Privacy

In short

This site sets no cookies, runs no analytics, carries no advertising and does not profile its visitors. Typefaces, charts and animations are served from this domain: while you read a page, no request goes out to Google, to advertising networks or to any third-party service.

Only two features involve any further processing, and both stay switched off until you switch them on: semantic search and YouTube video playback. Declining leaves the site fully usable.

What follows sets out the detail required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Data controller

The data controller is Graziano Enzo Marchesani, acting as a natural person.

This is a personal website. Although its content concerns research and teaching carried out at the University of Camerino, it is not an institutional site, and the University neither operates it nor determines the purposes of the processing described here — with the single clarification about the mailbox set out in § 3.3.

No Data Protection Officer has been appointed, the conditions of Article 37 GDPR not being met.

Email: graziano.marchesani [at] unicam.itCopy

2. What this site does not do

Stated plainly, and verifiable by inspecting the source code, which is public:

• No cookies. None at all, neither technical nor third-party.
• No analytics (Google Analytics or equivalent), no tracking pixels, no beacons, no heatmaps, no A/B testing.
• No advertising and no membership of any ad network.
• No profiling and no automated decision-making.
• No geolocation and no device fingerprinting.
• No contact, registration, comment or newsletter forms. Nothing you type is sent to this site.
• Typefaces are hosted on this domain. No call is made to Google Fonts or to any other external font service.
• Mathematics, charts and animations are generated locally, with no libraries loaded from external servers.
• No photographs of identifiable third parties are published. This is an editorial rule of the site: its images show places, buildings, data and instruments, not recognisable faces. The only portrait published is the controller’s own.
• Video thumbnails are downloaded at publication time and served from this domain: opening a page containing a video reaches neither Google nor YouTube.

3. Processing that does not require consent

3.1 Access logs kept by the hosting provider

The site is hosted on GitHub Pages, provided by GitHub, Inc. Like any web server, the infrastructure automatically records, for each request: IP address, browser and operating system (user agent), the address of the page requested, the date and time, and any referring page.

These data are inherent to communication over the Internet: without an IP address no page could be delivered to you.

• Purposes: delivering content, infrastructure security, fault diagnosis and abuse prevention.
• Legal basis: the controller’s legitimate interest in operating the service securely, Article 6(1)(f) GDPR.
• Recipient: GitHub, Inc. (Microsoft group), as processor under Article 28 GDPR.
• Retention: determined by the provider. The controller has no access to these logs and puts them to no purpose of their own.

3.2 Technical storage on your device

On the Fields page the site briefly stores, in the browser’s session memory, an identifier of the item you were viewing. Its only job is to restore the animation to the right position when you navigate back from an article.

It holds no personal or identifying data, cannot be used to recognise you, is not readable by third parties, and is erased automatically when you close the browser tab.

If you express a choice in the preferences banner, that choice is instead stored in the browser’s local storage (localStorage, under privacy:scelta), together with the date you made it, for the sole purpose of not asking you the same question on every page and every visit. It records only whether you accepted or declined; it does not identify you and is not readable by third parties. It stays on your device for six months at most, after which it expires and everything reverts to the declined state; you can delete it at any time from your browser settings, or change your choice through the “Privacy preferences” link.

Legal basis: storage strictly necessary to provide the service you requested, exempt from consent under Article 5(3) of Directive 2002/58/EC.

3.3 Contact by email

The site publishes an email address you may copy or use to open your mail client. No message passes through this site: the exchange happens entirely between your mail service and mine.

If you write to me, I process what your message contains — name, email address and anything else you choose to include — solely in order to reply.

Legal basis: pre-contractual steps or response to your request, Article 6(1)(b) GDPR; alternatively legitimate interest in answering correspondence received, Article 6(1)(f). Retention: as long as handling the request and any follow-up requires.

The address published here is the controller’s institutional mailbox. Your message is therefore received and stored on the mail infrastructure of the University of Camerino. The University operates that infrastructure as an independent controller, under its own privacy policies; it does not process your message on behalf of the controller of this site, and takes no part in the purposes described here.

At the time of writing, mail for the @unicam.it domain is delivered through Google Workspace: messages sent to that address are handed to Google’s servers and stored there, with the transfers outside the European Union that this entails. That is the University’s arrangement, not this site’s, and it may change without this notice reflecting it immediately. For the processing that falls to the University, see its privacy policy. If this matters to you, consider whether email is the right channel for what you want to send.

3.4 Names of publication co-authors

The site lists the controller’s scientific publications, including the names of co-authors, imported from the University of Camerino’s IRIS institutional research archive and from the publishers’ own bibliographic records.

The data are limited to surname and initials. No email addresses, affiliations, personal identifiers or other co-author data are collected or published.

• Purpose: accurate and complete attribution of scientific authorship — an ethical obligation before it is a legal one.
• Legal basis: legitimate interest in the truthfulness and integrity of the bibliographic record, Article 6(1)(f) GDPR. The data were already made public by the publishers and are reproduced in the same context and for the same purpose, within the reasonable expectations of the individuals concerned.
• Article 14 notice: the data are not obtained from the individuals themselves. Informing each of them would involve disproportionate effort within the meaning of Article 14(5)(b) GDPR; this notice, being publicly available, discharges that duty.
• Rights: any co-author may at any time request correction of the spelling of their name, or object to the processing, by writing to the address above. Requests are handled without delay.

