Notice on the processing of personal data
Data controller
The data controller is Valentina Mammana, Via Cavour 26, 96017 Noto (SR), Italy, who operates the website in her own name. References to the association CulturArte Noto ODV appearing on the website concern the controller's activity within that association and not the operation of the website.
The controller can be contacted at the postal address indicated above and through the contact form published on the website.
This notice is provided pursuant to Art. 13 of Regulation (EU) 2016/679 and concerns the processing carried out through the website valentinamammana.it, in its Italian, English, Spanish and German versions.
No data protection officer has been appointed, as the conditions set out in Art. 37 of the Regulation are not met.
Data and purposes
The website collects the data provided through the quotation request form: name, email address and the content of the message. This data is processed in order to receive the request, examine it and provide a reply.
On submission, the server processes the originating IP address, in pseudonymised form, together with the technical data of the form completion session. The purpose is the prevention of automated and repeated submissions. The records relating to this processing are not accessible from the outside and are protected by measures appropriate to the risk pursuant to Art. 32 of the Regulation.
The website does not carry out profiling and does not use analytics, tracking or advertising tools. There is no newsletter, no user accounts and no online sales functionality. No processing based on automated decision-making is carried out.
Legal basis
The processing of the data provided through the form is based on Art. 6(1)(b) of the Regulation, as it is necessary in order to take steps at the request of the data subject prior to entering into a contract. The selection of the checkbox present in the form confirms that this notice has been read and does not constitute consent to the processing.
The processing of the IP address for the purpose of preventing misuse is based on Art. 6(1)(f) of the Regulation. The legitimate interest pursued is the security of the website and the reduction of automated and repeated submissions through the form.
Nature of the provision of the data
The provision of the data is neither a statutory nor a contractual requirement. The name, email address and message are necessary in order to transmit the request: in their absence the request is not forwarded and cannot receive a reply.
Recipients of the data
The website is hosted on the infrastructure of Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), which acts as a processor pursuant to Art. 28 of the Regulation, on the basis of the contractual terms published by the provider. The web space is located in data centres situated in Italy. The infrastructure records technical operating and security data in accordance with the provider's policies.
Messages sent through the form are delivered to the controller's mailbox by means of the email delivery service of Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States, which acts as a processor pursuant to Art. 28 of the Regulation. The content of the message and the data subject's email address, set as the reply address, are processed by the provider's infrastructure.
The anti-spam check is performed on the website's own server and involves no disclosure of data to third parties. The website's resources are served from the same domain and involve no requests to third-party servers.
The data is not disseminated. Apart from the processors indicated and the sub-processors engaged by them within the limits of their respective contractual terms, the data is not disclosed to other recipients, without prejudice to disclosure obligations laid down by law.
Transfers to third countries
The email delivery service involves a transfer of personal data to the United States, where the provider stores the content of the messages and the data relating to their delivery. The sending region configured for the domain concerns mail routing only and not the place where the data is stored.
The transfer is carried out on the basis of the standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) of the Regulation, incorporated into the provider's data processing agreement. As at the date of the last update of this notice, the provider is also included in the list of participants in the EU-U.S. Data Privacy Framework, as a further transfer mechanism. A copy of the safeguards adopted may be requested from the controller.
Retention period
Correspondence received through the form is retained in the controller's mailbox for twelve months from the date of the last exchange with the data subject. Where a contractual relationship arises from the request, the related documentation is retained for the periods laid down by the applicable civil law and tax obligations.
The technical operating and security data recorded by the hosting infrastructure is retained in accordance with the provider's policies, which independently determine its duration.
The records intended for the prevention of misuse are retained for a maximum period of five days, after which they are deleted.
According to the terms published by the provider of the email delivery service, the content of the messages and the related delivery data are retained for thirty days and backup copies for seven days.
Cookies and local storage
The website does not use profiling cookies, analytics cookies or other tracking tools. The anti-spam check, in the configuration adopted by the website, does not set cookies and does not store any information on the visitor's device.
After the form has been submitted, the website stores an expiry value in the browser's local storage, containing no identifiers and no personal content, which for five days prevents the form from being offered again on the same device. Such storage is strictly necessary for the provision of the service requested by the user and is not subject to consent pursuant to Article 122(1) of Italian Legislative Decree 196/2003. The value may be removed at any time by clearing the website's data from the browser.
Data subject rights
The data subject has the right to obtain access to their personal data (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18). For data processed on the basis of Art. 6(1)(b), the right to data portability also applies (Art. 20).
With regard to the processing based on the legitimate interest in preventing misuse, the data subject has the right to object at any time pursuant to Art. 21 of the Regulation.
These rights may be exercised against the controller by submitting a request through the website's contact form or to the postal address indicated in the first section. Requests are handled directly by the controller.
Complaint to the supervisory authority
A data subject who considers that the processing does not comply with the Regulation has the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian supervisory authority) pursuant to Art. 77 of the Regulation, without prejudice to the right to bring proceedings before the courts.
Contact details of the authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma; telephone +39 06 696771; email protocollo@gpdp.it; certified email protocollo@pec.gpdp.it; website www.garanteprivacy.it.
Updates
This notice is amended in the event of changes to the processing operations, to the providers used or to the applicable legal framework. The version published on the website is the version in force.
Last updated: 17 September 2026.