Privacy Policy - Teresa Graziano

Introduction

This Privacy Policy explains how teresagraziano.com (“Website”) collects, uses, and protects personal data of its users, in compliance with the EU General Data Protection Regulation (GDPR) and applicable international privacy laws. We are committed to processing personal information lawfully, fairly, and transparently, regardless of your location. This policy applies to all users of our Website and services, and provides information on what data we collect, why we collect it, how we use it, and the rights you have over your data.

Data Controller and Contact Information

The Data Controller (the person or entity responsible for your personal data) for this Website is Teresa Graziano. You can contact the Data Controller at privacy@teresagraziano.com for any questions or requests regarding your personal data. In accordance with GDPR requirements, we clearly state the name and contact details of the Data Controller in this Privacy Policy. Teresa Graziano is responsible for deciding how and why your personal data is processed. (At this time, no Data Protection Officer is required or appointed, and no EU representative is required, given that Teresa Graziano is based in the EU.)

Personal Data We Collect

We collect personal data that you voluntarily provide through our contact form, as well as some data automatically through your use of the Website:

Contact Form Data: When you fill out the contact form on our site, we collect your name, surname, email address, and the contents of your message. This information is necessary for us to address and respond to your inquiry. Providing this data is optional, but without it we cannot respond to your questions or requests. There is no statutory or contractual requirement to provide this data; however, if you choose not to provide the required fields (such as your email), we will be unable to contact you back. We ask that you only share personal data that is necessary for your request and do not include sensitive personal information in the message.
Usage Data (Analytics and Cookies): When you visit our Website, we use cookies and similar tracking technologies (explained in our Cookie Policy) to collect certain data automatically. This may include your device’s IP address, browser type, operating system, referring URLs, pages viewed, and the dates/times of page visits, as well as interaction information (such as clicks). In particular, we use Google Analytics, which tracks user behavior on our site in ways that may qualify as personal data (such as IP address and unique IDs)[3]. This usage data helps us analyze how our Website is used and improve its functionality and content. We have configured Google Analytics to anonymize IP addresses (masking a portion of the IP) to enhance your privacy. Please see our Cookie Policy for more details on what cookies are used and how they work.

We do not collect any sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health information, etc.) and we do not intentionally collect data from minors (children under 16) as our Website is not targeted at children. If you are under 16, please obtain parental consent before providing any personal data. We do not knowingly use the contact form to collect personal data from children, and if we become aware of having received such information, we will delete it.

Purposes and Legal Bases for Processing

We only process your personal data for specific, explicit purposes, and we ensure that there is a valid legal basis under GDPR for each purpose. The ways we use personal data and the corresponding legal grounds are:

Responding to Inquiries: The primary purpose for collecting your name, email, and message via the contact form is to allow us to respond to and manage your inquiries or requests. We will use your data to communicate with you, provide information you asked for, or take steps you request prior to possibly entering into a contract (for example, providing a quote for services). The legal basis for this processing is your consent – by submitting your information through the contact form, you consent to us using it for this purpose[2]. We obtain your explicit consent by requiring you to positively agree (e.g., by clicking a “Submit” button accompanied by a privacy notice) before your form is submitted. You have the right to withdraw your consent at any time (see “Your Rights” below), but note that processing done before withdrawal will remain lawful. In certain cases, responding to your inquiry may also be considered pre-contractual steps (if you are inquiring about our services), which is another lawful basis under GDPR Article 6(1)(b). We will clarify if any further processing is based on a different legal basis.
Website Analytics: We use Google Analytics to collect aggregated usage data about how visitors use our site, in order to understand traffic patterns, popular pages, and other metrics that help us improve the Website’s user experience and performance. The legal basis for processing analytics data is your consent as well. Because Google Analytics cookies are not strictly necessary, we will only activate Google Analytics if you give consent via our cookie consent banner or preferences (see Cookie Policy). Google’s terms require us to disclose this use of Analytics and how it processes data.If you do not consent to analytics cookies, either by rejecting them or not opting in, we will honor that choice and no analytics data about your visit will be collected. (In jurisdictions where legitimate interest could be considered for simple analytics, we have opted to rely on consent to ensure compliance with ePrivacy directives and GDPR.) You can also opt-out of Google Analytics as described in the Cookie Policy. The analytics data we collect is used purely for statistical purposes (e.g., counting visitors, seeing which pages are most viewed) and not to identify you as an individual. We have configured Google Analytics in a privacy-compliant manner (IP anonymization and no use of User-ID or other tracking across sites).
Site Maintenance and Security (Server Logs): Additionally, our web hosting provider may process technical data (like IP addresses in server logs) to maintain server security and prevent fraud or abuse. This processing is done under our legitimate interests in keeping our Website secure and functioning properly, and to comply with any legal obligations to ensure security. These logs are generally used only for troubleshooting and security monitoring and are not actively combined with other data to profile individual visitors.

