1. Introduction
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") and describes how personal data are processed in relation to users who visit the website www.martinacaironi.it (the "Site"), persons who submit requests through the forms on the Site or to the Controller's email address, and the authors of the images published on the Site.
This notice applies to the Site only and does not extend to other websites that users may visit through links.
2. Data controller
The data controller is Martina Caironi (the "Controller"). For any communication concerning the processing of personal data, including the exercise of the rights set out in section 10, the Controller can be contacted at info@martinacaironi.it.
The Controller has not designated a data protection officer, as the conditions laid down in Article 37 GDPR do not apply.
3. Categories of data, purposes and legal bases of processing
3.1 Browsing data
In the course of their normal operation, the IT systems hosting the Site acquire certain personal data whose transmission is inherent in the use of Internet communication protocols. These include the IP address of the device, the date and time of the request, the address of the requested resource and its parameters, the address of the referring page, the server response code, and the browser and operating system used.
These data are processed to enable use of the Site, to ensure its security and to detect malfunctions or abuse, and are not used to identify users. The legal basis for the processing is the Controller's legitimate interest in the proper functioning and security of the Site (Art. 6(1)(f) GDPR).
3.2 Statistical data
The Site uses the Vercel Web Analytics service to measure, in aggregate form, the number of visits and the pages viewed. The service does not use cookies and does not store information on the user's device. It records the page visited, the date and time of the visit, the referring page, the approximate country and city of origin, the device type, the browser and the operating system. To distinguish visits, the service generates a code derived from the request data, which is deleted after 24 hours.
The Controller has access to aggregate data only, which do not allow individual users to be identified. The legal basis for the processing is the Controller's legitimate interest in understanding how the Site is used (Art. 6(1)(f) GDPR).
3.3 Data provided voluntarily by the data subject
Sending a message through one of the forms on the Site, namely the contact form published on the home page and on the "Contact" page and the form on the "Photo credits" page, or to the Controller's email address, entails the acquisition of the data entered by the sender: name and surname, email address, type of request, text of the message and, for requests concerning images, the addresses of the images concerned and the name to be shown in the credits.
These data are processed solely to respond to the request and to follow it up, including the assessment of invitations and partnership proposals, the addition or correction of credits, the removal of images from the Site and the assessment of images offered for publication.
The legal basis for the processing is the performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR) for invitations, partnership proposals and interview requests and, for other communications and for requests concerning images, the Controller's legitimate interest in responding and in publishing images with due regard for the rights of their authors (Art. 6(1)(f) GDPR). The checkbox in the forms confirms that this notice has been read and does not constitute consent.
Where credit is requested, the name indicated by the data subject is published on the Site alongside the relevant images and on the "Photo credits" page.
3.5 Images of the persons portrayed
The images published on the Site portray Martina Caironi and, in some cases, other persons, mostly during sporting competitions, ceremonies and public events. Publication is based on the Controller's legitimate interest in documenting her sporting and public activity (Art. 6(1)(f) GDPR), in compliance with Article 97 of Italian Law No. 633 of 22 April 1941. A person portrayed who does not wish their image to be published may request its removal by writing to info@martinacaironi.it and indicating the address of the image concerned.
3.6 Videos hosted on YouTube
Some galleries on the Site include videos published on the YouTube platform. Until the user starts playback, the Site displays only a preview image hosted on its own servers and establishes no connection with Google's servers.
When playback starts, the video player is loaded from the domain youtube-nocookie.com, operated by Google Ireland Limited, which receives the user's IP address and browsing data and may store cookies and other information on the device (for example in the browser's local storage) for the operation of the player and the measurement of views. Google Ireland Limited processes such data as an independent controller, as set out in its privacy policy.
5. Provision of data
The provision of browsing data is necessary to consult the Site. The provision of the data requested in the forms is optional; failure to provide the name, the email address and the content of the request makes it impossible to respond to it.
6. Methods of processing
Processing is carried out using IT and telematic tools, according to criteria strictly related to the purposes indicated and with security measures appropriate to prevent the loss of data, unlawful or incorrect use and unauthorised access. The Controller does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.
7. Recipients of the data
The data are processed by the Controller and by the persons who assist the Controller in managing the Site and correspondence, who are authorised to process the data and bound by confidentiality (Art. 29 GDPR). The data are also processed on the Controller's behalf, as processors under Article 28 GDPR, by the following providers:
- Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States, for hosting the Site and its media, handling the forms and measuring visits;
- Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States, provider of the Resend service, for delivering the messages sent through the forms by email;
- the provider of the email service hosting the Controller's mailbox.
Vercel Inc. also processes certain data relating to the use of its services as an independent controller, as set out in its privacy policy.
The data are not disseminated, except for the names of the authors of images referred to in sections 3.3 and 3.4, nor transferred to third parties for commercial or advertising purposes.
8. Transfer of data to third countries
Vercel Inc. and Plus Five Five, Inc. are based in the United States and also process data outside the European Economic Area. The transfer takes place on the basis of the adequacy decision adopted by the European Commission on 10 July 2023 concerning the EU-U.S. Data Privacy Framework, to which both companies have adhered (Art. 45 GDPR), and of the standard contractual clauses approved by the European Commission and included in their respective data processing agreements (Art. 46 GDPR).
9. Retention period
The data are kept for the following periods:
- browsing data: request logs are kept for one day;
- statistical data: aggregate data are kept for twelve months;
- data provided by the data subject: for the time needed to respond to and follow up the request and, thereafter, for no longer than twenty-four months from the last communication, unless further retention is necessary to establish, exercise or defend a legal claim; copies of messages held by the Resend service are kept for thirty days;
- authors' names: for as long as the relevant images are published on the Site.
Once these periods have elapsed, the data are deleted or anonymised.
10. Rights of the data subject
Data subjects may at any time exercise the rights set out in Articles 15 to 22 GDPR and, in particular, request from the Controller:
- access to their personal data and a copy of them (Art. 15);
- rectification of inaccurate data or completion of incomplete data (Art. 16);
- erasure of the data (Art. 17);
- restriction of processing (Art. 18);
- portability of the data provided, in a structured, commonly used and machine-readable format (Art. 20).
Data subjects also have the right to object at any time, on grounds relating to their particular situation, to processing based on the Controller's legitimate interest (Art. 21 GDPR).
Requests should be sent to info@martinacaironi.it. The Controller responds without undue delay and in any event within one month of receipt of the request, a period that may be extended in the cases provided for by Article 12 GDPR.
11. Right to lodge a complaint
Data subjects who consider that the processing of their personal data infringes the GDPR have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, in the manner indicated on the Authority's website, or with the supervisory authority of the EU Member State in which they habitually reside or work (Art. 77 GDPR), and to bring proceedings before the competent courts (Art. 79 GDPR).
12. Changes to this notice
The Controller may amend or update this notice, in particular following changes to the services used by the Site or to the applicable legislation. Any changes are published on this page, together with the date of the update.
Last updated: