This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended, and explains how the personal data of visitors to this website (the "Site") is processed.
1. Data controller
Elena Cacciagrano, VAT no. IT02774680694, who can be contacted by certified email at elenacacciagrano@pec.it.
2. Data processed
a) Data provided voluntarily by the user. The contact form collects:
- first and last name;
- email address;
- reason for contact (concert, event, collaboration, other);
- message text.
Providing this data is necessary to reply to the request. Please do not include unnecessary data in the message, in particular special categories of data (Art. 9 GDPR).
b) Browsing data. The systems running the Site acquire certain data whose transmission is implicit in the use of Internet protocols (IP address, browser type, date and time of the request). When the contact form is submitted, the IP address is also used solely to limit repeated submissions as protection against spam and abuse: it is kept temporarily in the server's memory, is not stored and is not linked to the user's identity. Traffic to the Site passes through Cloudflare, which acts as a security and performance proxy and processes the IP address and technical request data to protect the Site from attacks and automated traffic. The hosting provider may keep technical access logs for security purposes.
c) Visit statistics. The Site uses Cloudflare Web Analytics to understand visit trends in aggregate, anonymous form (pages visited, referring site, browser and device type, country, load times). The tool does not use cookies or any other browser storage, does not build profiles and does not identify individual users; the IP address is not kept for statistical purposes.
3. Purposes and legal bases
- Replying to requests for information and availability and managing any resulting artistic collaboration: performance of pre-contractual measures or of a contract at the data subject's request (Art. 6(1)(b) GDPR).
- Site security and protection of the form from spam, abuse and cyber attacks: the controller's legitimate interest (Art. 6(1)(f) GDPR).
- Aggregate visit statistics, to understand how the Site is used and improve its content and performance: the controller's legitimate interest (Art. 6(1)(f) GDPR).
- Compliance with legal obligations (e.g. tax) where a contract is entered into: legal obligation (Art. 6(1)(c) GDPR).
4. Processing methods
Data is processed electronically, with appropriate technical and organisational measures (encrypted HTTPS connection, anti-spam filters, submission limits) to prevent unauthorised access, loss or destruction. No automated decision-making or profiling takes place.
5. Recipients
Data is not disclosed or sold to third parties. It may be shared with:
- IONOS SE (Germany), the Site's hosting provider, as processor;
- Cloudflare, Inc. (USA), reverse proxy, security and content delivery service, as processor;
- Resend, Inc. (USA), the service that delivers contact form messages to the controller, as processor;
- public authorities, where required by law.
6. Third-party content
To display certain content, the user's browser loads resources directly from third-party servers, which therefore receive the user's IP address and process it as independent controllers:
The Site does not use social plugins, "like" buttons or tracking tools from these platforms. By clicking links to Instagram the user leaves the Site, and Meta's privacy policy applies.
7. Transfers outside the EU
Some providers (Cloudflare, Resend, Google, Meta) may process data in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework, where the provider participates, or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). IONOS hosting is located in the European Union.
8. Data retention
- Messages sent through the form: for as long as needed to reply and then for a maximum of 24 months. If a contract is entered into, for its duration and for the periods required by law (e.g. 10 years for tax records).
- IP address used to limit submissions: only for the duration of the check window (a few minutes), after which it is deleted.
9. Cookies
The Site only uses technical cookies, which are necessary for it to work:
- elena_lang: stores the language chosen by the user, lasts 12 months;
- Cloudflare security cookies (e.g. __cf_bm): distinguish human from automated traffic, last up to 30 minutes.
Under the Italian Data Protection Authority's guidelines (decision of 10 June 2021), technical cookies do not require consent, which is why the Site only shows an informational notice. The Site does not use profiling or analytics cookies: visit statistics (section 2c) are collected without cookies. Users can delete or block cookies in their browser settings; in that case the language preference will not be remembered.
10. Data subject rights
Under Articles 15–22 GDPR, users may at any time request:
- access to their data;
- rectification or erasure of their data;
- restriction of processing;
- to object to processing based on legitimate interest;
- data portability.
Requests can be sent to elenacacciagrano@pec.it. Users also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where they live or work.
11. Minors
The Site is not intended for children under 14, who must not submit data through the contact form.
12. Changes to this Privacy Policy
This notice may be updated. The version in force is always the one published on this page, with its last updated date.
Live moments