We will not use your personal data for any purpose incompatible with the above without obtaining additional consent from you or unless otherwise permitted or required by law. We do not use your data for marketing or newsletters unless you have explicitly requested or consented to such communication. We do not engage in automated decision-making or profiling with your personal data.

Cookies and Tracking Technologies

As noted, our Website uses cookies and similar technologies to enhance user experience and analyze usage. Cookies are small text files placed on your device when you visit a website, which may store or retrieve information on your browser. For detailed information on the cookies we use, their purposes, and how to manage them, please see our Cookie Policy (documented separately). In brief, we use cookies to remember your preferences and to enable Google Analytics as described above. When you first visit the site, you will see a cookie consent banner seeking your permission to use non-essential cookies (like analytics cookies). You are free to accept or decline. Essential cookies (if any, such as a cookie to remember your consent choice) do not require consent and are used only as needed for the site to function. Any personal data obtained from cookies (such as an IP address or unique ID) is processed in accordance with this Privacy Policy and the GDPR. For more details or to change your preferences, refer to the Cookie Policy and the controls described there.

How We Share Your Personal Data

We value your privacy and do not sell or rent your personal information to third parties. We only share your data in the following circumstances:

Service Providers (Processors): We may share your personal data with third-party service providers whom we engage to host or support our Website and business operations. This includes our website hosting company and email service provider, and our analytics provider (Google Analytics, provided by Google LLC and/or Google Ireland Limited). These third parties process data only on our behalf and under our instructions, and they are bound by contractual terms (Data Processing Agreements) to protect your information and use it only for the agreed-upon purpose. For example, Google Analytics acts as a data processor processing usage data for analytics, and our web host may process IP addresses in server logs for security. We ensure that any data processors we use are reputable and comply with GDPR standards. (If requested, we can provide a list of our current data processors).
International Transfers: Some of our service providers are based in other countries. In particular, data collected via Google Analytics may be transferred to and processed on servers located in the United States or other countries outside the European Economic Area (EEA). We are aware that such international transfers must comply with GDPR. Whenever we transfer personal data out of the EEA, we take steps to ensure an adequate level of protection for your data. These measures may include using the European Commission’s Standard Contractual Clauses (SCCs) as contractual safeguards for data transfers[8], and/or ensuring the recipient is certified under an approved framework (for instance, Google has committed to the EU-US Data Privacy Framework as of 2023). In any case, we will ensure that your rights and protections travel with your data. You can contact us for more information on the safeguards in place for international transfers. We also note that the nature of Google Analytics data is mostly aggregated and pseudonymized; additionally, IP anonymization is enabled to reduce the personal identifiability of the data. If you are located outside of the EU, your data will be processed according to this Privacy Policy and, in many cases, in the EU first before any transfer occurs. We will always handle your information securely and in accordance with this policy, regardless of location.
Legal Obligations: We may disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). For example, if we are under a legal obligation to retain or share data for law enforcement or regulatory purposes, we will comply as necessary. We will attempt to notify you of such disclosure, unless prohibited by law.
Business Transfers: (Currently not applicable, as Teresa Graziano’s website is personal/professional and not part of a business entity transfer. However, if in the future the ownership of the Website or business changes, user data might be transferred to the new owner under continuity of service, in accordance with applicable data protection laws. In such case, users would be informed of the change.)

