Privacy policy

1. Controller and scope

The data controller is Gianluca Luisi, who can be contacted at [email protected], including for all personal data protection requests.

This policy covers the personal website gluisi.it, including its Italian and English versions, the Flight / UAS, Sound, Music, Software, About and Contact sections, and the web pages dedicated to applications. It is provided under Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended.

This policy covers only the personal data processing connected with the gluisi.it website described below, including browsing pages that present software, applications and services.

Any personal data processing arising from the use of those products is separate and is described in their respective privacy notices. The terms of use specific to each software product, application or service also apply. This website privacy policy does not replace those documents.

External websites reached through links are subject to their own privacy policies and terms of use.

2. Browsing and operation of the website

To deliver the pages and resources you request, network systems process data such as your IP address, date and time, requested URL, request method and outcome, information sent by your browser about your device and software and, when transmitted, the referring page. Loading images, fonts, audio and video also involves network requests.

These data are used to make the website available, resolve faults and protect its security by preventing abuse and abnormal access. The legal basis is the controller’s legitimate interest in delivering and protecting the website under Article 6(1)(f) GDPR, limited to processing proportionate to these purposes. Any processing necessary to comply with a specific legal obligation is based on Article 6(1)(c).

Data technically necessary for communication are processed automatically: without them, the pages could not be delivered. The website does not require a public user account and has no registration forms, comments, newsletters or online purchases.

3. Email and voluntary enquiries

The email link opens your email application; it does not automatically send a message. When you write to the controller, you provide your email address, any name you include, the message, attachments and metadata needed for correspondence.

These data are used to reply, handle proposals and collaborations, provide explanations or support, and follow up on the conversation. For enquiries relating to a contract or steps requested by the individual before entering into a contract, the legal basis is Article 6(1)(b) GDPR. General correspondence is based on the legitimate interest in handling incoming enquiries under Article 6(1)(f). Requests to exercise data protection rights are processed to comply with GDPR obligations under Article 6(1)(c).

Providing data is optional, but a reply address and relevant information are necessary to answer. Please do not send passwords, credentials, health data or other sensitive information that is not needed. Sending an email does not subscribe you to promotional communications; these contacts are not used for newsletters or automated marketing.

4. People featured in the content

The website describes personal and professional experiences and may include names, roles, credits, images and information about authors, artists, collaborators and other people involved in the activities described. Sources include the controller’s personal and professional archive, materials received during those activities and publicly accessible sources, such as scientific publications, recording credits and official project pages.

The purpose is to document experiences, works and contributions and give appropriate credit. Processing of relevant personal data is based on the legitimate interest in describing and documenting the controller’s own experience under Article 6(1)(f) GDPR, respecting individuals’ rights, reasonable expectations and dignity.

Published data are accessible to visitors and, when pages are public and indexable, may be found through search engines. A publicly accessible source does not remove personal data protection. Anyone mentioned or depicted can contact the controller to identify the specific source and request correction, removal or restriction, or object to processing, subject to the conditions and limits of the law. This page does not replace any individual notification obligations under Article 14 GDPR.

References to trademarks, companies, products and people are further explained in the Legal notice.

5. Infrastructure, providers and recipients

The website uses hosting infrastructure reached through the Cloudflare network. The domain is registered with Aruba, which also provides the domain’s email service.

• Cloudflare processes request data passing through its network to provide connectivity, delivery and protection. This includes the connection error diagnostics described in the cookies and technical tools section. The group entities and subprocessors involved are identified in the data processing agreement and Cloudflare privacy policy.
• Aruba S.p.A. provides domain registration and email. Domain registration does not mean that Aruba hosts the website’s pages; when you write to the website’s email address, the email service processes your message to deliver and store it in the mailbox. See Aruba’s data protection information.
• Where necessary, data may be accessible to authorised technical support personnel and professional advisers bound by confidentiality, and may be disclosed to competent authorities when required by law or a lawful request.

Providers processing data on behalf of the controller operate under the agreements required by Article 28 GDPR; for purposes they independently determine, they may act as separate controllers under their own policies. Browsing data and incoming messages are neither published by the controller nor sold to third parties. Public disclosure concerns only the editorial content described above.

