// privacy policy

Privacy policy

Last updated: 13 July 2026

This notice describes how personal data of users visiting bombacamillo.com (the "Site") is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended ("Italian Privacy Code"). It applies solely to the Site and does not extend to other websites, platforms or services that may be reached via links.

1. Data controller

The data controller is Digi Solution di Bomba Camillo, VAT no. IT02718170695 (the "Controller"). For any matter concerning the processing of personal data, the Controller can be reached at me@bombacamillo.com.

2. Categories of data processed

a) Browsing data. The Site's systems and hosting infrastructure acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, request time, requested page, server response code, browser and device information). This information is used solely to ensure the proper operation and security of the Site.

b) Measurement data (statistics). The Site uses Google Analytics 4 with Consent Mode v2 and consent denied by default: without consent no measurement cookie is set and the data collected contains no persistent identifiers and is processed in aggregate form. Only after consent is given through the banner are the statistical cookies described in the cookie policy set. IP addresses are anonymised.

c) Data provided voluntarily. The Site contains no data collection forms. Where the user chooses to contact the Controller through the channels indicated (WhatsApp, email, phone, social profiles), the contact details and any information spontaneously provided in the message will be processed.

3. Purposes and legal bases

  • Operation and security of the Site (browsing data) — legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR) in properly delivering and protecting the service.
  • Site usage statistics (measurement cookies) — legal basis: the data subject's consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time via the "Cookie preferences" link in the footer.
  • Responding to contact requests (data provided voluntarily) — legal basis: pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
  • Compliance with legal obligations where applicable — legal basis: Art. 6(1)(c) GDPR.

4. Processing methods and retention

Data is processed by electronic means, with technical and organisational measures adequate to ensure its security and confidentiality. No automated decision-making or profiling within the meaning of Art. 22 GDPR is carried out.

Browsing data is kept for the time strictly necessary for operation and security purposes. Google Analytics statistical data is retained for a maximum of 14 months. Data relating to contact requests is kept for the time needed to respond and, where a professional relationship follows, for its duration and any applicable statutory periods.

5. Recipients

Data may be processed, as processors within the meaning of Art. 28 GDPR or as independent controllers, by the following parties:

  • Vercel Inc. — Site hosting and delivery (privacy policy);
  • Google Ireland Ltd. — Google Analytics 4 measurement service (privacy policy);
  • Meta Platforms Ireland Ltd. / WhatsApp Ireland Ltd. — where the user chooses to contact the Controller via WhatsApp (privacy policy);
  • providers of email and productivity services used by the Controller.

6. Transfers outside the EU

Some of the providers listed above are established or operate infrastructure in the United States. Transfers take place on the basis of adequacy decisions of the European Commission (EU-U.S. Data Privacy Framework, for certified providers) or of the standard contractual clauses under Art. 46 GDPR.

7. Data subjects' rights

Under Articles 15-22 GDPR, data subjects may exercise the following rights at any time by writing to me@bombacamillo.com:

  • right of access (Art. 15);
  • right to rectification (Art. 16);
  • right to erasure ("right to be forgotten", Art. 17);
  • right to restriction of processing (Art. 18);
  • right to data portability (Art. 20);
  • right to object (Art. 21);
  • right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal (Art. 7(3)).

8. Complaints to the supervisory authority

Data subjects who consider that the processing of their data infringes the GDPR have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), pursuant to Art. 77 GDPR, or to seek judicial remedies.

9. Minors

The Site is not intended for children under 14 and the Controller does not knowingly collect personal data relating to minors.

10. External channels and social platforms

The Site links to third-party platforms (WhatsApp, LinkedIn, Instagram, YouTube). Use of those platforms is governed by their respective privacy notices, over which the Controller has no control. Users are invited to review them.

11. Changes to this notice

The Controller reserves the right to amend or update this notice at any time, including as a result of regulatory changes or changes to the services used. Amendments will be published on this page with the date of last update. For information on cookies, please see the cookie policy.