Privacy Policy

1. Data Controller

The Data Controller is Gipi Visconti. You can write to info@gipivisconti.com with any request concerning personal data.

2. Data collected and children

The form is restricted to adults and collects the name and email address of the adult completing it, together with a birthday date that may relate to the adult or to a child for whom they are responsible. The person completing the form must confirm that they are at least 18 years old and, if they provide details about a child, that they are the child’s parent or legal guardian, or otherwise authorised to do so. Children must not submit data directly through the website and Gipi Visconti does not knowingly collect personal data submitted directly by them; direct submissions from a child will be erased when identified. Technical data, including the IP address and the outcome of the security check, is also processed temporarily to protect the service from abuse.

3. Purpose and legal basis

The data is used to manage the request, send the email in the selected language and provide the corresponding book download. If the dedicated box is selected, the name, email address and birthday date are retained in the newsletter profile on the basis of optional, separate and withdrawable consent. Declining does not prevent delivery of the book; anti-abuse checks serve the legitimate interest of protecting the website. The automated birthday gift service is not active and, before it is introduced, specific information and a separate choice will be provided.

4. How processing works

Cloudflare handles the request: Turnstile checks that the submission is not automated, while Workers, D1, Queues and protected assets process the request and provide the file. The email is sent from info@gipivisconti.com through Proton Mail’s SMTP service.

5. Retention

The name, email address, birthday date and newsletter choice are kept in encrypted form with the book request for no more than 30 days. Data held in the delivery queue is erased as soon as the delivery attempt ends. If newsletter consent is given, the encrypted profile and proof of consent are retained until consent is withdrawn. The book link expires after 72 hours and permits no more than five downloads.

6. Recipients and transfers

Cloudflare and Proton process the data required to provide their respective services under their own agreements and safeguards. Data submitted through the form is not sold or shared for advertising purposes.

7. Necessary technologies and preferences

Turnstile uses the technical information needed to distinguish a person from an automated submission; its token is necessary, remains valid for 300 seconds and can be used only once. Necessary technologies remain active because they support the operation and security of the website. For its visual presentation, the website loads Inter, Caveat, Cormorant Garamond and Outfit from Google Fonts; the technical request may communicate the IP address and browser information to Google, while no specific cookies or retention periods have been verified for this loading process. The gipi_cookie_consent record in localStorage is necessary to remember the preference for the optional analytics category.

8. Google Tag Manager and analytics tools

Google Tag Manager is used to manage the website’s optional analytics tag. Under the current basic consent setup, container GTM-M4HRN5J8 is not loaded until the analytics category is accepted; no cookies specific to the container have been verified. Before loading, Google Consent Mode v2 signals are set to denied and then updated in line with the choice made. Google Analytics 4, identified by G-PJ0LWY2294, must receive analytics consent before operating. By default, GA4 uses the _ga and _ga_PJ0LWY2294 cookies, which last for two years and may be renewed; the website’s effective configuration remains to be verified after activation with consent.

• Google Privacy Policy

9. Consent, retention of the choice and withdrawal

The analytics category is not preselected on the first visit and may be accepted or rejected. The necessary gipi_cookie_consent record is stored in localStorage with the version and language of the text, the date and time, and the choice made; it remains valid for no more than 390 days, the website code removes it when it expires and it is invalidated sooner if the notice version changes. It may also be erased through the browser settings. The Cookie settings link in the footer reopens the panel so that consent can be withdrawn at any time. Following withdrawal, the page is reloaded to stop analytics scripts; withdrawal does not affect the lawfulness of earlier processing.

10. Your rights

You may request access, rectification, erasure, restriction or objection where applicable by writing to info@gipivisconti.com. Newsletter consent may be withdrawn at any time through the same address or by using the unsubscribe link in every newsletter, without affecting the book request. You may also lodge a complaint with the competent supervisory authority.

11. Security and updates

Appropriate technical and organisational measures are used, including temporary encryption, expiring download links and anti-abuse limits. This notice may be updated if the service or the applicable law changes.