This Privacy Notice provides key information about how we process your personal data when you submit information through our Website (e.g., via the contact form). It is a concise summary of our full Privacy Policy, highlighting the most relevant points at the moment of data collection. We encourage you to read the full Privacy Policy for more detailed information, but here we outline what you need to know in a clear and user-friendly way.

• Data Controller: The person responsible for your personal data is Teresa Graziano, the owner of teresagraziano.com. You can reach her at privacy@teresagraziano.com. This means Teresa Graziano determines the purposes and means of processing your data, and is your point of contact for any privacy-related queries.
• Personal Data Collected: When you use our contact form, we collect the following information: your name, surname, email address, and the content of your message (which may include other personal details you choose to provide). We limit our collection to what is necessary: typically just contact details and your inquiry. If you contact us through other means (like email), we will process whatever information you provide in that context similarly. We do not collect sensitive personal data via the contact form and kindly ask that you do not include such information in your message. Additionally, when you browse the Website, we may collect some technical data (like IP address, cookies and usage data) for analytics and functionality, but this is separate from the contact form data and is covered under our Cookie Policy and full Privacy Policy. Any usage of analytics cookies will only occur with your consent.
• Purpose of Collection: We collect and use the above data solely to respond to and manage your inquiry or request. In practical terms, this means we will use your name and email to reply to you with the information or assistance you requested, and we’ll reference the content of your message to address your questions or concerns. We will not use the personal information you submit through the contact form for any other purpose, such as marketing, without your explicit consent. For example, if you ask about our services, we’ll use your info to answer that query; we won’t add you to a mailing list unless you specifically request it. The purpose is transparent: to communicate with you because you contacted us first.
• Legal Basis: Under GDPR, we must have a legal basis to process your data. In this case, your consent is the legal basis for processing the contact form information. By clicking “Send” or a similar action on the contact form, you explicitly consent to us processing the provided personal data for the purpose of handling your inquiry. We log the fact that you gave this consent at the time of submission. You have the right to withdraw consent at any time (see “Your Rights” below), which will apply to future processing. In certain cases, if your inquiry is about entering into a contract or obtaining a service from us, the processing might also be considered as a step necessary for the performance of a contract or pre-contract (GDPR Art. 6(1)(b)). However, in general, we treat it as consent-based. If you ever withdraw your consent, we will cease using your data (and delete it unless we have another lawful reason to keep it).
• Data Use and Sharing: We use your data internally for the purposes stated. This means Teresa Graziano (and any team members or assistants, if any, who help manage inquiries) will access your information to draft a response or follow up on your request. We do not share or disclose your contact form data to third parties for their own uses. The only instances of “sharing” are the use of service providers that enable us to operate: for example, our website is hosted by a hosting provider, and messages sent through the contact form may be stored on that web server or sent to our email system. Similarly, your email might be processed by our email service provider when we reply. These providers act on our behalf as “data processors” and are not permitted to use your data for anything other than delivering our messages or hosting our Website. We ensure any such providers are GDPR-compliant and have appropriate safeguards. We do not sell or rent your personal information to anyone. We also do not use your information for marketing unless you specifically ask for, say, a newsletter or similar, which is not the case here. Rest assured, your contact details stay with us and are used only to communicate with you. In rare cases, if required by law or authorities (e.g., a lawful request by law enforcement), we might have to disclose data, but we will inform you unless prohibited. Internally, your data is accessible only to those who need it to respond (which, on a small personal site like this, is typically just Teresa Graziano). We maintain confidentiality and protect your data from any unauthorized access.
• Data Retention: We keep your personal data only as long as necessary to fulfill the purpose of communication. In practice, when you send a message, we will retain the correspondence and your contact details for a period in order to ensure we can continue assisting you or refer back to your inquiry if you contact us again. Our general policy is to not keep inquiry data longer than 24 months (2 years) after our last interaction. This allows us to have context if you reach out again within a reasonable time and to track any ongoing matters. If you become a client or engage in a professional relationship, we may retain correspondence as part of our business records for a longer duration (in accordance with legal obligations or business requirements). If 24 months pass with no further communication, we will delete your contact form data and emails. You can also request deletion sooner (see Your Rights below), and we will honor that (provided we are not required by some law to keep it). For analytics data (unrelated to the contact form), retention is separate and outlined in the Cookie Policy (typically much shorter, and often anonymized). But specifically for the data you submitted, know that we won’t keep it indefinitely. We securely erase digital data and shred any physical notes (if any) once they are no longer needed. Backup systems might hold data a bit longer, but are also purged regularly and are protected.
