Skip to main content
davide bertoni
bertons.me
Home
LEGAL // 04

Privacy policy and legal notice

How bertons.me handles your data, why it sets no tracking cookies, and the legal notice.

v1.3.0No tracking cookies

1. Data controller

The Data Controller for personal data processed through this website pursuant to Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Italian Legislative Decree no. 196/2003 (as amended by Legislative Decree no. 101/2018) is Davide Bertoni, resident in Modena, Italy.

For any inquiry, data protection request, or clarification regarding this policy, you may contact the Controller directly via email at davidebe03@gmail.com.

This website is an independent personal portfolio and CV. It is not affiliated with any company.

2. Cookies and client-side storage

bertons.me does not set, store, or read any tracking cookies, profiling cookies, advertising identifiers, or third-party tracking beacons.

All typography (Geist, Newsreader, Space Grotesk, Source Sans 3, and JetBrains Mono) is self-hosted directly from the site origin via static font files. No network connections are opened to Google Fonts or foreign font distribution networks.

The site itself stores only these technical entries on your device:

  • theme (localStorage): Stores your selected color mode ('dark' or 'light'). This strictly functional entry prevents Flash of Unstyled Content (FOUC) and ensures your visual preference persists across navigations.
  • bertons:lang-scroll (sessionStorage): Remembers your scroll position for a few seconds when you switch language, so the translated page opens at the same spot. It is deleted as soon as it is read and never outlives the browser tab.
  • Offline cache (Cache Storage, via a service worker): Keeps copies of the pages, images and files of this site that you have already visited, so they load faster and also work offline. It holds site content only, no information about you, and is replaced at every new release of the site.

Legal exemption for technical storage

Under Article 5(3) of Directive 2002/58/EC (ePrivacy Directive, as amended by Directive 2009/136/EC), Article 122(1) of Italian Legislative Decree no. 196/2003, and the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) Guidelines of 10 June 2021 (Deliberation no. 231, Official Gazette no. 163 of 9 July 2021, Docweb no. 9677876), technical storage strictly necessary to deliver an information society service explicitly requested by the user is exempt from consent requirements.

Because no profiling, advertising, or non-essential tracking cookies exist on this platform, no cookie consent banner is legally required or displayed.

The only third-party content that could store data on your device is the YouTube video player. It is never loaded automatically: it starts only after you press play on a specific video, which counts as your consent for that video alone (see section 3, part D).

3. Data processing and legal grounds

Under Article 6 of Regulation (EU) 2016/679 (GDPR), every personal data processing operation must rest on an established lawful ground. The data processing activities conducted on this website include:

A. Messages and the contact form

When you submit the contact form located on the dossier page, the system processes your name, email address, message body, and a hidden anti-spam honeypot parameter.

Purpose: To read, evaluate, and reply to your incoming messages, technical inquiries, or professional collaboration proposals.

Legal basis: Article 6(1)(b) GDPR (execution of pre-contractual measures taken at the request of the data subject) and Article 6(1)(f) GDPR (legitimate interest of the controller in responding to direct communications).

Providing your data is voluntary: no law or contract requires it. Name, email address and message are needed to send the form and to reply to you; without them the message cannot be sent. You can always write to the email address in section 1 instead.

Anti-abuse safeguards: To prevent spam and abuse, the server uses your IP address as a temporary rate-limiting key (at most 5 messages every 10 minutes). The key is held only in the temporary memory of the serverless function on Vercel infrastructure, is never written to a database, and is discarded once the 10 minute window has passed. Your IP address is never included in the email, never placed in any URL, and never shared with other third parties. Messages are also screened automatically for abusive language: clearly abusive submissions are not delivered, while ambiguous wording is delivered with a flag for manual review. Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller in protecting the contact channel from abuse).

B. Server logs and network security

When you request any page or asset, edge routing servers automatically process technical transmission data: client IP address, HTTP request method, URI path, HTTP status code, user-agent string, and timestamp.

Purpose: Ensuring network security, mitigating distributed denial-of-service (DDoS) attempts, investigating system errors, and enforcing sliding-window rate limits (such as the 5 requests per 10 minutes limit on the contact endpoint).

Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller in guaranteeing the operational reliability, security, and integrity of technical systems, in accordance with Recital 49 of the GDPR).

C. Performance telemetry without cookies

This site measures real-user performance via Vercel Web Analytics and Vercel Speed Insights. Telemetry captures aggregated page metrics, Core Web Vitals (LCP, CLS, INP, TTFB), rough geographic location at country or region level, and browser family.

Privacy safeguards: The service is entirely cookieless. Incoming IP addresses and user agents are combined with a daily rotating salt to compute a transient hash, discarding raw identifiable data at ingestion. No persistent identifier is written to your device, and no cross-site profiling takes place.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in maintaining optimal rendering speeds, detecting performance regressions, and ensuring universal accessibility).