6. Processing outside the European Economic Area

Cloudflare’s network and providers operate internationally: technical data may also be processed outside the European Economic Area, including in the United States. Processing therefore does not necessarily take place exclusively in Italy.

The Cloudflare data processing agreement provides for European Commission standard contractual clauses and the safeguards described there for restricted transfers. Where applicable, an adequacy decision under Article 45 GDPR may apply; in other cases, Article 46 safeguards and any necessary supplementary measures are required. You can ask the controller for information about the applicable safeguards and a copy, with redactions where necessary to protect confidential information.

7. Retention periods

Retention depends on the purpose and nature of the data:

• Ordinary email enquiries: until the enquiry has been dealt with and, to allow for follow-up questions, for no more than 12 months after the last exchange. For messages that are not pursued, the period runs from receipt; messages no longer useful may be deleted sooner. The specific needs described in the following point remain applicable.
• Contractual relationships, compliance and disputes: only necessary correspondence is retained for the relationship’s duration and the subsequent retention or limitation periods that actually apply. An obligation relating to contractual or tax documents does not justify keeping all emails indiscriminately.
• Technical data: for the time needed to handle requests and security events. The website server configuration does not enable an application access log; network services may process their own logs according to the service, settings and applicable obligations. Data needed to investigate a specific incident or protect a legal right may be retained until that need ends. Provider log retention is distinct from the lifetime of cookies or NEL instructions in the browser.
• Editorial content: while it remains relevant to documenting the experiences and contributions described, taking account of individuals’ requests and any need to correct, update or remove data.

Once the purpose ends, data will be deleted or anonymised, subject to legal retention obligations. This website does not automatically delete email: the mailbox and any copies are managed in accordance with these criteria.

8. Cookies, resources and external links

The website code does not set cookies, use localStorage or sessionStorage, or integrate advertising tools, marketing pixels or services that analyse visitor behaviour. The language is determined by the page address; music player controls operate within the open page without storing persistent preferences.

Fonts and media are served by this website. Links to LinkedIn, SoundCloud, Beatport, companies, projects and publications are external links, not embedded widgets or players from those platforms. Following a link takes you to the external service, which processes data under its own policy and settings.

Cloudflare may perform technical processing at network level independently of the page code. For NEL diagnostics, possible security mechanisms and browser settings, see the Cookies and technical tools notice.

9. Processing methods and automated decisions

Data are processed using electronic tools and proportionate security measures, including HTTPS delivery of pages and access controls for management systems. During the restricted preview, HTTP authentication may be required: this is not visitor registration and does not create a personal website account.

The controller does not carry out advertising profiling or make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR. Network protection systems may filter requests considered abusive or require security checks.

10. Your rights and how to exercise them

Where Articles 15–22 GDPR apply, you may request access to and a copy of your data, rectification, erasure and restriction of processing. You may obtain portability of data you have provided where processing is automated and based on consent or a contract, within Article 20’s limits.

You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. The controller will stop that processing unless compelling legitimate grounds overriding your interests are demonstrated, or processing is needed to establish, exercise or defend legal claims. If a specific operation is based on consent, you may withdraw it without affecting the lawfulness of prior processing; ordinary browsing and correspondence described here do not rely on general consent.

Write to [email protected], describing your request and providing information useful to locate your data. Where there are reasonable doubts about identity, only additional information necessary to verify it may be requested. A response is normally provided within one month; where requests are complex or numerous, this may be extended by up to two further months, with notice and reasons given within the first month. Exercising your rights is normally free of charge, subject to the exceptions in Article 12 GDPR.

You may lodge a complaint with the Italian Data Protection Authority or the supervisory authority in the EU Member State of your habitual residence, workplace or the alleged infringement. You also retain the right to seek a judicial remedy. You do not have to contact the controller before making a complaint.

11. Updates

This policy is updated when processing, services or applicable provisions change. The date above identifies this version. New features requiring specific information or consent must be accompanied by that information and, where needed, consent must be obtained before activation.

The main references are the GDPR, as made available by the Italian Data Protection Authority and its Guidelines on cookies and other tracking tools of 10 June 2021.