1. Data controller
The controller responsible for personal data collected through this website is Alfredo Costa. For questions or to exercise your rights, contact: Information to be completed by the website publisher..
2. Data collected
When you use the contact form, the following data may be collected: name, email address, subject, selected project and message content. An irreversible fingerprint of the IP address is also used for security and abuse prevention; the full IP address is not stored in the contact database.
With your consent, first-party analytics record a random session identifier, pages visited, active time and, where the hosting infrastructure provides it, a country code. IP addresses are not stored in analytics. Outbound clicks to Spotify and YouTube are counted in aggregate without a visitor identifier.
3. Purposes and legal basis
Contact-form data are processed to receive, manage and reply to enquiries and to protect the website against abusive submissions. This processing relies on the legitimate interest in operating secure communications and, where applicable, on taking pre-contractual steps requested by the visitor. Analytics and external media players rely on your consent.
4. Recipients
Data are accessible only to the website publisher and, where technically necessary, to providers responsible for hosting and email delivery. Data are not sold and are not used for newsletters without specific consent.
5. Retention period
Messages and associated data are retained for the following period: Information to be completed by the website publisher.. Anonymous session analytics are retained for no longer than thirteen months. Data may be kept for longer where required by law or necessary for the establishment, exercise or defence of legal claims.
6. Your rights
Subject to the conditions of the GDPR, you may request access to, rectification or erasure of your data, restriction of processing, or object to certain processing. Exercise these rights at: Information to be completed by the website publisher.. You also have the right to lodge a complaint with the CNIL.
7. External content
Spotify and YouTube players are loaded only after you grant permission. Activating them causes your browser to connect to those platforms, which may process data under their own privacy policies.
8. Analytics
Analytics are hosted with the website and are available only inside the private Studio. They are activated only after you select “Analytics only” or “Allow all”. They are not used for advertising profiles or the sale of data.