Privacy &
Cookie Policy

Controller and scope

The data controller is Mattia Leonardi, Italy. Privacy requests may be sent to info@mattialeonardi.com.

This policy applies to the website mattialeonardi.com. It does not govern websites, platforms or services operated by third parties that may be reached through external links.

Personal data that may be processed

Browsing and technical data

When the website is requested, the hosting and content-delivery infrastructure may process technical information needed to transmit, secure and diagnose the service. This may include IP address, date and time of the request, requested resource, response status, browser and device information, operating system, referring page and security or error logs.

Information provided by email

The website has no internal contact form, user account, newsletter subscription or online payment function. If you contact Mattia Leonardi by email, the information you choose to provide may include your name, email address, organisation, project details, message, attachments and subsequent correspondence.

Special categories of data

Please do not send sensitive or special-category personal data unless it is strictly necessary for your request. If such information is received without being needed, it may be deleted.

Purposes and legal bases

• Website delivery, integrity and security: processing of technical data is necessary to provide the website, prevent misuse, investigate faults and protect the service. The legal basis is the controller’s legitimate interest under Article 6(1)(f) GDPR.
• Professional enquiries: email data is used to answer requests, discuss commissions, collaborations, licensing or other professional matters. The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request before a contract or to perform a contract.
• Administrative and legal obligations: information may be processed where required by tax, accounting or other applicable laws under Article 6(1)(c) GDPR.
• Establishment or defence of legal claims: relevant records may be retained where necessary on the basis of legitimate interests under Article 6(1)(f) GDPR.

The website does not use automated decision-making or profiling by the controller.

Hosting, service providers and recipients

The website is hosted and delivered through Netlify. Netlify may process technical and network data as a service provider for hosting, content delivery, availability, security and diagnostics. Further information is available in Netlify’s Privacy Policy and data-protection information.

Personal data may also be disclosed, only where necessary, to professional advisers, technical suppliers, public authorities or other recipients required by law. Personal data is not sold.

YouTube media and external links

Video thumbnail images are requested from YouTube’s image servers when the Work section is displayed. The embedded player itself is not loaded until you actively select a video. At that point the website uses YouTube’s privacy-enhanced domain, youtube-nocookie.com.

When YouTube content is requested, Google may receive technical data such as your IP address, browser, device information, referring page and interaction with the player. Depending on your settings and relationship with Google, cookies or similar storage technologies may then be used by Google. Details are provided in Google’s Privacy Policy.

Links to Spotify, Apple Music, YouTube and Instagram open third-party services. Those providers act independently under their own terms and privacy notices.

Cookies and similar technologies

The website itself does not set first-party cookies for ordinary browsing and no client-side analytics, advertising pixels or behavioural-profiling tools have been installed by the controller. For this reason, the website does not currently display a cookie consent banner.

Third-party technologies may become active when you choose to play a YouTube video or follow an external link. Their use is governed by the relevant provider’s privacy and cookie settings. You can also manage or delete cookies through your browser settings.

If non-essential analytics, advertising, embedded services or other tracking tools are introduced in the future, this policy and the consent mechanism will be updated before those tools are activated where required.

Data retention

Technical logs are retained by service providers according to their operational, security and legal retention periods. The controller does not create a separate visitor database from ordinary website traffic.

Email correspondence is retained only for as long as necessary to answer the enquiry and manage the professional relationship. Information connected with contracts, invoices or legal claims may be retained for the periods required by applicable law or until the relevant limitation periods have expired.

International data transfers

Some technology providers, including Netlify and Google, may process data outside the European Economic Area. Where applicable, such transfers are handled under recognised legal safeguards made available by the provider, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

Providing personal data

Technical data necessary to deliver the website is processed automatically when the site is accessed. Providing information by email is voluntary; however, without the information needed to understand and answer a request, it may not be possible to respond or provide the requested professional service.

Your data-protection rights

Subject to the conditions of the GDPR, you may request access to your personal data, rectification, erasure, restriction of processing, portability, or object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

Requests should be sent to info@mattialeonardi.com. Identity may be verified where reasonably necessary to protect the data concerned.

You also have the right to lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali, or with another competent supervisory authority in the European Union.

Security

Reasonable technical and organisational measures are used to protect the website and personal data against accidental loss, unauthorised access, alteration or disclosure. No method of internet transmission or electronic storage can, however, be guaranteed as completely secure.

Children

This professional portfolio is not directed to children and does not knowingly request personal data from them. A parent or guardian who believes that a child has provided personal data may contact the controller to request its review or deletion.

Changes to this policy

This policy may be updated to reflect changes to the website, service providers or applicable law. The current version will always be published on this page with its last-updated date.