§Last updated: September 26, 2026
Privacy policy
This notice explains which personal data is processed when you visit andreapossidente.dev, comment on an article or write to me, why, for how long and what your rights are, under Article 13 of Regulation (EU) 2016/679 (the “GDPR”).
Data controller
The controller is Andrea Possidente, a private individual who runs this site as a personal portfolio. For any privacy request, write to info@andreapossidente.dev. No data protection officer (DPO) has been appointed, as none is required for this processing.
What data is processed
- Browsing data: when you open a page, the server hosting the site automatically records your IP address, date and time, the page requested, the outcome of the request, the browser and operating system you report (user agent) and the referring page.
- Data you send me: if you email me, I process your address, any name you give and the content of your message.
- Comments: if you comment on an article, I process the name you give, the text, the date, the page language and, if you enter it, your email. The email is optional, never published and only used to reply to you privately. To limit spam I also keep an encrypted fingerprint of your IP address (a hash with a secret key, from which the address cannot be recovered).
Comments are published only after I approve them, and are then visible to anyone under the name you gave: you may use a pseudonym.
The site sets no cookies for visitors and uses no analytics, tracking pixels or third-party embeds, and loads no fonts or scripts from external servers.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Serving the site and keeping it working and secure (browsing data) | Legitimate interest in running a working, secure website (Art. 6(1)(f) GDPR) |
| Replying to your messages | Steps taken at your request before a contract, for example a job offer (Art. 6(1)(b)); otherwise, legitimate interest in replying to people who write (Art. 6(1)(f)) |
| Publishing your comment under the name you give | Your consent, given with the form’s checkbox (Art. 6(1)(a)), which you can withdraw at any time |
| Protecting comments from spam and abuse (IP fingerprint) | Legitimate interest in keeping the discussion usable (Art. 6(1)(f)) |
| Establishing or defending legal claims in case of abuse or dispute | Legitimate interest (Art. 6(1)(f)) |
Your data is never used for marketing, profiling or automated decision-making.
How long data is kept
- Browsing data: up to 14 days, then deleted automatically, unless needed to investigate abuse of or an attack on the site.
- Emails: for as long as needed to handle the conversation and no longer than 24 months after the last contact, unless you ask for deletion sooner.
- Published comments: for as long as the article stays online, unless you withdraw consent or ask for removal. Comments that are not approved are deleted; those identified as spam are deleted automatically after 30 days.
- IP fingerprint attached to comments: 30 days, then deleted automatically.
- Database backups: 14 days. Deleted data also disappears from the backups within this period.
Who can access the data
Data is never sold or published. It is accessed only as far as needed for the service they provide by:
- IONOS SE (Germany), which provides the virtual server hosting the site, located in the European Union;
- Squarespace, the domain registrar, which forwards messages sent to info@andreapossidente.dev;
- Google (Gmail), the mailbox these messages are delivered to.
When a new comment arrives, I get a notification on my devices with the name given and the article title. It travels through my browser’s push service (for example Google, Mozilla or Apple) encrypted by the site: the service delivers it but cannot read its content.
Public authorities may access data only where the law provides for it.
Transfers outside the European Union
The site and its logs stay in the European Union. Emails, forwarded by Squarespace and delivered to Gmail, may also be processed by these providers in the United States, on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework, which both have joined, and of standard contractual clauses.
Your rights
You can at any time request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15–21 GDPR) by writing to info@andreapossidente.dev. I will reply within one month.
If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the supervisory authority of the country where you live or work.
Do you have to provide data?
Browsing data is necessary to visit the site: without it, the server cannot send you the pages. Writing to me and commenting are optional; a comment needs a name and some text.
Cookies and browser storage
The technical tools the site may store in your browser are described in the cookie policy.
Changes
If the site changes, for example by adding analytics, I will update this notice and, where required, ask for your consent before enabling new tools. The date of the last update is shown at the top.