PRIVACY

Last updated: 24 October 2026.

This notice explains how personal data is processed when you visit Andrea Di Lorenzo’s website or send a message through the home or FAQ form to receive a reply or information about photography services.

Controller and contact details

The data controller is Andrea Di Lorenzo, a photographer based in Rome, Italy. For information about the processing of your data or to exercise your rights, email info@andreadilorenzo.it or call +39 339 19 399 08.

Messages, questions and requests for a quote

The home and FAQ forms collect your name, email address and message. These details are used to read your request, reply and handle any follow-up. Required fields are necessary to use the form and receive a reply. Your details are not used to subscribe you automatically to newsletters or send unsolicited promotional messages.

For requests about photography services or quotes, the legal basis is taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR. For other correspondence, the legal basis is the controller’s legitimate interest in replying to communications received, under Article 6(1)(f), while respecting your rights.

Messages are stored in the website’s Cloudflare D1 database and notified to the controller through the Resend email service. Access is limited to the controller, authorised persons and providers involved in operating the service. Please avoid including particularly sensitive information or unnecessary information about other people.

Browsing and security

To deliver pages and protect the website, the infrastructure may process IP addresses, browser information, request dates and times, requested resources and technical or security events. The legal basis is the controller’s legitimate interest in operating and securing the website and preventing abuse.

The contact form uses a hidden antispam field and request rate limiting. For rate limiting, the server hashes the IP address using a secret value; the plain IP address is not stored in the message record. The hash is not described as anonymous data: it is used solely to prevent abuse. The code removes antispam records older than 24 hours when subsequent requests arrive.

Cookies and functional browser storage

The website does not use advertising cookies or social media pixels for marketing. Instagram and other external destinations are links: when you visit them, their own privacy notices apply.

Some features may use temporary browser storage, particularly sessionStorage, to remember the previous page for the FAQ back link and information needed for page transitions. These details remain within the tab’s session, are not used for advertising profiles and are not transmitted to analytics services by those features. Closing the tab normally ends this storage, subject to the browser’s session restoration features.

Cloudflare’s infrastructure may use technical security tools needed to operate and protect the website, without advertising purposes.

Umami Cloud analytics

The website uses Umami Cloud to measure visits and understand which pages are viewed, helping improve content and usability. The identified legal basis is the controller’s legitimate interest in understanding use of the website, under Article 6(1)(f) GDPR. You may object by contacting the controller.

According to the provider’s documentation, Umami does not use cookies for analytics. It processes information including pages and URL parameters, referrers, language, browser and device characteristics and approximate location. To group activities, it generates an identifier using the website ID, IP address, User-Agent and a periodically changing value. The IP address is processed for these operations and is not stored as a field in ordinary analytics records; this does not exclude processing within the provider’s technical and security systems.

The website does not send Umami the names, email addresses or messages entered in forms, or assign visitors a personal identifier through the service’s identification feature. The Hobby plan used provides 6 months of analytics data retention. Residual copies may remain in backups according to the provider’s cycles. Further information is available in the metric definitions, privacy policy and Umami data processing agreement.

Providers and international transfers

Cloudflare supplies web infrastructure, request storage and security services; Resend handles email notifications; Umami Software supplies analytics. Data is not sold. It may be disclosed to authorities or advisers where necessary to meet legal obligations or protect the controller’s rights.

These providers may also process data outside the European Economic Area. An EU database location does not exclude technical operations, support or access from other countries. The safeguards under Chapter V GDPR and the providers’ agreements apply, including, where relevant, adequacy decisions or standard contractual clauses. Contact the controller for information about applicable safeguards or to request a copy. The data processing agreements of Cloudflare, Resend and Umami are available online.

Retention of requests and other data

Contact messages and related emails are retained as long as necessary to reply and complete follow-up. If a professional relationship develops, necessary correspondence may be retained to manage that relationship, meet legal obligations and protect rights for the applicable periods. Data no longer needed must be deleted or anonymised. This criterion applies to the website database and email copies; contact messages are not subject to a general automatic deletion schedule.

Technical data is retained according to operational and security needs and the providers’ cycles; information about abuse or disputes may be kept as long as needed to handle them. The specific analytics retention period is stated in the Umami Cloud section. Contact the controller to learn which retention period applies to your request.

Your rights

In the circumstances provided by Articles 15–22 GDPR, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing already carried out.

To exercise these rights, email info@andreadilorenzo.it. You will receive a reply within the GDPR time limits, normally one month; only information necessary to verify your identity may be requested. You may also lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority where you normally live, work or believe an infringement occurred.

Updates

This notice may be updated when services or processing activities change. The date at the beginning identifies the latest revision.