Privacy notice
How I process the personal data of people who visit this site and people who write to me. Drafted under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Who processes your data
The data controller is Riccardo De Pandis — Officina De Pandis, an atelier of fine cabinetmaking with its operating base in the province of Lecce, Italy, hereafter "the Controller" or "the atelier".
For anything concerning your personal data — including the requests described in section 8 — the reference channel is certified electronic mail (PEC), the Italian legally-recognised email system:
riccardo.depandis@pec.it
The designation of a Data Protection Officer (DPO) is not mandatory: the activity does not fall within the cases of Article 37(1) GDPR, as assessed against the criteria set out in the Article 29 Working Party guidelines (WP 243 rev.01).
2. What data I collect
2.1 If you simply read the site
Even without your consent, the technical operation of the site involves processing some data, strictly necessary to serve the page and protect it from abuse:
- a session identifier, generated at random and kept in your browser's memory (
sessionStorage) until the tab is closed; - your IP address and user agent, in pseudonymised fingerprint form, derived through a one-way salted hash function with a daily-rotated secret key, used solely to rate-limit requests and prevent abuse. The plain IP address is not retained in persistent form. This is a technical processing not subject to consent under Article 122 of the Italian Data Protection Code (Legislative Decree 196/2003), implementing the ePrivacy Directive;
- the standard technical logs generated by the infrastructure serving the site.
No profiling cookies are set on these pages. The pages under Resources load no measurement script at all.
2.2 If you consent to measurement
Only once you have agreed via the on-site notice do I collect:
- navigation events: pages and sections viewed, scroll depth, clicks on calls to action, progress through the questionnaire, technical errors, page performance indicators;
- a device fingerprint (rendering and font characteristics, reduced to a synthetic value), used to recognise repeat visits without double-counting them;
- attribution data: campaign parameters (UTM), any advertising click identifiers present in the URL, landing page and referring site;
- where your browser supports it and you have allowed it, the topics of interest exposed by the Privacy Sandbox API.
You can withdraw consent at any time from the Privacy preferences link at the bottom of the homepage. Withdrawal does not affect the lawfulness of processing carried out before it.
2.3 If you fill in the questionnaire
If you choose to open a private consultation, I process the data you enter: full name, email address, optional phone number, preferred contact channel, city, plus whatever you choose to tell me about the collection and the piece you have in mind (collection size, provenance, intended setting, material and guardianship preferences, and optionally the person the piece is meant for).
3. Why I process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Serving the site, keeping it secure, preventing automated submissions | Controller's legitimate interest in a functioning, protected service (Art. 6(1)(f)) |
| Responding to your request for a consultation and managing any resulting relationship | Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) |
| Measuring how the site is read and improving its content | Your consent (Art. 6(1)(a)) |
| Keeping a record of consent choices expressed | Compliance with a legal obligation (Art. 6(1)(c)), read in conjunction with Art. 7(1) GDPR (demonstrability of consent) |
| Defending a legal claim, where necessary | Controller's legitimate interest in the establishment, exercise or defence of legal claims (Art. 6(1)(f)) |
The purposes of advertising, direct marketing, personalisation and session recording are provided for in the site's architecture but are not active: the consent collected via the notice covers measurement only. Should I activate them in the future, you will be asked for a new, specific consent.
4. Who your data is shared with
Your data is not sold or passed on to third parties for their own purposes. It is processed, on the Controller's behalf and under its instructions, by providers appointed as data processors under Article 28 GDPR, under a written data-processing agreement containing the minimum terms set out in Article 28(3), belonging to the following categories:
- infrastructure and security: the provider hosting the site, the database, document storage and anti-bot protection;
- measurement: the statistical analytics platform, configured on European infrastructure (active only with your consent);
- email: the service that delivers my reply to your message;
- contact management: the tool in which I keep and follow up on consultation requests received;
- assisted processing: automated text-analysis tools, used to organise and summarise the requests I receive.
5. Transfers outside the European Union
The databases and document storage are hosted on infrastructure located within the EU. Some data processors are based in, or operate processing centres outside, the European Economic Area — in particular in the United States. In such cases transfers rely on European Commission adequacy decisions (Art. 45 GDPR, including the EU–US Data Privacy Framework where applicable) or on the Commission's Standard Contractual Clauses (Decision 2021/914, Art. 46 GDPR), supported by a transfer impact assessment (TIA) and by the supplementary measures described in this notice: encryption of identifying data at rest and in transit, and pseudonymisation of technical identifiers.
6. How long I keep it
- Measurement data and proof of consent: 36 months from collection, then automatic deletion.
- Consultation requests: for as long as needed to assess them and, if a relationship is established, for its duration plus the subsequent statutory tax and litigation-defence periods.
- Session identifier: until the browser tab is closed.
- IP and user-agent fingerprints: for the reference day only — the derivation key rotates daily, making the fingerprint no longer re-associable. In accordance with the storage-limitation principle of Art. 5(1)(e) GDPR.
7. Automated decisions
Requests received are assigned an automatically calculated score, reflecting how the page was browsed, and the text of a request may be summarised by automated processing tools. These are internal prioritisation aids: they produce no legal effects concerning you, nor similarly significant effects.
No decision affecting you is made by an automated system. Every request is read personally by Riccardo De Pandis, and the choice to accept a commission or not is always, exclusively, human. No automated decision-making within the meaning of Article 22(1) GDPR therefore takes place.
8. Your rights
At any time you can ask me to: give you access to your data and a copy of it; rectify it if inaccurate; erase it; restrict its processing; receive it in a structured format and transfer it to another controller (portability); object to processing based on legitimate interest; withdraw consent given, without affecting the lawfulness of prior processing.
To exercise these rights, write to riccardo.depandis@pec.it, indicating which right you wish to exercise. Where reasonable, you may be asked for identity verification proportionate to the request (Art. 12(6) GDPR). I will reply within one month of receipt (Art. 12(3)); if the request is particularly complex this may be extended by two months, and I will let you know if so.
If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or with the supervisory authority of the country where you live.
9. Changes to this notice
Every version of this notice is identified by a version number, shown above. If the version changes, any consent given for the previous version is not carried over: the notice will be shown to you again, so you can decide on the basis of the updated text.