Privacy Policy
What data this site collects, why, where it goes and how long it is kept. Described from how the site actually works, not from a template.
In short
This site collects personal data in one case only: when you fill in one of the two forms to contact me. In addition, and only if you accept it on the banner, it measures visits with Google Analytics to understand which pages are useful: aggregate statistics, no profiling, no advertising. If you prefer to write to me on WhatsApp, the data you send me is processed as described in the “Contact via WhatsApp” section.
The rest of this document explains exactly what happens in that case: which fields, where they go, who sees them and for how long.
Who processes the data
- Data controller
- Manuele Donvito
- Tax code (codice fiscale)
- DNVMNL02M20H355Z
- info@dsprogram.it
What data I collect
Only what you write. The site does not obtain data from other sources, does not buy it and does not infer it from browsing.
- Contact form
- Name and email (required), company and project type (optional), message text (required).
- Guided form
- Five multiple-choice answers about area, starting point, goal, approximate budget range and timing; then name and email (required), company and phone number (optional) and the project description (required).
- IP address
- You don’t type it: it arrives with the request, as on any website. It is used for one thing only: counting how many times the same address submits a form, and stopping automated submissions. It does not end up in the email and is not associated with what you wrote.
- Visit statistics (only if you consent)
- Pages viewed, where the visit came from, device and browser type, approximate geographic area, and a few actions on the site recorded as labels: opening a project, the area chosen in the skills section, clicks on WhatsApp or email, progress through the guided form. No text written by you goes into these measurements: there is no field it could go into.
The free-text field is the only one where you can write anything at all. I ask you not to include special category data (health, opinions) or data relating to criminal convictions and offences in it, because processing that data would require different conditions from those of a quote request.
Why I process it
- Replying to your request
- This is the only purpose. I read what you wrote, I reply and, if the project moves forward, I discuss it. Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR): you are the one who writes to me first.
- Understanding how the site is used
- Which pages are read, where visits come from, where people stop. It helps decide what to write and what to fix, not to recognize anyone. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from “Cookie preferences” without the site working any differently.
- Protecting against abuse
- Counting submissions per IP address and the hidden anti-bot field are there to prevent the forms from being used by automated programs. Legal basis: the legitimate interest in keeping the site working (Art. 6(1)(f) GDPR).
There is no marketing, no newsletter, no advertising profiling. Your address is not added to any list and you will not receive any communication other than the reply to what you wrote. Statistics are not used to build profiles and are not cross-referenced with form data: they are aggregate numbers about how the site is read.
How it is processed
It is worth describing in full, because it is simpler than you might expect and it explains all the answers that follow.
- When you press send, the fields are checked, turned into a text message and delivered to an email inbox.
- There is no database. The site has none, and it does not save what you write to files.
- After delivery, the content of the message does not remain on the server.
- Your IP address stays in the server’s memory as a count of recent submissions, without being linked to what you wrote and without being recorded in any archive.
- In the guided form, your answers are saved as a draft in your browser while you fill it in, so if you stop halfway you don’t have to start over. That draft stays on your device and is not sent until you press “Send request”.
Communication with the site takes place over an encrypted connection. The site does not load scripts, fonts or images from third-party servers: everything your browser downloads comes from the site itself.
Contact via WhatsApp
You can also contact me on WhatsApp, at +39 378 399 6079. The button at the bottom right and the links in the FAQ, in the Contact section and in the footer are plain links: they open WhatsApp with a pre-written message that you can edit or choose not to send. The site does not transmit any data about you to WhatsApp, and the conversation starts only if you decide to send the message.
- What data
- The data you choose to give me when you write: your phone number, your name, the content of the messages and any attachments.
- Why I process it
- To reply to your request and, if a relationship develops, to handle the negotiations and the professional relationship that follows. Legal basis: taking steps at your request prior to entering into a contract and, once an engagement is agreed, the performance of the contract (Art. 6(1)(b) GDPR).
- Who sees it
- Whoever runs the site, as with messages sent through the forms. It is not sold, transferred or exchanged.
- The role of WhatsApp
- WhatsApp is a third-party service that I do not operate. The processing carried out by its provider is also governed by WhatsApp’s privacy policy, which I invite you to read.
As with the free-text field in the forms, I ask you not to send me special category data (health, opinions), data relating to criminal convictions and offences, or documents containing them.
Who it is shared with
No one, for their own purposes. That leaves the technical providers without which the site could not work or reply.