Aside from the above, we do not share your personal data with any third parties. In particular, we do not give your contact information to third parties for their own marketing or advertising purposes, and we do not display third-party ads that would entail sharing your data. Any third-party content or plug-ins on our site (such as social media sharing buttons or embedded content) will be clearly indicated, and those third parties may collect data directly subject to their own privacy policies (we advise you to review those if you choose to interact with such features).

Data Retention

We will retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law, in accordance with GDPR’s storage limitation principle. This means:

Contact Form Data: If you contact us via the Website, we will retain the correspondence and the personal data you provided for as long as it is needed to respond to and resolve your inquiry, and for a reasonable period thereafter in case further follow-up is needed. Typically, we would not keep personal information from inquiries longer than necessary to fulfill your request plus an additional [12-24] months for administrative purposes. For example, we may archive a query and our response for up to 1–2 years in case you contact us again or in order to have context about our communications. This 24-month maximum retention (absent further interaction) is in line with common recommendations. After that period of inactivity, we will delete your contact data and communications. If our correspondence leads to a contractual relationship or provision of services, we may retain relevant data for longer as part of our business records (subject to applicable legal retention requirements for contracts, transactions, or accounting).
Analytics Data: Data collected via Google Analytics is retained in Google’s systems for a duration determined by our settings. We have set Google Analytics’ user-level and event-level data retention to a reasonable period (e.g., 14 months) after which data is automatically deleted from Analytics’ records. Aggregate reports may be kept longer, but they do not contain personally identifiable data. We do not individually identify users via analytics data, and in any case, you can clear your cookies or use opt-out mechanisms to prevent new data collection. Any Analytics data that becomes part of our internal reports will typically be in aggregated form (e.g., total visitors per month) and kept indefinitely for trend analysis, but without personal identifiers.
Server logs and Security Data: Server logs containing IP addresses and visit timestamps are generally rotated or deleted within a short period (usually within a few weeks to a few months) unless retained longer to investigate security incidents. We will not keep these technical logs longer than necessary for security monitoring and legal compliance.
Legal Obligations and Backups: In certain cases, we may need to retain data for a longer period if required by law. For example, if a legal issue arises (such as a dispute or an enforcement request), we might need to preserve relevant information until it is resolved. Additionally, our automated backups or archives might retain fragments of data for a longer duration; however, we ensure that such data is isolated and protected, and we will not actively process personal data from backups except if needed for disaster recovery or legal purposes. Once the retention period expires, or upon valid request for erasure, we either securely delete the personal data or anonymize it so it can no longer be associated with you.

We periodically review the data we hold and erase or anonymize personal data that is no longer needed. No personal data will be kept longer than necessary for the purposes described in this Policy, unless a longer retention is required by applicable law.

Data Security

We take the security of your personal information seriously. We have implemented appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include using secure servers, encryption protocols for data in transit (e.g., HTTPS on our website), and access controls so that personal data is only accessible by the Data Controller or authorized personnel/contractors who need it to perform their duties. We treat all personal data as confidential and restrict access to it on a need-to-know basis. We also ensure that any third-party processors we use are contractually obligated to take adequate security measures.

However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will follow applicable breach notification laws (such as GDPR Article 33 and 34) and inform you and the relevant supervisory authority when required. We continuously review and update our security practices to adapt to new threats and to ensure the ongoing confidentiality, integrity, and availability of your data. By using our Website, you acknowledge these risks and agree that we cannot be held responsible for unauthorized access that is beyond our control.

Your Rights

As an individual (data subject) whose personal data is processed by us, you have certain rights under the GDPR and other privacy laws. We respect and uphold these rights, which include:

