Privacy notice
Provided under Article 13 of Regulation (EU) 2016/679 — GDPR.
Last updated: 21 August 2026.
1. Controller
The controller is Ugo Bruno Gambardella, based in Potenza (PZ), Italy. To exercise your rights, or for any question about this notice, write to the email address given in the contact section of the site.
No data protection officer has been appointed, as the conditions set out in Article 37 of the Regulation are not met.
2. What data is processed
2.1 Data you provide through the contact form
Full name, company name, email address and the content of your message. Please do not enter special categories of data (Article 9 of the Regulation) or information covered by confidentiality or trade secrecy in the free-text field: a direct conversation is the appropriate channel for those matters.
2.2 Browsing data
This site consists of static pages and uses no analytics, profiling or tracking technology, and no third-party services. The typefaces are served from the site’s own domain, so displaying them involves no communication with any external server.
The hosting provider records server access logs for technical and security purposes, which may include the IP address, the date and time of the request and the browser type. This data is necessary to operate and protect the infrastructure and is retained for a limited period in accordance with the provider’s policies.
2.3 Browser local storage
The site stores a single entry in the browser’s local storage, named
ubg-theme, recording your preference between the light and dark
themes. It cannot identify you, is never transmitted to any server, and falls
within the technical storage exempt from consent under Article 122 of the
Italian Data Protection Code. You may remove it at any time by clearing the
site data in your browser settings.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to enquiries sent through the contact form or by email | Article 6(1)(b): steps taken at the request of the data subject prior to entering into a contract | 24 months from the last contact, where no engagement follows |
| Managing a professional engagement, where one is entered into | Article 6(1)(b) and (c): performance of the contract and compliance with legal obligations | 10 years from completion, for civil and tax law obligations |
| Infrastructure security and server logs | Article 6(1)(f): legitimate interest in protecting the systems | In accordance with the hosting provider’s policies |
The tick box in the form records that you have read this notice. Providing the fields marked as required is necessary in order to reply; without them the enquiry cannot be handled. No marketing is carried out and the data is never used to send commercial communications.
4. Recipients and transfers outside the European Union
Data is neither disclosed publicly nor sold to third parties. It may be processed, strictly as necessary, by technical service providers appointed as processors under Article 28 of the Regulation: the site’s hosting provider and the email service provider.
Contact form submissions are handled by Formspree Inc., established in the United States, acting as a processor. The resulting transfer to a third country takes place on the basis of the standard contractual clauses adopted by the European Commission and the further safeguards provided by the framework applicable to transfers to the United States. As an alternative to the form, you may always write directly to the email address given on the site.
5. Automated decision-making
No automated decision-making or profiling within the meaning of Article 22 of the Regulation takes place. No artificial intelligence system is involved in assessing enquiries received through this site.
6. Your rights
Articles 15 to 22 of the Regulation give you the right to obtain access to your personal data, to have it rectified or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests should be addressed to the controller at the email address given on the site and receive a reply within one month, extendable by a further two months where the request is particularly complex.
7. Complaint to a supervisory authority
If you consider that the processing of your data infringes the Regulation, you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, or with the supervisory authority of your habitual residence, or to bring proceedings before the competent court. Details are available at garanteprivacy.it.
8. Changes
This notice may be updated to reflect regulatory or organisational changes. The date of the most recent update appears at the top of this document.