• Data Transfers: By default, we aim to store and process your contact data within the European Union. If you are contacting us from outside the EU, your data will still be handled under GDPR principles. We do not actively transfer your contact form data to third countries. However, our email server or hosting might be located in another EU country (which is fine under GDPR) or in some cases outside the EU (if, for example, we use an email service like Google Workspace, which might process in the US). If any data is transferred outside the EEA, we will ensure appropriate safeguards (like Standard Contractual Clauses) are in place to protect it. In summary, we treat your data with the same high level of protection wherever it is processed.
• Your Rights: You have several important rights regarding your personal data. Even in this short notice, we want you to know you are in control. You have the right to access the data we hold about you – you can ask us to confirm if we’re processing your data and request a copy of it. You have the right to rectification – if any information is incorrect or outdated, please inform us and we will fix it. You have the right to erasure – also known as the right to be forgotten – you can request that we delete the data you submitted, and we will do so if it’s no longer necessary for the purpose or if you withdraw consent. For example, if you no longer want us to have your contact info on file, just let us know and we will remove it. You have the right to withdraw consent at any time, which means if you no longer want us to process your inquiry data, contact us and we will stop and delete as appropriate. Note that if we are in the middle of helping you, withdrawing consent might mean we can no longer continue communication, but that’s your choice. You have the right to object to certain processing (though in our case we only process with consent, so this is less relevant unless we were, say, processing under legitimate interest) and the right to request restriction of processing. You have the right to data portability for information you provided to us – we can send you your data in a machine-readable format if needed. Lastly, you have the right to lodge a complaint with a supervisory authority (such as the GDPR regulator in your country, e.g., Italy’s Garante if you’re in Italy, or whichever EU country you reside in) if you believe we have handled your data improperly[18]. We would appreciate the chance to address your concerns directly, so please consider reaching out to us first, but the choice is yours. We will not retaliate or deny you service for exercising your rights. To exercise any of these rights, simply contact us at the email provided (privacy@teresagraziano.com). We will respond as promptly as possible, typically within 30 days.
• Data Security: We take appropriate measures to safeguard your personal data. Our website is encrypted with SSL (HTTPS) to ensure information you send via the contact form is transmitted securely. We have implemented technical measures (like firewalls, access controls, up-to-date security patches) and organizational measures (like limiting access to your data only to the controller) to prevent unauthorized access, loss, or disclosure of your information. However, no internet transmission is 100% secure, so we cannot guarantee absolute security; still, we make every effort to protect your data. If there were any breach affecting your personal data, we would inform you if required by law.
• Use of Cookies/Analytics: Separately from the contact form data, note that our site uses cookies for analytics and functionality. We mention this here so you’re aware that if you browse the site, certain usage data might be collected via cookies (like Google Analytics) – but this will only happen with your consent (through the cookie banner). Such data (e.g., pages visited, IP address) helps us improve the website and is not directly linked to your contact form submission. You can use the site without analytics cookies if you prefer (simply opt out via the banner). For more details, see our Cookie Policy. This is just to be transparent that, outside of what you actively send us in the form, there is passive data collection common to most websites. All of it is covered under our broader privacy practices.
• No Automated Decisions: We do not use your data for any automated decision-making or profiling. When you contact us, a real person (Teresa) reads your message and responds personally. You won’t be subject to decisions based solely on algorithms or automated systems.
• Contact & Further Information: If you have any questions or concerns about this Privacy Notice or our data practices, or if you wish to exercise your rights, please do not hesitate to contact us at privacy@teresagraziano.com. We are here to help and value your privacy. For more detailed information, please refer to our comprehensive Privacy Policy and Cookie Policy (links are provided on the website).

By submitting the contact form, you acknowledge that you have been informed about how your data will be used. Thank you for taking the time to read this Privacy Notice. We believe that being informed is essential to trust, and we want you to feel comfortable when providing your information. Our goal is to handle your data respectfully, securely, and only as you’d expect.

(Remember: This notice is a summary for convenience – for full details, please see the complete Privacy Policy on our site.)