Right to Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to obtain a copy of the data we hold about you, as well as information about how we use it. This is commonly known as a Subject Access Request. We will provide the first copy of your data free of charge and in a structured, commonly used format.
Right to Rectification: If any of your personal data that we have is inaccurate or incomplete, you have the right to have it corrected or updated. Upon your request, we will rectify any incorrect information about you as soon as possible. For example, if your name or email address has changed or has a typo, you can ask us to fix it.
Right to Erasure: You have the right to request that we delete your personal data, in certain circumstances. This “right to be forgotten” applies, for instance, if your data is no longer necessary for the purposes we collected it, or if you withdraw consent and we have no other legal basis to continue processing, or if you object to processing and we have no overriding legitimate grounds. We will honor valid requests for erasure and also instruct any processors to do the same, provided there is no legal obligation for us to retain the data. Please note that if you request deletion of your contact form data, we will be unable to continue any ongoing communications with you.
Right to Restrict Processing: You have the right to ask us to restrict or pause the processing of your personal data in certain cases. For example, if you contest the accuracy of the data or have objected to processing (see below), you can request a restriction while we address your concern. During restriction, we will store your data securely and only process it with your consent or for legal reasons.
Right to Object: You have the right to object to our processing of your personal data when such processing is based on our legitimate interests (or those of a third party) or when done for direct marketing. In this case, you should explain the grounds of your objection relating to your particular situation. We will stop processing the data unless we have compelling legitimate grounds that override your interests or if needed for legal claims. (Note: For Google Analytics, which we only run with your consent, you can simply decline or revoke consent to effectively object to that processing.) If we were to send you any marketing (which we currently do not without consent), you could object at any time and we would cease.
Right to Data Portability: For data you provided to us and which we process by automated means based on your consent or a contract, you have the right to obtain that data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible. For example, if you request, we can provide a copy of the contact information you gave us in a CSV or similar format.
Right to Withdraw Consent: Where we rely on your consent to process your personal data (such as for contacting you after a form submission or for analytics cookies), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that occurred before you withdrew consent, but it means we will stop the specific processing going forward. For instance, you can withdraw your consent to analytics by adjusting your cookie settings or contacting us, and you can withdraw consent for us to use your contact data by letting us know (after which we will delete or anonymize your data unless we have another basis to retain it).
Right to Lodge a Complaint: If you believe we have infringed your data protection rights or GDPR obligations, you have the right to file a complaint with a supervisory authority in the EU. Teresa Graziano is based in Italy, so our lead supervisory authority is the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority). You can find their contact details on their official website. If you reside in another country, you may contact your local data protection authority. We would appreciate the chance to address your concerns directly before you approach a regulator, so we invite you to contact us first with any complaint and we will do our best to resolve it.

These rights can be exercised by contacting us at privacy@teresagraziano.com. We will respond to requests within one month, as required by GDPR, and will inform you if an extension is needed. Please note that some rights are subject to certain exemptions or conditions under the law. For example, we might not delete information we are required by law to keep, or we might decline a request if it adversely affects the rights and freedoms of others. We will explain our reasoning in any case where we cannot fully comply with your request. Rest assured, you will not be discriminated against or denied service for exercising your privacy rights.

International Users

This Privacy Policy is intended to cover our data processing activities globally. Our services are available to users around the world, and we strive to provide equal privacy protections to all users. If you are located outside of the European Union, your personal data will still be handled in accordance with the principles outlined in this Policy. That means we apply the same standards of transparency, security, and user control irrespective of your country. However, you should be aware that by using the Website, your information may be transferred to and processed in the EU and other jurisdictions as explained above. Some of these locations might have different data protection laws than your home country. In all cases, we will protect your data as described herein. If local laws grant you additional rights or require different handling, we will comply with those as applicable. For example, residents of certain U.S. states (like California) may have specific privacy rights; while our focus is on GDPR compliance, we also aim to honor those rights (such as not selling personal information and enabling deletion upon request). We encourage international users to contact us if they have any questions about how their data is handled.

Updates to This Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make changes, we will post the updated Policy on this page with a new “Last Updated” date. If the changes are significant, we may also notify you by additional means (such as by email if we have your contact information, or by a notice on the website). We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Last Updated: (03/08/2025).

If we ever plan to process your personal data for a new purpose not originally disclosed (and not obviously compatible with the original purpose), we will notify you and obtain any necessary consent before doing so. We will not apply any material changes to the Privacy Policy retroactively without your consent unless required by law.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us:

Data Controller: Teresa Graziano
Email: privacy@teresagraziano.com

We will be happy to assist you and address any issues. Your privacy is important to us, and we aim to respond promptly to any communication.

By using our Website, you acknowledge that you have read and understood this Privacy Policy. Thank you for trusting teresagraziano.com with your information.