Legal
Privacy Policy
Last updated: 1 July 2026
1. Who we are
This website — raffaellarosa.com — presents the professional work of Raffaella Rosa Lorenzo, visual artist (Pistoia, Italy).
Data Controller
Raffaella Rosa Lorenzo
Pistoia, Italy
Email: studio@raffaellarosa.com
The website is built and technically managed by Gaia Holding S.r.l. (Via Rampa Statale 66, 51100 Pistoia — P.IVA 11501380965 — PEC: posta@pec.gaiaholding.it), acting as Data Processor on behalf of the Data Controller pursuant to Art. 28 of Regulation (EU) 2016/679 (GDPR).
Server hosting is provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany), acting as a further processor engaged by Gaia Holding S.r.l. The server is located in Germany, within the European Economic Area.
2. What data we collect and how
2.1 Server technical logs. When you visit any page of this website, our web server automatically records:
- IP address of the requesting device
- Browser type and version (user agent)
- Operating system
- URL of the page requested
- Date and time of the request
- HTTP status code of the server response
- Referrer URL (the page from which you arrived, where your browser transmits this automatically)
This data is recorded as part of normal server operation. You do not actively provide it. We do not combine these records with any other data to identify you individually, and we do not use them for any purpose other than security and the correct operation of the site.
2.2 Email enquiries. The Contact page of this website displays an email address. If you choose to write to us, your email address and the contents of your message will be processed in order to respond to your enquiry. You provide this data entirely voluntarily. We do not send unsolicited follow-up communications.
2.3 Analytics and marketing data (collected only with your prior consent). If you give your consent through the cookie consent banner, this website uses:
- Google Analytics 4 (GA4), a web analytics service provided by Google LLC. GA4 uses cookies stored on your device to help us understand how visitors use the website — which pages are visited, how long users stay, the general source of traffic. Data is used solely to improve the website experience. This website implements Google Consent Mode v2: analytics cookies are set and data is transmitted to Google only after you grant consent for the Analytics category. If you decline, no GA4 cookies are placed.
- Meta Pixel, an advertising measurement and retargeting tool provided by Meta Platforms, Inc. When you consent to the Marketing category, the Meta Pixel sets cookies on your device and transmits event data to Meta. This allows us to measure the effectiveness of advertising on Meta platforms (Facebook and Instagram) and to show relevant content to visitors who have previously visited this website. If you decline, no Meta Pixel cookies are placed.
You may grant or decline consent for each category independently through the cookie banner. Your choices are saved in your browser and respected on all pages. You may change or withdraw consent at any time — see Section 7 and the Cookie Policy.
3. Purposes and legal basis for processing
| Data | Purpose | Legal basis |
|---|---|---|
| Server technical logs | Ensuring the security and correct delivery of the website; identifying and preventing abuse or cyberattacks | Art. 6(1)(f) GDPR — legitimate interests in maintaining a secure and functioning website |
| Email correspondence | Responding to your enquiry; taking steps at your request prior to a possible professional engagement | Art. 6(1)(f) GDPR — legitimate interests; or Art. 6(1)(b) GDPR where the enquiry concerns a potential contractual relationship |
| Analytics data (GA4) | Understanding how visitors use the website in order to improve it; audience measurement | Art. 6(1)(a) GDPR — your freely given, specific, informed consent; Art. 122 D.Lgs. 196/2003 (Italian implementation of Art. 5(3) ePrivacy Directive) |
| Marketing data (Meta Pixel) | Measuring the effectiveness of advertising campaigns on Meta platforms; retargeting on Facebook and Instagram | Art. 6(1)(a) GDPR — your consent; Art. 122 D.Lgs. 196/2003 |
Right to withdraw consent. Where processing is based on your consent (analytics and marketing tracking), you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. To withdraw or change your consent, click the “Cookie settings” link in the footer of any page.
4. Who receives your data
We do not sell, rent, or share your personal data with third parties for commercial or marketing purposes. The parties with access to the data described in this policy are:
- Gaia Holding S.r.l. — acting as Data Processor, providing technical management of the website under a data processing agreement pursuant to Art. 28 GDPR.
