Privacy Policy

The data controller is Arcanode di Alessandro Pasqualetti, a sole proprietorship (impresa individuale) with registered office at Corte Panicale, 55041 Camaiore (LU), Italy, VAT number (P.IVA) IT02755170467. You can contact us at any time at [email protected] or by post at the registered office. We have not appointed a data protection officer, as we are not required to. This is policy version 2.0, published on 2 October 2026.

• Details you send through the contact form (name, email address, optional phone number, your message, and the guided-form answers: areas of interest, industry, company size, project scope and timeline): used to reply to your request, prepare a demo or a quote, and follow up on it. Legal basis: your consent (Art. 6(1)(a) GDPR) and pre-contractual measures taken at your request (Art. 6(1)(b)).
• Consent evidence (date and time, policy version, page language, browser user agent and a salted hash of your IP address): kept to demonstrate that consent was validly given, as EU law requires. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
• Marketing attribution (the campaign parameters of the link that brought you here, the referring site, the landing page and a coarse device type): included in the internal email our team receives so we know which channels work. It is never sold or shared outside Arcanode. Legal basis: our legitimate interest in measuring our own marketing (Art. 6(1)(f)).
• Technical and security data (IP address, pages requested, browser, referrer, request rate and the outcome of anti-abuse checks), recorded in our server access logs: used to keep the website available, secure and free of spam. Legal basis: our legitimate interest (Art. 6(1)(f)).
• Aggregate usage statistics: we analyse our own server access logs with AWStats, a tool self-hosted on our server, to understand overall traffic in aggregate. It builds no individual profiles and is not shared with third parties. Legal basis: our legitimate interest (Art. 6(1)(f)); you may object at any time (see section 6).

This website does not use profiling or advertising cookies and shows no consent banner, because the only cookies and device storage involved are technical or functional.

• Cloudflare technical cookies. This site is delivered and protected through the Cloudflare network, which may set strictly necessary cookies (such as __cf_bm and cf_clearance) to route traffic, absorb attacks and remember that your device passed a security check. They are required to serve the site safely and, under Art. 122 of the Italian Privacy Code and the Garante guidelines of 10 June 2021, do not require consent.
• Anti-spam challenge (Cloudflare Turnstile). When you submit the contact form an invisible challenge checks that you are human. It runs on Cloudflare infrastructure and may place technical storage strictly needed for that check. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f)).
• Attribution (no device storage). We do not store campaign or attribution data on your device. When you submit the contact form with your consent, we read the campaign parameters of the link that brought you here (for example ?utm_source=linkedin) directly from your browser address bar and include them in the internal email our team receives, so that a request can be attributed to the right channel. Nothing is written to your device for this purpose.
• Form progress (session storage). While you complete the multi-step contact form, your answers are kept in your browser session storage so that opening this policy and going back does not lose them. They are removed when you submit successfully or close the tab.

You can block or delete cookies and site storage at any time in your browser settings; doing so may affect the security features of the site.

• Contact and project details, together with their attribution: 24 months from our last exchange, unless a business relationship begins, in which case for the period required by tax and accounting law.
• Consent evidence: 36 months, then deleted.
• Server access and security logs: up to 30 days.
• Contact-form progress in session storage: until you submit or close the tab.
• Aggregate statistics derived from the access logs contain no personal identifiers and may be retained longer.

Your data is handled by Arcanode and by a short list of providers acting as our processors or as infrastructure:

• Contabo GmbH (Germany, EU): hosts the server on which this website and our mail system run.
• Cloudflare, Inc.: delivers the site through its network and provides the Turnstile anti-spam service. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers to it rely on the European Commission adequacy decision (Art. 45 GDPR).
• Our own mail system (mailcow), self-hosted on that server in the EU: your message is delivered to our shared mailbox [email protected] and to the person who handles enquiries within Arcanode.

We use no third-party email-marketing platform, no CRM, no advertising network and no data broker, and we never sell your data. Apart from Cloudflare as described above, your data is not transferred outside the European Economic Area. Each provider processes data only on documented instructions or under its own published privacy terms, and we share no more than is necessary.

At any time and free of charge you may ask us for: access to your personal data (Art. 15 GDPR); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); and objection to processing based on our legitimate interest, including the usage statistics and attribution described above (Art. 21). Where we rely on consent, you may withdraw it at any time with effect for the future (Art. 7(3)), without affecting the lawfulness of processing before withdrawal. To exercise any right, write to [email protected] and we will reply within one month. If you believe our processing infringes the law, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (https://www.garanteprivacy.it), under Art. 77 GDPR, or bring the matter before the courts.

All connections to this website use TLS. Mail delivery upgrades to TLS via STARTTLS and refuses plaintext. IP addresses in the consent records are stored only as a salted hash, with the salt rotated periodically. The contact form is protected by rate limiting, a hidden honeypot field, a submission-timing check and the Cloudflare Turnstile challenge. The server sends strict security headers, including a Content-Security-Policy, and access to the data is limited to the controller. We keep only the data described above and only for as long as necessary.

We do not profile you, and no decision that produces legal effects or similarly significant effects concerning you is taken solely by automated means (Art. 22 GDPR).

If we change how we process data we publish a new version on this page with a new version number and date. The consent you give on the contact form records the version you accepted, so we can always show which text applied at that moment.