This site is built privacy-first. By default it sets no cookies and stores nothing on your device. The only cookies are Google Analytics cookies, set solely if you accept them in the banner. Here is what is processed when you visit.
The data controller is Andrea Rovatti (Hemis.studio), based in Reggio Emilia, Italy. For anything on this page, write to info@hemis.studio.
Keeping the site secure and understanding in aggregate whether it works, on the legal basis of legitimate interest (Article 6(1)(f) GDPR); plus optional analytics that run only with your consent (Article 6(1)(a) GDPR).
If you email me, I process what you choose to send in order to reply (Article 6(1)(b) or (f) GDPR). Nothing more. Writing to me is your choice; if you do not, I have nothing to reply to. The technical logs above are collected automatically just by loading a page, as on any website.
Hosting and cookieless analytics run on Vercel Inc., as a data processor under its Data Processing Agreement. If you consent, analytics also run through Google (Google Analytics 4), as a processor under Google's terms. No data is sold. There are no advertising or social-media trackers on this site.
Vercel is a US company, so the technical data above (mainly your IP address and server logs) is processed in the United States. These transfers rely on the EU-US Data Privacy Framework, under which the European Commission has decided the US offers adequate protection, and Vercel is certified. Where the Framework does not cover a transfer, Vercel falls back on the European Commission's Standard Contractual Clauses. The details are in Vercel's Data Processing Agreement (vercel.com/legal/dpa), and you can ask me for a copy of the safeguards at any time. Google LLC is also a US company: if you consent to Google Analytics, that data is processed in the United States under the same EU-US Data Privacy Framework, to which Google is certified. Adobe Inc. is a US company as well: the font requests described above are processed in the United States, again under the EU-US Data Privacy Framework, to which Adobe is certified (participant 5660). Adobe's terms are in its privacy policy (adobe.com/privacy/policy.html).
By default, none. Cookies are set only if you choose Accept in the banner, and those cookies (_ga and _ga_*) belong to Google Analytics. Your choice (accept or decline) is remembered in your browser's local storage under the key "hemis-consent", so the banner does not keep reappearing: that entry is a functional preference, not a tracker. To change your mind, use the Cookie link in the site footer and the banner will come back. There is no profiling, no advertising, and no automated decision-making.
Logs and cookieless analytics are short-lived and aggregate. Google Analytics data, if you consent, is retained for up to 14 months. Email correspondence is kept only as long as needed to handle your request.
Under the GDPR you can ask to access, correct, or delete your data, or to restrict or object to its processing. Write to info@hemis.studio. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it).