Version 1.3 — last updated: 25 September 2026
1. Who we are
This Privacy Policy explains how personal data are processed when you visit www.ficss.institute (the “Site”). It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
Data controller: Stefano Angeli, Corso Lodi 50, 20139 Milano, Italy.
Contact for privacy matters: info@ficss.institute
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
2. What data we collect, why, and on what legal basis
2.1 Browsing data (server and security logs)
When you visit the Site, the web server automatically records technical data such as your IP address, the date and time of the request, the page requested, the referring page, your browser type and operating system. We use these data to deliver the Site, keep it secure and fix technical problems.
Our security plugin also records the IP address of failed login attempts and of requests that look malicious, so that it can block them. These data are processed on our own server and are not shared with third parties.
Legal basis: our legitimate interest in running a secure and working website (Art. 6(1)(f) GDPR).
Retention: server logs are kept for the period set by our hosting provider for technical and security purposes; security logs are kept for no more than 30 days, unless needed to investigate an incident.
2.2 Contact form and email
If you write to us through the contact form or by email, we process the data you give us: first name, last name, email address, subject, message, and any other information you choose to include. We use them only to read and answer your message.
Form messages are not stored in the Site database. They are delivered to our mailbox (info@ficss.institute) through a transactional email service (see Section 4).
Legal basis: steps taken at your request and our legitimate interest in answering correspondence (Art. 6(1)(b) and (f) GDPR).
Retention: messages are kept for as long as needed to handle your request and then for up to 24 months, after which they are deleted, unless a longer period is required by law.
Please do not send special categories of data (e.g. health data) through the form.
2.3 Google Analytics (only with your consent)
If you accept “Statistics” cookies in our cookie banner, we use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors use the Site (pages viewed, time on page, approximate location, device and browser, links clicked, files downloaded). Google Analytics 4 does not log or store IP addresses. We do not use Google Signals or any advertising feature. Data are kept by Google for 2 months.
Until you accept, the Google Analytics code is not loaded at all: no data are sent to Google and no analytics cookies are set.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can withdraw it at any time through the cookie settings, without affecting the lawfulness of processing carried out before.
More information: Google Privacy Policy.
2.4 Cookies
We use technical cookies, which are needed for the Site to work and to remember your cookie choices, and — only with your consent — statistics cookies. We do not use marketing or profiling cookies. The full list, with purpose and duration of each cookie, is in our Cookie Policy. You can change your choices at any time with the cookie settings button at the bottom left of every page.
2.5 Links to other websites
The Site links to external platforms (for example Substack, GitHub, Zenodo, ORCID, DOI, LinkedIn, X, Bluesky and OpenStreetMap). These are plain links: no data are shared with those platforms unless you click on them. Once you are on their sites, their own privacy policies apply.
3. Is providing data mandatory?
Browsing data are collected automatically. Providing your name, email address and message is needed to send a message through the contact form; if you do not provide them, we cannot answer you. Consent to statistics cookies is optional: refusing it has no effect on your use of the Site.
4. Who receives your data
Your data are handled by the controller and, on its behalf, by the following providers acting as data processors under Article 28 GDPR:
| Provider | Service | Location |
|---|---|---|
| Aruba S.p.A. | Website hosting, server logs, cache | Italy (EU) |
| Google Ireland Ltd. / Google LLC | Google Analytics (only with consent) | Ireland / USA |
| Brevo (Sendinblue SAS) | Delivery of emails sent by the Site, including contact-form messages | France (EU) |
| Aruba S.p.A. | Email mailboxes for the ficss.institute domain | Italy (EU) |
We do not sell your data and we do not share them for advertising. Data may also be disclosed to public authorities where required by law.
5. Transfers outside the European Economic Area
If you consent to Google Analytics, data may be transferred to Google LLC in the United States. The transfer takes place on the basis of the European Commission adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified (Art. 45 GDPR).
6. Security
We protect your data with appropriate technical and organisational measures, including an encrypted connection (HTTPS), protection of the login area against unauthorised access and regular software updates.
7. Your rights
Under Articles 15–22 GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict processing;
- receive your data in a portable format;
- object at any time to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing carried out before.
To exercise your rights, write to info@ficss.institute. We will reply within one month.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the EU country where you live or work.
8. Automated decisions and minors
We do not make decisions based solely on automated processing, including profiling. The Site is not directed at children under 14, and we do not knowingly collect their data.
9. Changes to this policy
We may update this Privacy Policy when the Site or the law changes. The current version and its date are always shown at the top of this page.