1. Data Controller
Jacopo Mossa – Ephera
P. IVA 01882910092
Regione Rollo 43, 17031 Albenga (SV), Italia
info@ephera.it
The Controller has not appointed a Data Protection Officer, as the conditions requiring such appointment do not currently apply.
2. Data processed, purposes and legal bases
This policy applies only to ephera.it. External websites linked from these pages process data under their own policies.
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Browsing and hosting | IP address, requested URL, date and time, response code, browser and device technical data, security logs. | Delivering the website, ensuring security, preventing abuse and diagnosing technical faults. | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) and performance of a user-requested service. | Technical logs are kept for up to 30 days, unless a longer period is required to investigate security incidents or comply with legal obligations. |
| Content delivery | IP address and technical request data sent when images and editorial content are loaded. | Displaying website content and operating the content management infrastructure. | Legitimate interest of the Controller (Art. 6(1)(f) GDPR). | For the time technically necessary to deliver content and according to the processors’ documented security-log retention periods. |
| Google Analytics 4 | Online identifiers, first-party cookie identifiers, page and interaction data, approximate geographic and device information. Google states that GA4 does not log or store individual IP addresses. | Producing aggregate statistics and improving content and user experience. Advertising signals and personalisation are disabled by this website. | Consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). Google Analytics is not loaded before consent. | Analytics cookies: 13 months from first setting. User-level event data: 2 months in the GA4 property. Consent may be withdrawn at any time. |
| Email communications | Name, email address, message content and any data voluntarily included by the sender. | Replying to requests, taking pre-contractual steps and managing subsequent business or legal communications. | Pre-contractual or contractual steps (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); establishment or defence of legal claims (Art. 6(1)(f)). | Unsuccessful enquiries: up to 12 months after the last contact. Contractual, accounting or dispute-related records: for the applicable statutory period, generally up to 10 years. |
3. Data provided voluntarily
The contact form currently opens the visitor’s email application: the site does not transmit the name or message to an Ephera server. Data is processed when the visitor chooses to send the email, under the terms above.
The newsletter interface is not currently connected to an active subscription service. No mailing list processing is carried out through the website. This policy will be updated before that function is activated.
4. Recipients and processors
Data may be processed by authorised personnel and by suppliers acting under Article 28 GDPR, only as needed to provide their services. Current main technology providers are:
- Netlify, Inc. — hosting, delivery network and infrastructure logs.
- Sanity AS — content management, API and media delivery.
- Google Ireland Limited and its sub-processors — Google Analytics, only after consent.
- The Controller’s email and IT-service providers — delivery, security and management of communications.
Data may also be disclosed where required by law, a public authority or for the establishment, exercise or defence of legal claims. It is not sold.
5. Transfers outside the EEA
Some suppliers may process data outside the European Economic Area. Where this occurs, the Controller relies on an adequacy decision, including the EU–US Data Privacy Framework for certified US recipients, or on the European Commission’s Standard Contractual Clauses and any required supplementary safeguards. Further details and copies of the applicable safeguards may be requested from the Controller.
6. Your rights
Subject to the conditions in Articles 15–22 GDPR, you may:
- request access to and a copy of your data;
- request rectification or erasure;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive data you supplied in a portable format where applicable;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
Requests are free and can be sent to info@ephera.it.
7. Right to lodge a complaint
You may lodge a complaint with the Italian Data Protection Authority or seek a judicial remedy. Authority information and contact channels are available at www.garanteprivacy.it.
8. Changes to this policy
This policy is reviewed when services or processing activities change. If a change affects consent-based processing, the website will request a new choice where required.