D. Embedded YouTube videos (only after you press play)

Some pages show a video hosted on YouTube. Until you press play, the page shows only a preview image served from this site: no connection is made to YouTube or Google and nothing is stored on your device.

When you press play, the player is loaded from youtube-nocookie.com (YouTube privacy-enhanced mode). From that moment Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as an independent controller, receives your IP address, browser data and the address of the page, and may store identifiers on your device and transfer data to Google LLC in the United States (covered by the EU-U.S. Data Privacy Framework). See the Google privacy policy: https://policies.google.com/privacy.

Legal basis: your consent, Article 6(1)(a) GDPR and Article 122 of Italian Legislative Decree no. 196/2003, given by pressing play on that video. The choice is not remembered: every page load starts from the preview again, so you withdraw consent simply by leaving or reloading the page. You can also watch the video on YouTube through the link under it.

4. Data processors and international transfers

Personal data is handled with care and never sold, rented, leased, or traded. Third-party providers acting as data processors under Article 28 GDPR include:

  • Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA): Cloud hosting, edge content delivery, serverless compute, and cookieless telemetry. Data transfers to the United States are governed by the EU-U.S. Data Privacy Framework (DPF) adequacy decision of 10 July 2023 under Article 45 GDPR, supplemented by Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914.
  • Resend Inc. (2261 Market St #5134, San Francisco, CA 94114, USA): Transactional email relay dispatching contact form messages to the controller. Data transfers to the United States are covered under Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR and encrypted transit (TLS).
  • Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA): Inbox hosting service (Google Workspace / Gmail) receiving incoming contact emails. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Links to third-party platforms

This site provides outbound links to external profiles and platforms (GitHub, LinkedIn, Telegram, Itch.io, YouTube). When clicking an external link, you leave bertons.me and are subject to the independent privacy terms and cookie practices of that third party.

5. Data retention periods

In alignment with the principle of storage limitation under Article 5(1)(e) of the GDPR, personal data is retained only for the period necessary to fulfill its processing purpose:

  • Contact form submissions: Retained in the controller email client for the duration necessary to handle the conversation, answer inquiries, or maintain professional correspondence. Obsolete threads are reviewed and deleted periodically.
  • Email relay logs: Resend keeps a delivery log of each message (sender, recipient, subject and content) for a limited period set by its own retention policy, after which it is deleted automatically.
  • Contact rate-limiting keys: The IP-based counter lives only in serverless function memory. It is pruned once its 10 minute window has passed and never outlives the short-lived serverless instance.
  • Server edge logs: Stored temporarily on hosting infrastructure in accordance with Vercel standard operational cycles (up to 30 days) and automatically overwritten.
  • Local storage preference: The theme entry remains in your client browser until you clear browser data or change your theme preference.
  • Offline cache: Kept until the next release of the site or until you clear site data in your browser.

6. Rights of the data subject

Under Articles 15 through 22 of Regulation (EU) 2016/679 (GDPR), individuals located in the European Union hold specific enforceable rights regarding their personal data:

  • Right of access (Art. 15 GDPR): Obtain confirmation as to whether personal data concerning you is being processed, and access a copy of that data.
  • Right to rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
  • Right to Erasure ("Right to be Forgotten", Art. 17 GDPR): Request deletion of personal data when no longer necessary for original purposes.
  • Right to restriction of processing (Art. 18 GDPR): Request temporary limitation of processing in contested situations.
  • Right to notification (Art. 19 GDPR): Receive notification regarding rectification, erasure, or restriction of personal data.
  • Right to data portability (Art. 20 GDPR): Receive personal data provided in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21 GDPR): Object at any time to data processing carried out under the legitimate interest ground.
  • Right to withdraw consent (Art. 7(3) GDPR): Where processing rests on your consent (the YouTube player), you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
  • Right not to be subject to automated decision-making (Art. 22 GDPR): Note that bertons.me carries out no automated decision-making and no profiling.

How to exercise your rights

To exercise any of these rights, send an email request directly to davidebe03@gmail.com. Inquiries are handled promptly, free of charge, and answered within one month (30 days) pursuant to Article 12(3) of the GDPR.

If you believe that the processing of your personal data infringes data protection regulations, you hold the right to lodge a formal complaint with a competent supervisory authority under Article 77 GDPR, or seek an effective judicial remedy under Article 79 GDPR. In Italy, the supervisory authority is:

Garante per la Protezione dei Dati Personali - Piazza Venezia 11, 00187 Roma, Italy (Telephone: +39 06.696771, Certified Email: protocollo@pec.gpdp.it, Website: https://www.garanteprivacy.it).