This notice explains how the personal data of visitors to www.cisilino.com is processed, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It covers website visitors only: the notice on the services provided to customers is a separate document. Last updated: 29 October 2026.
Data controller
Matteo Cisilino, sole proprietorship, Via Latisana – Rivignano 13/D, 33061 Rivignano Teor (UD), Italy. VAT number 03128900309.
- Email: privacy 🐌 cisilino.com (replace the 🐌 emoji with the @ sign)
What data we process and why
Browsing the site
The server automatically records technical data such as IP address, date and time, requested page and browser. It is needed to run the site, keep it secure and trace any abuse. Legal basis: the controller’s legitimate interest in the security of the site (Art. 6(1)(f) GDPR).
Protecting the site
The site uses the security plugin Cisilino Site Defense Network. When a login attempt fails, it records the IP address, the username tried, the outcome and the time, but never the password. Addresses that exceed a threshold of attempts may be blocked. Legal basis: legitimate interest in security (Art. 6(1)(f)).
Bookings
The booking form asks for the mode (on site or remote), the chosen date and duration, your name and email (required) and, optionally, a phone number, a subject and notes. Your IP address is recorded together with these data. Everything is sent to the diary managed by the controller on his own servers, to handle the request and get back to you. The request stays pending until you confirm it with the link you receive by email. The IP address is also used to limit repeated requests, as protection against abuse, through a temporary counter. Legal basis: performance of pre-contractual measures or of a contract at your request (Art. 6(1)(b)) and legitimate interest in security (point (f)). If a booking leads to a contractual relationship, invoicing data is kept for 10 years, as required by Articles 2220 and 2946 of the Italian Civil Code.
Email and contact
The site’s emails (booking confirmations and replies) are sent through the controller’s own servers, with authentication and delivery on his own infrastructure, without third-party mail services. If you write to us, we use your address and the content of your message to reply. Legal basis: Art. 6(1)(b) or (f), as the case may be.
Comments
If you post a comment, your name, email, IP address and text are saved. Your name, email and website can be stored in a cookie only if you tick the relevant box and accept the cookie in the banner. Comments may be moderated before publication. Comment data, even if not published, may be used for the security of the site and to counter spam and abuse. Legal basis: your consent for the cookie (Art. 6(1)(a)) and legitimate interest in security for preventing abuse (point (f)).
Cookies
During anonymous browsing the site sets no cookies. Details in the cookie policy.
Who we share data with
Data is processed directly by the controller, on servers he owns and manages himself, on dedicated private-cloud infrastructure. The servers are located exclusively in data centres within the European Union (Germany and France, with backups in Finland). No data is transferred to countries outside the EU/EEA. Data is not sold or passed to third parties for their own purposes. For contractual relationships, electronic invoicing is carried out through Aruba S.p.A. (Italy).
How long we keep data
- Technical and security logs: according to the backup retention policy, with up to 12 daily, 2 weekly, 2 monthly and 1 yearly copies, after which they are deleted.
- Requests and bookings: for as long as needed to handle them and get back to you.
- Comments: as long as the comment is published or until you ask for its removal.
- Invoicing data and contracts: 10 years.
Backups are encrypted and kept in the Helsinki data centre, separate from the production ones. When data is deleted from the production systems, the backup copies containing it are deleted within 62 days.
Your rights
You may at any time ask for access to your data, rectification, erasure, restriction and portability, and object to processing, by writing to the controller’s contact details. Where processing is based on consent, you may withdraw it without affecting the lawfulness of the earlier processing. We reply within one month, extendable by two months in the cases set out in Art. 12 GDPR. You also have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the authority of your own country.
Security
Administrative access to the servers is only by cryptographic key, backups are encrypted and access logs are kept on a system separate from the production servers.