4. Processing that requires your consent

Default state: everything off

Neither feature described here switches itself on.

The site’s initial state, for everyone and on every device, is refusal. Until you take a positive, explicit step to accept, nothing is downloaded from third parties, nothing beyond § 3.2 is stored on your device, and no request reaches the parties named below.

The following all amount to refusal and produce exactly the same technical result: closing the banner with the “✕”, pressing “Decline”, ignoring the banner, or carrying on browsing without answering. No passive behaviour can be read as consent, in line with Article 4(11) and Recital 32 GDPR.

The only difference between an express refusal and no answer at all concerns the banner itself: if you decline explicitly, the choice is recorded and you will not be asked again for six months; if you do not answer, the banner may reappear on a later visit.

4.1 Semantic search

Search works in two modes.

Text search is always available, requires no consent and involves no further processing: it matches what you type against a static index served from this domain.

Semantic search adds the ability to find conceptually related content even when it does not contain the words you typed. To do so, your browser downloads roughly 33 MB — a language model of about 22 MB plus the runtime that executes it — served from this same domain, and keeps them in the browser cache so they need not be downloaded again.

What you type never leaves your browser. Processing happens entirely on your device: there is no search log, on the server or anywhere else. Nobody — the controller included — can know what you searched for.

Legal basis: consent, Article 6(1)(a) GDPR, and Article 5(3) of Directive 2002/58/EC for the storage on your device.

If you do not consent: search continues to work in text mode. Nothing is downloaded and nothing is stored on your device.

4.2 YouTube videos

Some articles contain videos hosted on YouTube. The preview you see is a static image served from this domain: opening the page contacts no Google server.

The video loads only if you expressly ask for it. At that moment your browser connects to Google’s servers, and the following are disclosed: your IP address; information about your browser and device; the address of the page you are watching from; and any data already held in your browser relating to your Google account, if you are signed in.

The privacy-enhanced mode (youtube-nocookie.com) is used, which reduces but does not eliminate this processing: Google may still store information on your device and associate the view with your profile.

From that point the processing is carried out by Google as an independent controller, on its own terms. The controller of this site has neither access to those data nor any control over them. See the Google privacy policy.

Legal basis: consent, Article 6(1)(a) GDPR and Article 5(3) of Directive 2002/58/EC. Recipients: Google Ireland Limited and Google LLC.

If you do not consent: the preview stays visible along with the video title and a direct link to YouTube, which you may choose to open. No part of the article becomes inaccessible.

4.3 Withdrawing consent

You may change or withdraw your choice at any time, without giving a reason and without any consequence for your use of the site, from the “Privacy” link at the foot of every page.

Withdrawal does not affect the lawfulness of processing carried out beforehand. As regards data already obtained by Google, withdrawal on this site prevents any further transmission but does not undo processing already performed by that company, against which rights must be exercised directly.

5. Links to external sites

The site links to external resources: DOIs of scientific publications, institutional archives, code repositories, academic and social profiles, project sites.

Following such a link takes you away from this site. The controller exercises no control over the destination sites and is not answerable for their content or for any processing of personal data they carry out, which is governed by their own privacy notices.

6. Transfers to third countries

Some of the parties named above are established, or operate infrastructure, outside the European Economic Area, in particular in the United States of America.

Transfers take place under Articles 44 et seq. GDPR. Further information about the safeguards in place is available on request at the address above.

7. Retention periods

• Hosting access logs: per the provider’s policy; not accessible to the controller.
• Technical session storage: until you close the browser tab.
• Consent preference: up to 6 months, or until you change it.
• Semantic search model: in your browser cache, until you clear it or withdraw consent.
• Email correspondence: as long as handling the request requires.
• Bibliographic data: as long as the publication remains listed on the site.

8. Your rights

In relation to data concerning you, you may exercise the rights set out in Articles 15 to 22 GDPR:

• access — to learn whether and what data are processed, and obtain a copy;
• rectification — to correct inaccurate or incomplete data;
• erasure — to have data deleted, in the cases provided for;
• restriction — to have processing suspended;
• portability — to receive the data in a structured format, where applicable;
• objection — to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest;
• withdrawal of consent — at any time, as described in § 4.3.

Requests should be sent to the address given in § 1 and are answered within one month, extendable in the cases allowed by Article 12(3) GDPR.

If you consider that the processing infringes the law, you have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — garanteprivacy.it), or with the supervisory authority of the country where you live, or to bring proceedings before a court.

9. Automated decision-making

The controller carries out no profiling and takes no decisions based solely on automated processing within the meaning of Article 22 GDPR.

Where you consent to video playback, Google may carry out profiling on its own terms, over which the controller has no control.

10. Children

The site is not directed at children under fourteen and does not knowingly collect their data. Its teaching material is intended for university students.

11. Whether providing data is required

No provision of data is mandatory. Declining the features described in § 4 simply switches them off, with no restriction whatsoever on access to the content of the site.

12. Changes to this notice

This notice may be updated to reflect changes to the site or to the law. The date at the top indicates the latest revision. Substantial changes affecting consent already given will prompt a fresh request for consent.