Privacy & cookies

1. Data controller and contact

The controller is Carlo Desantis, Italy. For questions about this notice or to exercise your rights, write to info@carlodesantis.com.

2. Browsing and technical data

Delivering and securing the website involves technical information such as IP address, requested URL, date and time, browser information and response status. Hosting is provided through a Contabo server located in Germany. This processing is based on the controller’s legitimate interest in operating a reliable and secure website (Article 6(1)(f) GDPR). Infrastructure logs are managed with the hosting service for operational and security purposes; access is restricted to authorised personnel and service providers.

The contact endpoint uses a SHA-256 identifier derived from the requesting IP address to limit abuse. This is pseudonymous, not anonymous. It is held in application memory for a 15-minute window; expired entries are cleared on subsequent requests or when the process restarts. The application does not log the contents of messages or SMTP credentials.

3. Contact forms and email

When you submit a proposal, the website processes your name, email address, message, selected opportunity and any organisation, profession, portfolio link, timing or budget information you provide. Required fields are marked in the form. Without them, the form cannot deliver the request; optional details can be omitted.

The purpose is to answer your request and discuss employment, professional services or collaboration. Where the request concerns a potential contract with you, the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b)). Other professional correspondence is handled on the basis of the legitimate interest in responding to enquiries (Article 6(1)(f)). There is no newsletter signup or marketing subscription.

Messages are sent to info@carlodesantis.com through Aruba S.p.A.’s email service. The site does not maintain a separate contact database. Correspondence that does not lead to an engagement is retained for up to 12 months after the conversation closes. If an engagement follows, relevant information may be retained for contract administration, legal obligations or the establishment, exercise or defence of legal claims, for the applicable periods. Avoid including sensitive information that is unnecessary for your proposal.

4. Cookies and storage on your device

The portfolio does not install advertising or audience analytics trackers. It uses localStorage for the functional preferences you choose: appearance, wallpaper selection, dock, window layout and accessibility options (portfolio-os-desktop, portfolio-os-dock, portfolio-os-windows and portfolio-os-settings). These remain in your browser until reset or deleted. Language and navigation state may also be held in memory during the visit.

If you select a personal wallpaper, it is resized and compressed on your device and saved in IndexedDB (portfolio-os-personalization). The wallpaper feature does not upload the image to Carlo or to a server. You can remove it in Appearance settings or clear the site’s browser data. These storage functions provide the customisation you request; they are not used to identify you across websites.

5. Optional Spotify content

Spotify is an optional external service. Its player is blocked until you select “Enable Spotify”. Enabling it allows a connection to Spotify, which receives technical data such as your IP address and browser information and may use cookies or other identifiers under its own policy. The legal basis for activating this optional content is your consent (Article 6(1)(a) GDPR and applicable rules on device storage).

Your choice applies to this visit only and is not saved across reloads. You can withdraw it using “Disable Spotify” in the widget or the privacy controls in Settings; this removes the players and prevents further embedded connections. It does not delete data or cookies already held by Spotify; use your browser settings or Spotify’s controls for those. Refusing the player does not prevent use of the portfolio, and you can instead open Spotify directly through the external link.

Spotify acts under its own privacy policy and may process data outside the EEA using the safeguards described there. Review https://www.spotify.com/legal/privacy-policy/ and https://www.spotify.com/legal/cookies-policy/ before enabling the player.

6. Recipients and external links

Data is accessible to Carlo and, as necessary for their services, authorised hosting and email providers and technical support personnel. Data may also be disclosed to competent authorities where required by law. The website is hosted in Germany; email is handled through Aruba. Carlo does not sell visitor data or send contact messages to generative AI services.

Links to clients, social networks, music platforms and other websites take you to independent services governed by their own notices. A normal external link does not embed their content in the portfolio. The site does not use automated decision-making or profiling to make decisions about visitors.

7. Your rights

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing before withdrawal. Write to info@carlodesantis.com; reasonable verification of your identity may be needed.

You may lodge a complaint with the Garante per la protezione dei dati personali (https://www.garanteprivacy.it/) or the competent supervisory authority in your country of habitual residence, place of work or place of the alleged infringement.

8. Updates

This notice will be updated if the website’s services or processing change. The revision date is shown below.