Welcome to our online art journey. You can read our thoughts or you can simply write to us

FashionFine ArtFoodfotobookPhotography & GraphicsPortraitsstill life photography

Privacy Policy

Last updated: 8 November 2026

This notice explains how personal data of visitors to stefaniacola.com, and of anyone who contacts me through the website, are processed under Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.

1. Data controller

Stefania Cola – Stefania Cola Photographer
Via Senigallia 5, 60131 Ancona (AN), Italy
VAT no. IT02206590420
Email: stefania.cola@gmail.com

No Data Protection Officer (DPO) has been appointed, as it is not required for this activity.

2. What data I collect and why

Browsing data

The servers hosting this website automatically record some technical data (IP address, date and time, page requested, browser and operating system). This is needed to run the website, keep it secure and detect abuse. It is kept only as long as necessary, normally no longer than 30 days, unless needed to investigate unlawful activity.
Legal basis: legitimate interest in the security and operation of the website (Art. 6(1)(f) GDPR).

Contact form and email

If you write to me through the contact form or by email, I process the data you provide (name, email address, message and any other information) to answer your request and, if you wish, to prepare a quote. The message reaches my inbox and a copy is kept in the website’s admin area.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
Retention: as long as needed to handle your request and no longer than 24 months after the last contact. If the request leads to an assignment, the necessary data are kept for the duration of the relationship and for 10 years to meet tax and accounting obligations (Art. 2220 of the Italian Civil Code).

The form is protected by an anti-spam system (Cloudflare Turnstile) that analyses technical device data and browsing behaviour to tell humans from bots.
Legal basis: legitimate interest in protecting the website from spam (Art. 6(1)(f) GDPR).

Blog comments

If you leave a comment on the blog, your name, email, website (optional), the comment text, IP address and browser type are collected in order to publish the comment and prevent spam. Your email is never published. The comment stays online until you ask for it to be removed.

Visit statistics

With your consent, the website uses Google Analytics 4 to collect aggregate statistics on visits (pages viewed, duration, source, device type). Without your consent these tools are not activated. Details in the Cookie Policy.
Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Admin area

To protect access to the website’s administration, the IP addresses that repeatedly enter a wrong password are recorded for a few minutes in order to block intrusion attempts.
Legal basis: legitimate interest in security (Art. 6(1)(f) GDPR).

3. Providing your data

Browsing data are necessary to visit the website. Contact form data are optional, but without them I cannot reply to you.

4. Who receives the data

Your data are never sold or made public. They may be processed, only for the purposes above, by providers acting as processors or as independent controllers:

  • Hostinger International Ltd. (Cyprus, EU) – website hosting and CDN;
  • Google Ireland Ltd. – email (Gmail) used to receive and answer messages, Google Analytics (only with your consent), Google Fonts;
  • Cloudflare, Inc. – spam protection for the contact form (Turnstile) and delivery of some site files (cdnjs);
  • AddOnce, Inc. (AddToAny) – social sharing buttons;
  • Trustindex.io Kft. (Hungary, EU) – display of Google reviews;

Data may also be disclosed to public authorities where required by law.

5. Transfers outside the European Union

Some providers (Google, Cloudflare, AddToAny) may also process data in the United States. Such transfers rely on the EU-US Data Privacy Framework, to which these companies are certified, and/or on the Standard Contractual Clauses approved by the European Commission (Arts. 45 and 46 GDPR).

6. Your rights

At any time you can ask to access, correct or erase your data, restrict processing, receive your data in a machine-readable format (portability) and object to processing based on legitimate interest (Arts. 15–22 GDPR). Where you gave consent, you can withdraw it; this does not affect processing carried out before.

To exercise your rights, write to stefania.cola@gmail.com. I will reply within one month.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country of residence.

7. Security

The website uses an encrypted connection (HTTPS), and data are protected by appropriate technical and organisational measures against unauthorised access, loss or destruction. No automated decision-making or profiling takes place.

8. Changes

This notice may be updated. The current version is always published on this page, with the date of the last update.