IT

Legal document

Privacy Policy

Last updated:

Introduction

This notice explains the processing of personal data on michelangelosapunaru.com under Regulation (EU) 2016/679. The site is static, published through GitHub Pages, and uses Cloudflare services for DNS, form protection and related infrastructure. Any Cloudflare proxy, CDN or WAF use applies only while those features are active for the domain.

1. Data Controller

The Controller is Michelangelo Sapunaru, Rome, Italy. For personal-data matters, write to privacy@michelangelosapunaru.com.

2. Data processed

Browsing and security data

When you visit, GitHub Pages and the applicable Cloudflare services may receive technical data needed to deliver and protect the site, such as IP address, date and time, requested URL, HTTP headers, user agent, browser and device information, request outcome, and error or security-event data. GitHub may also process IP addresses and technical logs for security, abuse prevention and service integrity.

Contact form

When you submit the form, the site processes your name, email and message, together with date and time, only the pathname of the referring page, and the anti-bot result. Do not include passwords, documents, health data, credentials or confidential third-party information.

Cloudflare Turnstile

Turnstile processes technical signals needed to distinguish people from automated traffic. These may include IP address, browser, operating-system and device characteristics, user agent, network headers and parameters, the site and widget key, verification timing and interactions, token and result. The site receives the token and result, not a complete copy of the signals Cloudflare uses.

Booking a call

If you choose a booking link on cal.eu, Cal.com may process your name, email, time zone, availability, selected slot, submitted answers and appointment metadata. Necessary data is synchronized with Google Calendar and may be sent by email through Google. If you select a video feature, Cal Video may be used. The booking alias is used only in booking communications and flows.

Google Analytics 4

Google Analytics 4, ID G-YNJT7YJQE8, processes statistics, online identifiers, technical device data and visited-page information only after consent. It is not loaded and no Analytics request is made before consent. Google Signals, advertising features and ads personalization are disabled.

3. Purposes and legal bases

  • Article 6(1)(b) GDPR - responding to project requests, estimates, collaborations, interviews, bookings requested by the data subject, and pre-contractual steps.
  • Article 6(1)(f) GDPR - responding to general communications, preventing spam and abuse, protecting the site and form, maintaining security, and defending legal rights.
  • Article 6(1)(a) GDPR - Google Analytics 4 and other genuinely optional processing based on consent.

4. How forms and bookings are handled

The form sends data to a Cloudflare Worker, which verifies Turnstile and uses Cloudflare Email Service to deliver the message. The Worker uses no application storage and does not retain form content. The message reaches the Controller's Google mailbox.

Booking opens only when you choose a Cal.com link. On cal.eu, Cal.com may process your name, email, phone number if supplied, role or position, general information about a project or process, call preferences, booking date and time, time zone, and information entered in free-text fields. Necessary data may be synchronised with Google Calendar and sent by email through Google. Cal Video is involved only if you choose that service. booking@michelangelosapunaru.com is used only for booking communications and flows.

5. Providers and roles

Depending on the specific processing and applicable terms, a provider may act as a processor on the Controller's instructions or as an independent controller for its own activities. The applicable qualification depends on each service and is not extended beyond the agreements and the law.

6. International transfers

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the Data Privacy Framework for participating organizations, European Commission standard contractual clauses, or another safeguard under Articles 45 and 46 GDPR, with supplementary measures where appropriate. Current safeguard information is available in the provider notices and agreements linked above.

7. Retention

  • Spam and unnecessary requests: no more than 30 days.
  • General requests with no follow-up: 6 months.
  • Unsuccessful interviews and recruiter contacts: 6 months.
  • Cancelled bookings or no-shows: 6 months.
  • Project requests and estimates: 12 months from the last contact.
  • Completed collaborations: up to 24 months after closure, unless contractual or legal needs apply.
  • Privacy requests: minimum evidence of handling for up to 3 years.
  • Form application logs: no permanent content; technical errors for up to 7 days.
  • Detailed GA4 data: 2 months.

Contractual, tax, or rights-protection records may be retained longer where required by law.

8. Providing data

Necessary browsing data is processed automatically to make the site available and secure. Name, email and message are required to submit the form; without them, the request cannot be sent. Phone number and other Cal fields must be optional unless needed for a phone call. Do not include sensitive data or unnecessary data about other people. GA4 consent is optional, and refusal does not limit the site, form or booking.

9. Withdrawing Analytics consent

You can withdraw consent through the "Preferences" link in the footer. Withdrawal disables new sends, removes GA4 cookies from the device and reloads the page without loading Analytics. It does not affect the lawfulness of processing before withdrawal.

10. Automated decisions and profiling

No solely automated decision produces legal or similarly significant effects. No profiling takes place. Turnstile performs only a technical anti-bot check to protect the form.

11. Children

The site and professional services are not directed to children. If you believe a child submitted personal data, contact the Controller to request verification and deletion.

12. Your rights

You may request access, rectification, erasure, restriction, objection and, where applicable, data portability. You may withdraw consent at any time. Send requests to privacy@michelangelosapunaru.com. A response is provided within one month, subject to the GDPR extension for complex cases. You may also lodge a complaint with the Italian Data Protection Authority.

13. Updates

This notice may be updated when the site, services or law changes. The current version is dated 26 July 2026.

Book a call

Who are you?

Company / client Recruiter