacy policy).
- Dropbox: receives the backup copies of the website, which include the database (service privacy policy).
- Google, also for the Google Fonts typefaces: they are loaded from Google servers, which receive the visitor’s IP address (Google privacy policy).
Data may also be disclosed to the judicial authorities, only in the cases provided for by law and following a legitimate request.
Transfers outside the European Union
Some of the providers listed above are based in the United States, in particular Google, Automattic, Dropbox and ManageWP. Using their services therefore entails a transfer of personal data outside the European Economic Area.
The transfer takes place on the basis of the European Commission adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework for providers that have joined it, and on the basis of the standard contractual clauses approved by the European Commission in the other cases.
The typefaces used by the website (Cormorant and Montserrat) are requested from the Google Fonts service. Displaying the pages therefore involves a connection to Google servers, which receive the visitor’s IP address.
How long the data is kept
- Browsing data and server logs: for the time technically necessary for security and diagnostics, according to the hosting provider’s settings.
- Security logs: for the period set in the protection system, in any case limited in time.
- Messages received through the forms: messages stored in the website database are deleted automatically after six months. Correspondence received by email remains on the controller’s workstation for the duration of the professional relationship and afterwards as documentation of the work carried out and for the periods provided by law on contractual and accounting matters.
- Google Analytics statistical data: two months for event data and fourteen months for user data, according to the property settings.
- Consent register: twelve months from registration, with automatic daily deletion of the oldest entries.
- Backup copies: they contain the data existing at the time they are created and are replaced by subsequent copies according to the rotation cycle in place.
Once these periods expire the data is deleted, unless it must be kept to comply with a legal obligation or to defend a right in court.
How the data is protected
Processing is carried out using computer tools and with logic strictly related to the purposes indicated. Data submitted through the website travels encrypted over HTTPS. Access to the administration area is protected by personal credentials and by a security system that limits unauthorised access attempts.
The website is protected by the Wordfence security system, which records IP addresses and access attempts (service privacy policy).
No system is absolutely secure, however, and the total inviolability of information transmitted over the internet cannot be guaranteed.
Your rights
As a data subject you may exercise the rights provided by Articles 15 to 22 GDPR, and in particular:
- obtain confirmation that processing is taking place and access your data;
- request its rectification or updating if inaccurate or incomplete;
- request its erasure;
- request the restriction of processing;
- receive the data in a readable format and transfer it to another controller;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out previously.
To exercise these rights it is enough to write to info@claragraziolino.com. You will receive a reply within one month of the request.
If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
COOKIE POLICY
Cookies are small text files that websites save on the visitor’s device and that are read back by the browser on each subsequent visit. This section is drafted according to the guidelines of the Italian Data Protection Authority of 10 June 2021.
Technical cookies
They serve the operation of the website and do not require consent. On this website they are used to store your choice on the cookie banner, to manage the browsing session and for security functions. Some expire when the browser is closed; the one recording the cookie choice lasts one month.
| Name | Origin | Duration | Purpose |
|---|---|---|---|
| cookie_notice_accepted | claragraziolino.com | 1 month | Stores the choice made on the cookie banner |
| PHPSESSID | claragraziolino.com | Session | Maintains the browsing session, expires when the browser is closed |
| _GRECAPTCHA | google.com | 6 months | Tells people from automated systems filling in the form (reCAPTCHA) |
| wfwaf-authcookie-… | claragraziolino.com | 1 year | Recognises legitimate requests for the Wordfence security system |
Statistical cookies
They are installed only if you accept the banner and come from Google Analytics 4. They serve to count visits and to understand how the website is used. If you refuse the banner or make no choice, these cookies are not installed and Google Analytics is not loaded.
| Name | Origin | Duration | Purpose |
|---|---|---|---|
| _ga | claragraziolino.com | 2 years | Assigns an anonymous identifier to distinguish visitors |
| _ga_9E4D61BHH2 | claragraziolino.com | 2 years | Maintains the session state for the website’s Analytics property |
Third-party services
Google reCAPTCHA, as indicated above, is a technical security component loaded from Google servers.
The typefaces are loaded from the Google Fonts servers.
Videos shown on the website are hosted on the website’s own server and are not loaded from external platforms.
This website does not host social sharing buttons, does not use advertising pixels and does not take part in remarketing networks.
How to withdraw consent
You can change your choice at any time using the consent withdrawal link at the bottom of this page.
How to manage cookies from the browser
Every browser allows you to block or delete cookies already on your device. Please note that disabling technical cookies may prevent some functions of the website from working correctly. Instructions can be found on the pages of Mozilla Firefox, Google Chrome, Microsoft Edge, Apple Safari and Opera.
COPYRIGHT
All content on this website, texts, graphics, photographs and code, is the property of Clara Graziolino, unless otherwise indicated.
Any third-party content present, such as logos and images belonging to other parties, remains the property of its respective owners. Anyone who believes that content has been published in breach of their rights may report it to info@claragraziolino.com and it will be removed.
TERMS OF SERVICE
By using this website you accept the conditions described in this section.
Limitation of liability
The content published is for informational purposes. While care is taken over its accuracy, no guarantee is given as to the completeness and currency of the information, and no liability is accepted for any damages arising from its use, from the temporary unavailability of the website or from errors and omissions in the content.
Links to third-party sites
The website contains links to sites operated by other parties. No control is exercised over those sites, and visiting them is at the visitor’s own risk.
Changes
The content, services and information present may be changed at any time without notice.
Applicable law
The relationship is governed by Italian law. The Court of Turin, Italy, has jurisdiction over any disputes that may arise.
Updates to this notice
This notice may be updated to reflect changes in the law or in the services used by the website. The version published on this page is always the one in force.
Notice updated on 14/9/2026.