Privacy & cookies

1. Controller and contact

The data controller is Giulia Bucolo. For privacy questions or to exercise your rights, contact giuliabucolo02@gmail.com.

2. Data processed

Visiting the site transmits technical information to the hosting service, such as your IP address, requested URL, date and time, browser information and server responses. This is needed to deliver pages and maintain security.

If you use the contact form, the data processed includes your name, if supplied, email address, selected subject and message. An email address and message are needed to reply; your name is optional. Please do not submit health information, other special categories of personal data or information unnecessary for your request.

3. Purposes and legal bases

• Providing the site, preventing abuse and maintaining security: legitimate interests in operating a functional, secure portfolio, Article 6(1)(f) GDPR.
• Replying to collaboration and professional opportunity enquiries: taking steps at your request before a contract, Article 6(1)(b). For other messages: legitimate interests in replying to people who contact me, Article 6(1)(f).
• Meeting applicable legal obligations: Article 6(1)(c), where relevant.

The form does not subscribe you to a newsletter, and contact details are not used for promotional campaigns. The required checkbox only confirms that you have read this notice; it is not consent to analytics or marketing.

Aggregate visit statistics using Vercel Web Analytics: optional consent, Article 6(1)(a). Refusing or withdrawing consent does not limit access to the portfolio or contact form.

4. Recipients and services used

Data may be processed by the controller and providers needed for the activities below, within their respective functions. Data is not sold or used for personalised advertising.

• Vercel Inc., hosting and security: delivering pages and handling technical connection data. These necessary functions do not depend on analytics consent. Vercel privacy notice.
• Vercel Web Analytics, optional statistics: activated only after consent. It may process timestamps, visited pages, referrers, browser and device information, and approximate location derived from the connection. This site sends only public page views, with no custom events or form data; query strings and fragments are removed from page URLs. Analytics details and privacy information. To disable it, reopen “Cookies & privacy” and select “Reject”.
• EmailJS Pte. Ltd., form delivery: its API receives your name, if supplied, email, subject, message and technical connection information only when you press Send. The email service connected to EmailJS also participates in delivery. EmailJS privacy notice and data processing agreement.
• Google, Gmail: messages are received and managed in the controller’s personal Gmail inbox. No Google Workspace contract is assumed here. Google privacy notice.

Behance and LinkedIn links are ordinary links, not embedded widgets: opening them takes you to external sites with their own privacy notices. Google Analytics, Google Tag Manager, Google Ads, Microsoft UET and Amazon Ads are not used.

5. Processing outside the European Economic Area

Providers may process data outside the European Economic Area. EmailJS states that its servers are in the United States and refers to standard contractual clauses in its DPA. Its terms provide for automatic incorporation of the DPA for processing subject to the GDPR.

The site uses Vercel Hobby. The public Vercel DPA states that it applies to Pro and Enterprise plans; it is not declared automatically applicable to Hobby. Email uses personal Gmail, not Google Workspace. The controller must verify the terms and safeguards actually applicable to these services: analytics consent does not replace any required agreements or safeguards.

Contact the controller for information about available documented safeguards and to request a copy. This notice does not claim that outstanding contractual checks have already been completed.

6. Retention

Enquiries that do not become collaborations are retained for up to 12 months after the conversation closes, then deleted from the inbox and records managed by the controller, unless documented legal obligations or the protection of rights require otherwise. If a professional relationship follows, the necessary records are retained under the rules applicable to that relationship.

Providers’ technical logs, delivery events and backups follow their respective retention periods and criteria, as described in their notices and service settings. They are not a promotional database for this portfolio.

Your analytics choice is valid for six months, unless material changes require a new choice. Withdrawal stops future collection, but does not retroactively erase aggregate statistics already produced. Vercel states that analytics session identification is discarded after 24 hours; this is not the retention period for statistics. Hobby offers a one-month reporting window; provider logs and retention follow applicable terms.

7. Cookies and browser storage

Vercel Web Analytics loads only after consent. The provider describes aggregate statistics without third-party cookies, using a request hash to distinguish visits and without cross-site identification. This portfolio nevertheless makes the service conditional on consent. No advertising pixels, commercial profiling, social widgets or external videos are active. Fonts and media are served by the site.

• gb:site-entered · sessionStorage · manages the introduction during the tab session.
• gb:page-entry · sessionStorage · holds transition state, valid for 20 seconds; removed on the next page.
• cookie-consent · localStorage · accepted or declined.
• gb:cookie-consent-meta · localStorage · consent mechanism and notice versions, decision, analytics purpose allowed or refused, date and six-month expiry. Contains no name, email or personal identifier. This is a local record on the device, not a central consent register.

The legacy technical key gb:privacy-notice may remain from dismissing the previous notice; it does not authorise analytics. You can delete site storage in your browser settings. If storage is unavailable, analytics remain disabled.

Service details: Vercel Web Analytics privacy.

The site does not set advertising cookies. The technical storage listed above does not authorise statistics. Hosting providers may process technical data necessary to deliver and protect pages under their respective terms.

8. Preferences and future changes

“Accept all” authorises the single optional purpose, statistics with Vercel Web Analytics. “Reject” keeps only necessary features. Reopen “Cookies & privacy” in any page footer and select “Reject” to withdraw: the page reloads to stop the running script as well.

The choice is valid for six months. Silence, scrolling and browsing do not constitute consent. On expiry or after material changes, collection remains blocked until you choose again.

If your browser prevents saving the choice, statistics do not activate. “Continue without statistics” closes the notice for the current page only and does not constitute consent. Changed notice versions or purposes require a new choice; validity is checked again when the tab resumes and during prolonged visits.

9. Your rights

Where the GDPR provides, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests and withdraw any consent without affecting the lawfulness of earlier processing. Send requests to the controller; proportionate identity verification may be needed.

You may lodge a complaint with the Italian Garante per la protezione dei dati personali or the competent supervisory authority. The site does not make automated decisions with legal effects or perform profiling.

The controller responds without undue delay and normally within one month of receiving a request. Under Article 12 GDPR, this may be extended by two further months where permitted, with notice and reasons provided within the first month.