Privacy Policy (complete)

This page explains which personal data is processed when you visit blog.daniil.it (“this blog”) or subscribe to its newsletter, how and why it is processed, and what rights you have, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”).

In short: this blog does not use analytics, advertising or profiling, comments are disabled, and the only form is the newsletter subscription. Personal data is processed to deliver and protect the blog, and to send the newsletter to those who subscribe to it.

Data controller

Daniil Gentili (VAT 01647560299), Viale Domenico Angeli, 97 - 45100 Rovigo (RO), Italy.
Email: daniil@daniil.it

Types of data processed

Browsing data (also called usage data): IP address, requested URL, date and time of the request, HTTP method and response code, size of the response, referring page, browser and operating system (user agent), and approximate location derived from the IP address;
Newsletter subscription data: email address, optional name, subscription status, date of subscription and of later changes, and the IP address used to subscribe or confirm the subscription;
Newsletter statistics: how many times each newsletter email is opened and each of its links is clicked, counted in total and not linked to individual subscribers;
Data you provide when contacting the controller directly, and the content of your messages.

Only the email address is required to subscribe to the newsletter. If you share personal data of other people through this blog, you are responsible for having the right to do so.

Purposes, legal bases and services used

Delivering and protecting the blog (hosting, traffic distribution and system logs)

When you open a page your browser sends the browsing data listed above to the servers delivering it:

Cloudflare (Cloudflare, Inc., United States): Cloudflare hosts the blog (Cloudflare Pages), and all traffic passes through Cloudflare, which acts as a reverse proxy, content delivery network and protection against attacks and abuse (for instance, by blocking malicious requests or asking suspicious visitors to complete a security check). Cloudflare also provides the controller with aggregated traffic statistics that do not identify individual visitors, and may set strictly necessary security cookies, described in the cookie policy. Privacy policy.
The controller’s own server, located in Italy, runs the newsletter (newsletter.daniil.it) and its database. Its web server records each request to the newsletter (IP address, requested page without query parameters or subscriber identifiers, date and time, browser and response code) in logs that are kept for up to 90 days.

The controller does not use browsing data to identify or profile visitors; it is only used to operate the blog and to investigate attacks or abuse.

Legal basis: the controller’s legitimate interest in delivering a fast, secure and available blog (Art. 6(1)(f) GDPR).

You can subscribe to the newsletter with the form at the end of each post or on the newsletter page, by entering your email address (and, optionally, your name) and accepting this privacy policy. The form is sent to the newsletter software on the controller’s own server (newsletter.daniil.it). To keep automated subscriptions out, the form uses Cloudflare Turnstile (Cloudflare, Inc., United States), which checks that the form is sent by a person using signals from your browser, such as its IP address and characteristics, without cookies; Cloudflare processes this data under its privacy policy. Legal basis: the controller’s legitimate interest in protecting the newsletter from abuse (Art. 6(1)(f) GDPR). You then receive an email asking you to confirm the subscription: newsletters are only sent to confirmed addresses.

The subscription list is managed by newsletter software (listmonk) running on the controller’s own server: no newsletter service provider receives it. The emails are sent from news@daniil.it through Zoho Mail (Zoho Corporation, United States data center), which processes the recipients’ addresses and the content of the emails in order to deliver them. Privacy policy.

Each newsletter email contains a small invisible image and links that pass through newsletter.daniil.it, which count how many times the email is opened and each link is clicked; these counts are not linked to individual subscribers. The controller uses them to understand which content interests the readers. Every email contains a link to unsubscribe and to manage your subscription, where you can also export or erase your data. Links in newsletters sent before November 2026 pass through this blog and newsletter.daniil.it, which redirect them without recording anything beyond the web server logs described above.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 130 Privacy Code), given when you subscribe and confirm, which you can withdraw at any time by unsubscribing, without affecting the lawfulness of the processing carried out before. Your data is never used for any purpose other than sending you the newsletter, and is never shared with others for their own purposes.

Direct contacts

If you write to the controller by email, by replying to a newsletter, or through the Telegram, Instagram or X links on this blog or in the newsletter, the controller processes your contact details and the content of your messages in order to reply. Legal basis: the controller’s legitimate interest in replying to the messages it receives (Art. 6(1)(f) GDPR). Those services are operated by third parties under their own privacy policies; this blog only links to them.