- Google Analytics 4 (Google Ireland Limited)
- What it does
- Produces aggregate visit statistics for the site: pages viewed, traffic sources, device, approximate geographic area derived from the IP address. It does not receive names, email addresses, phone numbers or message content: the events sent by the site contain only labels chosen from a closed list, and numbers.
- Active today
- Yes
- Vercel
- What it does
- Hosts the site and serves its pages. It processes the technical traffic data needed to deliver a page, like any server.
- Active today
- Yes
- Resend
- What it does
- Delivers the content of the forms to the DS Program inbox. It therefore receives name, email, company, phone number and message text. The email address you provide is used as the reply address (Reply-To), so your request can be answered directly; the sender of the message remains DS Program.
- Active today
- Yes
- Rate-limiting service
- What it does
- Counts how many submissions arrive from the same IP address, to stop abuse.
- Active today
- No: Only if configured. Today the count is kept in the server’s memory, without leaving it.
The only statistics service is the one listed above, and it works only if you accept it. No advertising network, no social network, no other third party: they are not switched off, they simply aren’t there.
| Provider | What it does | Active today |
|---|---|---|
| Google Analytics 4 (Google Ireland Limited) | Produces aggregate visit statistics for the site: pages viewed, traffic sources, device, approximate geographic area derived from the IP address. It does not receive names, email addresses, phone numbers or message content: the events sent by the site contain only labels chosen from a closed list, and numbers. | Yes |
| Vercel | Hosts the site and serves its pages. It processes the technical traffic data needed to deliver a page, like any server. | Yes |
| Resend | Delivers the content of the forms to the DS Program inbox. It therefore receives name, email, company, phone number and message text. The email address you provide is used as the reply address (Reply-To), so your request can be answered directly; the sender of the message remains DS Program. | Yes |
| Rate-limiting service | Counts how many submissions arrive from the same IP address, to stop abuse. | No: Only if configured. Today the count is kept in the server’s memory, without leaving it. |
The only statistics service is the one listed above, and it works only if you accept it. No advertising network, no social network, no other third party: they are not switched off, they simply aren’t there.
The data may be accessed by whoever runs the site and reads the email inbox. It is not sold, transferred or exchanged.
Transfers outside the European Union
The infrastructure that hosts the site is distributed across several continents, so the technical processing needed to deliver a page to you may also take place on servers located outside the European Union, on the basis of the safeguards provided for in Chapter V of the GDPR and adopted by the provider.
The content of the forms, on the other hand, travels only to the destination email inbox.
Statistics, when you accept them, are collected by Google Ireland Limited, which is established in the European Union. Google may also process the data on servers located outside the EU on the basis of the safeguards stated in its own privacy policy, to which I refer you for details.
How long
- On the server
- None. The content of the forms is not saved to any database or written to files: it is turned into an email and delivered to the inbox.
- In your browser
- Up to 14 days without returning to the guided form page; each return restarts the count. It is deleted immediately after a successful submission, and you can remove it at any time by clearing the site data in your browser.
- In the email inbox
- The message stays in the inbox that receives it, like any email. A maximum retention period has not been set yet: you can ask for it to be deleted at any time and it will be.
- In the statistics
- The two Google Analytics cookies last thirteen months from the last visit; the choice you make on the banner stays in your browser for the same period, after which you are asked again. How long Google keeps the data collected depends on the settings of the measurement property and on Google’s privacy policy.
- On WhatsApp
- The conversation stays in the chat, like any WhatsApp message. A maximum retention period has not been set yet: you can ask me at any time to delete the messages and attachments you sent me. The processing carried out by WhatsApp as the service provider is governed by its privacy policy.
Your rights
Regarding the data you sent me, you can exercise the rights provided for in Articles 15 to 22 of the GDPR:
- to know whether I process your data and obtain a copy of it (access);
- to have it corrected if it is wrong or incomplete (rectification);
- to have it deleted (erasure);
- to ask me to restrict its use (restriction);
- to receive it in a machine-readable format (portability);
- to object to processing based on legitimate interest (objection).
To exercise them, just write to info@dsprogram.it. No forms are needed and there is nothing to pay. If you believe your data is being processed improperly, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, garanteprivacy.it).
The draft saved by the guided form is on your device, so you can delete it yourself at any time by clearing the site data from your browser settings.
Changes to this policy
If the way the site processes data changes, this page is updated and the date at the bottom changes. Changes affecting purposes or recipients will be stated explicitly, not just with a new date.
Latest change: added visit statistics with Google Analytics, active only after your consent, with sections on what data is measured, how long it is kept and how to withdraw your choice.