Privacy Notice
Pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR") · Version of 2 November 2026. In case of discrepancy, the Italian version prevails.
1. Controller
Davide Botto, independent professional, Italian VAT number IT13773310969, with professional address at Via Bettino da Trezzo 2B, 20056 Trezzo sull'Adda (MI), Italy; email davide@davidebotto.com.
No Data Protection Officer has been designated, as the conditions of Article 37 GDPR are not met. Any data protection matter can be addressed to the email above.
2. Data processed
a) Data you provide through the contact form: name, email address, company or organisation (optional), subject and message, plus any other information you choose to include. Please do not send special categories of data (Art. 9 GDPR) or data on criminal convictions (Art. 10 GDPR); if sent spontaneously, they will only be processed to the extent strictly necessary to reply, or deleted.
b) Browsing data: IP address, date and time, method, requested resource, response code and size, referrer and browser user agent, automatically logged by the server hosting the website. They are not used to identify or profile visitors.
c) Anti-abuse data: the IP address of whoever submits the form is kept only in server memory, together with the submission time, to limit messages (maximum 5 per hour) and prevent automated spam.
d) Data provided to download the NIS2 Operational Manual: name, email address, organisation, optional role and message, your choice on receiving updates and contacts, and the date and time of the request. Your IP address is not recorded.
The website sets no cookies, uses no analytics, profiling or marketing tools and embeds no third-party content (see the Cookie Notice).
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to requests sent through the form and handling the resulting exchanges, including those preceding a professional engagement | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR); for requests unrelated to an engagement, the controller's legitimate interest in replying to those who contact him (Art. 6(1)(f)) | As long as needed to handle the request and, if no engagement follows, no longer than 24 months after the last exchange |
| Managing any resulting professional engagement | Performance of a contract (Art. 6(1)(b)) and legal obligations, e.g. tax law (Art. 6(1)(c)) | For the duration of the engagement and then 10 years (Art. 2220 Italian Civil Code) |
| Providing the NIS2 Operational Manual requested through the registration form, via a personal, time-limited download link | Performance of a service requested by you (Art. 6(1)(b) GDPR) | 24 months from the request |
| Sending updates on the manual and contacts about professional services, only if you ticked the dedicated box | Consent (Art. 6(1)(a) GDPR and Art. 130 Italian Legislative Decree 196/2003), which you can withdraw at any time | Until consent is withdrawn and in any case no longer than 24 months after the last contact |
| Operation, security and integrity of the website; prevention of abuse and attacks | Legitimate interest in the security of the controller's systems (Art. 6(1)(f); Recital 49 GDPR) | Server access logs: deleted automatically by rotation, after 5 weeks at the latest. Error logs (anomalous requests only): after 11 weeks at the latest. Anti-abuse counters: in memory only, up to 1 hour |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) | For the time strictly necessary, within the applicable limitation period |
The controller has balanced the legitimate interests above against your rights: the processing concerns ordinary data, provided by you or generated by normal browsing, and is consistent with the reasonable expectations of visitors. The balancing test is available on request. Data are deleted at the end of the periods indicated, are not used for marketing and are not subject to automated decision-making or profiling (Art. 22 GDPR).
4. Whether providing data is mandatory
The fields marked as required (name, email, subject, message) are necessary to receive a reply; without them the request cannot be sent. The company field is optional. Browsing data are inherent to the use of Internet communication protocols.
To download the NIS2 Operational Manual, name, email and organisation are required; role and message are optional. Consent to receive updates and contacts is optional and separate: without it, the download is still available.
5. How data are processed and secured
Messages are transmitted only over encrypted connections (HTTPS with HSTS) and delivered directly to the controller's mailbox; the web application does not store them in its own databases or record their content in logs. Measures under Art. 32 GDPR include a strict Content Security Policy, no third-party resources or scripts, rate limiting, input validation and data minimisation.
Manual requests are recorded in a restricted-access archive on the controller's server; when the email service is active, the controller is notified by email. The download link is sent only to the email address given in the form; it is personal, cryptographically signed and valid for 24 hours. The controller is also notified when the link is used.
6. Recipients
Data may be processed, as processors under Art. 28 GDPR and within the scope of their services, by: Akamai Technologies (Linode / Akamai Cloud Computing service), provider of the virtual server in a data centre in Frankfurt (Germany) on which the controller installs and runs the website himself; Microsoft Ireland Operations Limited (Dublin, Ireland), Microsoft 365 email service on which messages are received and stored. Data may also be disclosed to advisers bound by professional secrecy and to public or judicial authorities where required by law. Data are not disseminated or sold.
7. Transfers outside the EEA
Data are stored in the European Economic Area. As the providers belong to US-based groups, access from the United States cannot be excluded (e.g. for support). In that case transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), for certified entities, or on the Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR), as provided in the providers' data processing agreements. A copy of the safeguards is available on request.
8. Your rights
Within the limits of Articles 15-22 GDPR you may obtain access, rectification, erasure, restriction and, for contract-based automated processing, portability of your data, by writing to davide@davidebotto.com. Requests are answered without undue delay and in any case within one month, extendable by two months where Art. 12(3) GDPR applies. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive. Identity verification may be requested.
You can withdraw your consent to updates and contacts at any time by writing to davide@davidebotto.com or replying to any message you receive, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).
9. Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on the controller's legitimate interest (Art. 21 GDPR), by writing to davide@davidebotto.com. The controller will stop processing unless he demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
10. Complaints
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the supervisory authority of the Member State where you live, work or where the alleged infringement occurred (Art. 77 GDPR), without prejudice to judicial remedies (Art. 79 GDPR).
11. Links to third-party websites
Links to LinkedIn and other external sites open only if you click them; the destination site then processes data as an independent controller under its own policy (for LinkedIn: LinkedIn Ireland Unlimited Company, linkedin.com/legal/privacy-policy).
12. Changes
This notice may be updated; the version in force is always published on this page with its date.