- Hetzner Online GmbH — acting as a further processor engaged by Gaia Holding S.r.l., providing server hosting under Hetzner's standard GDPR-compliant data processing agreement. Hetzner operates within the European Union and processes data in Germany.
- Google LLC — if you have consented to analytics cookies, GA4 receives and processes data about your use of this website. Google acts as an independent data controller for its own product-improvement purposes in addition to processing analytics data as our service provider. Google's privacy policy: policies.google.com/privacy.
- Meta Platforms, Inc. — if you have consented to marketing cookies, the Meta Pixel transmits browsing event data to Meta for advertising measurement and retargeting. Meta acts as an independent data controller for its own advertising platform. Meta's privacy policy: facebook.com/policy.
5. International data transfers
Hetzner Online GmbH processes data within Germany (EU). Server logs and email correspondence involve no transfer outside the EEA.
Transfers to the United States. When you consent to analytics or marketing cookies, data is transferred to Google LLC and Meta Platforms, Inc., both headquartered in the United States. These transfers rely on the following legal bases:
EU–US Data Privacy Framework (DPF). Both Google LLC and Meta Platforms, Inc. have certified their participation in the EU–US Data Privacy Framework, established by the European Commission's adequacy decision of 10 July 2023 and confirmed valid by the General Court of the European Union on 3 September 2025 (Case T-553/23). You may verify their certifications at dataprivacyframework.gov.
Standard Contractual Clauses (SCCs). As a supplementary measure, both companies have adopted the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), which contractually bind the US recipients to data-protection standards equivalent to those required within the EEA, providing a backup mechanism should the adequacy decision be revised.
A legal challenge to the DPF adequacy decision is pending before the Court of Justice of the EU (Case C-703/25 P). The SCCs remain available as a fallback. For further information on the safeguards applicable to these transfers, write to studio@raffaellarosa.com.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Server technical logs | Maximum of 14 days, then deleted automatically. Logs may be preserved longer only where required by a law enforcement authority or judicial order, or where a security incident requires investigation. |
| Email correspondence | Retained as long as necessary to handle your enquiry; deleted within 12 months of the last exchange, unless legal or contractual obligations require a longer period. |
| Analytics data (GA4) | GA4 cookies persist on your device for up to 2 years (see Cookie Policy). Data retained by Google is governed by Google Analytics retention settings and Google's privacy policy. |
| Marketing data (Meta Pixel) | Meta Pixel cookies persist on your device for up to 90 days (see Cookie Policy). Data retained by Meta is governed by Meta's own retention policies. |
7. Your rights
Under Chapter III of the GDPR (Arts. 15–22), you have the right to:
- Access — obtain confirmation of whether we process your personal data and, if so, receive a copy (Art. 15).
- Rectification — request correction of inaccurate or incomplete data (Art. 16).
- Erasure — request deletion of your personal data where permitted by law (Art. 17).
- Restriction of processing — in certain circumstances (Art. 18).
- Data portability — receive your data in a structured, machine-readable format (Art. 20), where processing is based on consent or contract and carried out by automated means.
- Object — object to processing based on legitimate interests (Art. 21); we will stop unless we can demonstrate compelling legitimate grounds.
- Withdraw consent — where processing is based on your consent (analytics and marketing cookies), withdraw it at any time without penalty via “Cookie settings” in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.
For rights relating to data held by Google or Meta, exercise those rights directly with those companies using the contact details in their privacy policies (links in Section 4).
For rights relating to data held by us, write to studio@raffaellarosa.com. We will respond within one month of receiving your request. In complex cases we may extend this by up to two further months; if so, we will inform you of the extension and the reasons.
8. Right to lodge a complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Italy, this is:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma
www.garanteprivacy.it · garante@garanteprivacy.it
You may also lodge a complaint with the supervisory authority of the EU Member State where you habitually reside or work.
9. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the website's technical configuration, the services used, or applicable law. The “Last updated” date at the top indicates when changes were last made. If we introduce new tracking technologies, we will update the cookie consent banner so you can review and re-confirm your choices before the new processing begins.
A version of this policy in Italian is available upon request at studio@raffaellarosa.com.