Privacy Policy

Notice under Article 13 of Regulation (EU) 2016/679. Last updated: 14 September 2026. This notice applies to oltreiltratto.com and www.oltreiltratto.com.

Data controller and contact details

Valentina Craboledda — Oltre il Tratto, Cagliari, Sardinia, VAT no. 04242640920. For information or to exercise your rights: contatto@oltreiltratto.com.

Browsing data

Browsing involves processing your IP address, request headers, browser information, date and time, and technical logs. These are used to make pages available, prevent abuse and resolve problems. The legal basis is the controller’s legitimate interest in the operation and security of the website (Article 6(1)(f) GDPR). These data are necessary for communication over the Internet.

Email enquiries

If you write to us, we process your email address, name and message content to respond to and manage your enquiry. For enquiries about a commission, the basis is taking pre-contractual steps at your request (Article 6(1)(b)); for other communications, our legitimate interest in responding (point (f)). Providing the data is optional, but we cannot reply without contact details. Please avoid sending unnecessary sensitive data.

The Contact form sends your name, email and message to the website’s server, which forwards them to the studio’s mailbox through Aruba. The data are processed to handle your enquiry on the legal bases described above. The content is not used for advertising or sent to analytics services. The email link instead opens the visitor’s email application.

Fonts hosted on the website

Fonts are served by the website itself, without browser requests to Google Fonts. No external services need to be activated to display the text.

Providers and transfers

Hosting is provided by AppDeploy (FreeBraavos LTD), which uses AWS infrastructure. The provider states that its primary region is in the United States and content is distributed globally; for applicable transfers, it states that it relies on standard contractual clauses or other valid instruments. Its DPA governs processing on behalf of the controller. Information and safeguards may be requested from the controller and are described in the provider’s privacy notice. The provider also processes technical data for its own security and service-management purposes.

Email communications are managed by the studio through the email services used to receive them. Data may be accessible to technical providers and authorised parties within the scope of their duties, or to authorities when required by law. Instagram and LinkedIn links open external websites: we do not embed their feeds or pixels. Those websites are subject to their respective operators’ privacy notices.

Retention

Email enquiries are retained to manage the conversation and any follow-up; when no longer needed, they are deleted unless documented needs to protect rights or legal obligations require otherwise. If a commission follows, documentation is kept for the periods applicable to the professional relationship. AppDeploy retains logs as needed for security, abuse prevention and reliability; it states that backups may remain for up to 30 days after deletion.

Your rights

Where provided for by the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. You may withdraw consent at any time. Write to the controller’s address: you will normally receive a response within one month, subject to the extensions provided by the Regulation. You may lodge a complaint with the Italian Data Protection Authority. The website does not carry out automated decision-making or advertising profiling.

For browser technologies, see the Cookie Policy. This notice will be updated when services or processing activities change.