Privacy
Privacy Notice
This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) to users of michelemarchioro.it and michelemarchioro.com.
Version 1.6 – 25 October 2026
Data Controller
Who processes your data
The data controller is Michele Marchioro, acting as an individual and professional and as owner of michelemarchioro.it and michelemarchioro.com.
For requests concerning personal data protection, the dedicated address privacy@michelemarchioro.it is active. The international domain also provides privacy@michelemarchioro.com, which forwards messages to the same dedicated mailbox.
No Data Protection Officer (DPO) has been appointed, as the applicable requirements for such an appointment are not currently met.
Data processed
What data may be processed
The websites mainly process data that users choose to provide voluntarily in order to contact the controller. This may include first name, last name, email address, telephone number if provided, the subject and content of a message, and any additional information voluntarily supplied by the data subject.
The websites and hosting service may also process technical data necessary for communications and service security, such as IP address, date and time of the request, browser and device information, requested URLs, and technical or security logs.
No special categories of personal data under Article 9 GDPR, identity documents, or personal data relating to third parties are requested. Users are asked not to provide such data unless strictly necessary for their request. Where excessive or unnecessary data are provided voluntarily and no lawful basis exists for further processing, those data will be deleted or no longer used.
Purposes and legal bases
Why data are processed
Responding to requests and communications. Data are processed to read messages, reply to users and manage the relationship voluntarily initiated by them. The legal basis is the controller’s legitimate interest in managing incoming communications and maintaining relevant professional or personal relationships, pursuant to Article 6(1)(f) GDPR.
Requests that may lead to a professional engagement. Where a user requests information or preliminary activities with a view to a potential engagement or consultancy assignment, processing may be necessary in order to take steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR.
Compliance with legal obligations. Where the relationship gives rise to tax, accounting, administrative or other legal obligations, the necessary data are processed pursuant to Article 6(1)(c) GDPR.
Website security and operation. Technical data may be processed to ensure the availability, integrity and security of the websites, prevent abuse and diagnose anomalies. The legal basis is the controller’s legitimate interest in the security of systems and services, pursuant to Article 6(1)(f) GDPR.
Statistical analysis and website improvement. The controller uses self-hosted Matomo Analytics to obtain statistics on the use of the websites, understand which content is accessed and improve structure, performance and usability. The processing is based on the controller’s legitimate interest in measuring and improving the websites under Article 6(1)(f) GDPR, with the data-minimisation measures described below. Matomo is not used for behavioural advertising, commercial profiling or cross-site tracking across websites controlled by different parties.
Professional updates and marketing on consent. Only where the individual selects a separate, optional checkbox, Michele Marchioro may use the email address provided to send professional updates, insights, invitations to events and information about his professional services. The legal basis is consent under Article 6(1)(a) GDPR and applicable rules on electronic communications. Consent is not required to receive a reply and can be withdrawn at any time by emailing privacy@michelemarchioro.it or following the instructions in marketing communications. Data collected through these websites are not shared with AD Management for commercial purposes.
Providing data through any contact forms is optional. Failure to provide such data only prevents the controller from replying through that channel.
Retention
How long data are retained
Contact details. Names, email addresses, telephone numbers and other ordinary contact details may be retained for as long as there remains a reasonable interest in maintaining a professional or personal relationship with the data subject. The need for retention is reviewed periodically and data are deleted when they are no longer relevant to the purpose for which they are kept or where an objection by the data subject must be upheld.
Contacts consenting to professional updates and marketing. Email addresses are processed until consent is withdrawn, and in any case for no longer than 24 months after the last meaningful interaction unless consent is renewed. Records demonstrating consent and withdrawal are kept as necessary to show compliance with applicable obligations.
Correspondence and additional data without follow-up. Where preliminary exchanges do not lead to any engagement, consultancy, service, tax document or other activity justifying further retention, messages, attachments and other personal data beyond ordinary contact details are deleted within twelve months of the last contact.
Contractual, tax or accounting relationships. Data relating to relationships that result in services, tax, accounting or contractual documents are retained for the period required by applicable law, normally ten years, and in any event for any longer period necessary to comply with legal obligations, deal with assessments, or establish, exercise or defend legal claims.
Technical and security data. Logs and other technical data are retained only for as long as necessary for website operation, security, abuse prevention and compliance with any applicable legal obligations, according to the criteria and configurations applied to the hosting service.
Matomo data. Raw analytics logs are configured to be deleted automatically after 180 days. Aggregated statistical reports may be retained for longer to allow historical comparisons and website trend analysis, in accordance with the principles of data minimisation and storage limitation.
Recipients and providers
Who may process the data
The websites are hosted by Netsons S.r.l., based in Italy. In providing hosting services and email services for the michelemarchioro.it and michelemarchioro.com domains, Netsons may process personal data on behalf of the controller as a processor under Article 28 GDPR, within the limits set by the contract and the related Data Processing Agreement.
Personal data are not transferred, sold or disclosed to third parties for marketing or profiling purposes.
The websites may contain links to external services such as LinkedIn, XING, FIDE, Lichess and Chess.com. Simply displaying such links does not involve the voluntary disclosure to those services of data submitted through contact forms; once an external link is followed, processing is governed by the terms and privacy notices of the relevant provider.
International transfers
Data outside the European Economic Area
Data submitted through contact forms are delivered to info@michelemarchioro.it; privacy requests are handled through privacy@michelemarchioro.it. Mailboxes and forwarding addresses for michelemarchioro.it and michelemarchioro.com use email services provided by Netsons in Italy, with the aim of avoiding the need to transfer message content to third countries.
The typefaces used by the websites are hosted locally within the website infrastructure and are served from the michelemarchioro.it domain, without requests to Google servers for font loading. If third-party services involving transfers of personal data outside the EEA are introduced in the future, such transfers will take place only where there is a valid legal basis and safeguards compliant with Chapter V GDPR.
Automated decision-making
No profiling
Data collected through these websites are not used for profiling, behavioural advertising or automated decision-making producing legal effects or similarly significant effects on the data subject.
Rights
Your rights
Where provided for by the GDPR, data subjects may request access to their personal data, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interests. The exercise of these rights may be subject to the limitations provided by applicable law.
Requests may be sent directly to privacy@michelemarchioro.it or through the Connect page.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority under the GDPR.
Updates
Changes to this notice
This notice may be updated following legal, technical or organisational changes. The version number and date shown at the beginning of the page identify the applicable version.