Methods of processing and security

Personal data is processed with IT tools, following procedures strictly related to the purposes described above, and the controller takes appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of the data. Besides the controller, data may be accessed by the service providers listed in this policy, which act as data processors or as independent controllers. Personal data is not sold, and is not disclosed to third parties for their own marketing purposes. An up-to-date list of the providers involved can be requested from the controller at any time.

Place of processing and transfers outside the EU

Data is processed on the controller’s server in Italy and wherever the providers listed above are located. Cloudflare operates a globally distributed network, so it is not possible to determine in advance which of its servers handles a given request. Since Cloudflare and Zoho may process data in the United States, data may be transferred outside the European Economic Area. These transfers rely on the EU-U.S. Data Privacy Framework for providers certified under it and, otherwise, on the Standard Contractual Clauses adopted by the European Commission (Articles 45 and 46 GDPR). You can ask the controller for information on the legal basis of these transfers and on the safeguards adopted.

Retention

Web server logs: up to 90 days. Cloudflare retains its own logs for the limited periods set out in its privacy policy.
Newsletter: your subscription data and statistics are kept until you unsubscribe. After that, your address is kept marked as unsubscribed, so that you are not sent newsletters again by mistake; you can ask for it to be erased completely. Subscriptions that are never confirmed receive no newsletter, and are erased on request.
Messages sent to the controller: kept for as long as needed to reply and to handle any follow-up, and then deleted, unless longer retention is required by law.
Data may be kept longer when required by a legal obligation or by an order of a public authority, or to establish, exercise or defend legal claims.

Once the retention period expires, personal data is deleted: after that, the rights of access, erasure, rectification and portability can no longer be exercised.

Cookies

This blog sets no cookies of its own, and uses no analytics or advertising cookies; Cloudflare may set strictly necessary security cookies. See the cookie policy for details.

Automated decisions

No automated decision-making or profiling is carried out.

Your rights

To the extent provided by the GDPR (Articles 15-22), you have the right to:

withdraw your consent at any time, by unsubscribing from the newsletter, without affecting the lawfulness of the processing carried out before;
access your personal data, and obtain a copy of it and information on how it is processed;
have inaccurate data rectified and incomplete data completed;
have your data erased;
restrict the processing of your data, so that it is only stored;
receive your data in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability): the subscription page linked in every newsletter lets you export it directly;
object at any time, on grounds relating to your particular situation, to processing based on legitimate interest; this blog does not process data for direct marketing purposes other than the newsletter you subscribe to;
lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali, or the authority of the EU country where you live, work, or where the alleged infringement took place.

To exercise your rights, write to daniil@daniil.it. Requests are free of charge and are answered as soon as possible, and in any case within one month (extendable by two further months for complex requests, in which case you will be informed). Any rectification, erasure or restriction is communicated to each recipient the data was disclosed to, unless this proves impossible or involves disproportionate effort; on request, the controller will tell you who these recipients are.

Legal action and requests from authorities

Personal data may be used by the controller to establish, exercise or defend legal claims, including in court, arising from improper use of this blog. The controller may be required to disclose personal data upon request of public authorities.

Further information

More details on the processing of personal data, including information not contained in this policy, can be requested from the controller at any time using the contact details above.

Links to other websites

This blog links to other websites (such as GitHub, Telegram, Instagram and X), which have their own privacy policies.

Changes to this policy

This policy may be updated, for instance when the blog or the services it uses change. Changes are published on this page, and the date of the latest update is shown below: please check it from time to time. If a change concerns processing based on consent, the controller will ask for new consent where required.

Definitions

Personal data: any information relating to an identified or identifiable natural person.
Browsing data (usage data): the technical information automatically collected when a page is requested, listed above.
Data subject (user): the natural person the personal data refers to, i.e. you.
Data controller: the person who determines the purposes and means of the processing, i.e. Daniil Gentili.
Data processor: a person or organization processing personal data on behalf of the controller.
Cookie: a small piece of data stored by the browser; more generally, a tracker is any technology that stores or reads information on the user’s device.
European Union (EU): unless otherwise specified, references to the EU include all member states of the European Economic Area.

Latest update: November 10, 2026

Show the privacy policy overview »