Last updated: April 14, 2026

Data controller

The controller of the personal data collected through Romano Stefano is the party that determines the purposes and means of the processing.

• Controller: Stefano Romano
• Email: spike93sr@gmail.com
• Website: https://romanostefano.com/

Data Protection Officer (DPO) and representative, where applicable

A Data Protection Officer (DPO) is appointed only in the cases provided for by Articles 37-39 of Regulation (EU) 2016/679. Where such a figure, or a representative in the European Union, has been appointed for the processing carried out through the site, the relevant contact details are made available by the controller through the contact channels indicated in this notice or in any additional dedicated information sections.

Categories of personal data processed

• Technical browsing data, logs, IP addresses, online identifiers, device-related data, and information necessary for the operation of the site.
• Data voluntarily provided by the user through contact forms, emails, commercial requests, registration forms, booking forms, checkout flows, or support requests, if present on the site.
• Data relating to privacy or cookie preferences and consents, including logs strictly necessary to document the user's choice.
• Any data processed by third-party services embedded in pages, such as video platforms, maps, analytics tools, advertising systems, pixels, or chatbots.

Third-party services detected in the cookie catalog

The current cookie catalog suggests the presence of third-party services or providers that may involve additional processing of personal data. This section helps connect the privacy notice to the cookies actually recorded on the site.

• romanostefano.com: Third-party provider declared in the site's cookie catalog. The related processing depends on the features actually integrated in the project and on the information provided by the provider.

The notices and any preferences made available by the individual providers, where applicable, also remain applicable to the third-party services listed above.

Source of the data

Personal data are collected directly from the data subject during browsing, form completion, account registration, the purchase of goods or services, or interaction with site features. Where third-party services are integrated into the pages, some technical data, online identifiers, or usage information may also be collected by the related providers according to the features actually active and their respective notices.

Purposes of processing and legal bases

• Browsing, security, abuse prevention, authentication, and site operation: performance of the requested service and the controller's legitimate interest in the security and continuity of the service.
• Management of requests, contacts, quotations, or orders: performance of pre-contractual measures, contractual obligations, or compliance with legal obligations, depending on the requested service.
• Administrative, tax and accounting obligations: legal obligation.
• Sending promotional communications, newsletters, remarketing, profiling, or personalized advertising: data subject consent, where required.
• Non-technical statistical analysis, experience personalization, and non-essential tracking tools: consent expressly provided through the cookie banner.

Nature of providing data

Providing the technical data necessary for browsing and site security is generally necessary to use the service. Providing the data requested in site forms may be necessary to receive a response or use the requested services. Providing data for marketing, profiling, or non-essential cookies is optional and subject to consent where required.

Processing methods and security measures

Processing is carried out using electronic, telematic, and organizational tools suitable to ensure data confidentiality, integrity, availability, and security, in accordance with principles of lawfulness, fairness, transparency, minimization, and storage limitation.

Recipients or categories of recipients

Data may be processed by staff authorized by the controller and disclosed, within the limits relevant to the stated purposes, to hosting providers, IT suppliers, site maintainers, consultants, email platforms, analytics tools, payment services, advertising providers, entities that provide technical or organizational services, and other processors appointed where necessary.

Transfer of data to countries outside the EEA

The use of some third-party providers may involve transfers of data to countries outside the European Economic Area. In such cases, processing takes place on the basis of an adequacy decision, standard contractual clauses, or other appropriate safeguards provided for by Articles 44 et seq. GDPR.

Retention period

Personal data are retained for the time strictly necessary for the purposes for which they are collected and, thereafter, within the limits permitted to protect the controller's rights and comply with legal obligations.

• Technical browsing and security data are processed for periods compatible with site operation, protection, and the management of incidents or abuse.
• Data submitted through forms, emails, or support requests are retained for the time necessary to handle the request and related follow-up obligations.
• Data processed for administrative, tax, accounting, or contractual purposes are retained for the periods required by applicable law and to protect the controller's rights.

Withdrawal of consent

When processing is based on consent, the data subject may withdraw it at any time without affecting the lawfulness of the processing carried out before withdrawal. This applies in particular to marketing tools, profiling, optional newsletters, or non-essential cookies, unless different legal bases apply to specific processing.

Automated decision-making and profiling

At the time of generation, there are no fully automated decision-making processes producing legal or similarly significant effects on the data subject under Article 22 GDPR. Statistical analyses, security measures, or functional customizations of the site do not normally involve automated decisions of this kind.

Data subject rights

The data subject may request access to personal data, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent, and information about the parties to whom the data is disclosed, within the limits provided by applicable law.

Right to lodge a complaint

If you believe that the processing violates personal data protection law, you may lodge a complaint with the Italian Data Protection Authority or contact the competent judicial authority.

Cookies and tracking tools

In the current cookie catalog, the following categories are specifically present: Necessary. More details are available in the Cookie Policy. Open Cookie Policy

Policy updates

This notice may be updated when the processing activities carried out, the providers used, the site features, or the applicable legal framework change.

How to contact us

To exercise your rights or request information about data processing, you can contact the controller using the contact details above.