---
title: "Privacy policy"
description: "How atanasiu.me handles personal data: what is collected, on what legal basis, who processes it, and how to exercise your GDPR rights."
url: https://atanasiu.me/privacy-policy
language: en
updated: 2026-10-26
---

# Privacy policy

*Last updated: October 26, 2026*

This policy explains what happens to personal data when you visit `atanasiu.me`. It is written under
Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended (Codice Privacy).

## 1. Who is responsible

The data controller is Doinel Atanasiu, VAT number IT 03947550541.

For anything concerning this policy or your data, the channel I prefer is the certified address
(PEC) [atanasiu@pec.it](mailto:atanasiu@pec.it). For general contact you can also write to

[doinel@atanasiu.me](mailto:doinel@atanasiu.me).

No Data Protection Officer has been appointed: the processing described below is limited in scope
and does not meet the conditions of Article 37 GDPR.

## 2. What this site does not do

- No user accounts, no login, no comment section.
- No advertising, no ad networks, no retargeting pixels.
- No profiling cookies, and no cross-site or cross-device tracking on my part. The one service to
  be aware of is Microsoft Clarity (3.4): it runs only if you accept it, and Microsoft may use what it
  collects for its own purposes, advertising included.
- No sale or disclosure of personal data to data brokers.
- No automated decision-making producing legal or similarly significant effects (Article 22 GDPR).
- No third-party fonts or embedded widgets: fonts are served from this domain, so no request is made
  to Google Fonts or similar services while you read a page.

## 3. Data processed

### 3.1 Technical logs

The site is hosted on Vercel, and every request reaches it through Cloudflare's network, which sits
between your browser and Vercel. Like any web server, both infrastructures record the data needed
to serve a request: IP address, browser user agent, requested URL, referrer and timestamp, to which
Cloudflare adds the country the request comes from.

Microsoft Clarity receives from Cloudflare the traffic statistics derived from these logs and uses
them to tell automated traffic, such as search engine and AI assistant crawlers, apart from human
visitors. Neither Microsoft nor Cloudflare documents which fields are read, so I assume the worst
case: for every request, yours included, Microsoft may obtain the same data as the logs, namely IP
address, user agent, URL, referrer, timestamp and country. It accesses them through a token I
created on Cloudflare: the token can read the domain's configuration and statistics and configure
log export (Logpush), but no log export is active. This flow does not depend on the choice you make
in the consent banner (3.4): it concerns every request, including those of visitors who decline
Clarity and those from bots. Under the Clarity terms, Microsoft receives these statistics as an
independent controller and may use them for its own purposes too, advertising included, as
described in 3.4. What I see of this data is aggregate bot data only: which bots visit the site, how
often, and which pages they request.

- **Purpose**: delivering the site, keeping it secure, diagnosing errors and abuse, and knowing
  which bots and AI crawlers read its content.
- **Legal basis**: legitimate interest in the security and correct operation of my own site and in
  knowing how automated systems collect its content (Article 6(1)(f) GDPR). For Microsoft reading
  the statistics, I have carried out a legitimate interest assessment, a copy of which you can ask
  me for.
- **Objection**: I have no way to exclude only your requests from the flow to Microsoft. If you
  object and your objection prevails, I stop the Clarity integration for everyone (section 8).
- **Retention**: the Vercel runtime logs I can consult cover the last hour only; Vercel keeps its
  own platform logs under its [privacy notice](https://vercel.com/legal/privacy-policy). I have no
  access to Cloudflare's raw logs, which it processes for as long as it needs to deliver and
  protect the site. The statistics Clarity reads follow Microsoft's retention periods. I do not use
  these logs to identify individual visitors.

### 3.2 Audience measurement

I use Umami, hosted by its vendor in its European region, to know which pages are read and where
readers come from. It is a cookieless tool: it does not write anything to your device. To tell
visits apart, Umami computes a pseudonymous identifier from your IP address, your browser's user
agent and a salt that changes every month: throughout a calendar month the same browser on the same
network gets the same identifier, which from the following month can no longer be linked to new
ones. The IP address is used only for this calculation and to derive an approximate origin, and is
not stored. Every data point carries the address and title of the page visited, including any URL
parameters (such as those of a campaign), the referrer, the approximate origin (country, region and
city), and the device, operating system, browser, screen size and language. Umami also records a few events when you use the
contact, download and service links (a click on the WhatsApp, LinkedIn, GitHub or email link,
copying the email address, opening the CV, following a link to a service page), each with the page
and language it happened on. The reports I see are aggregate figures only: there is no way for me
to trace a session back to a person, and no data is shared across sites.

- **Purpose**: understanding which content is useful, in aggregate.
- **Legal basis**: legitimate interest in measuring the audience of my own site
  (Article 6(1)(f) GDPR). Umami's script has your browser send some information about your device,
  such as screen size and language, which falls under Article 122 of the Codice Privacy. I don't ask
  for your consent because I consider that Umami meets in substance the conditions under which the
  Garante treats analytics tools like technical ones
  ([Guidelines on cookies and other tracking tools](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876),
  section 7.2): the data only produces aggregate statistics for this site, Umami, as processor,
  neither combines it with other processing nor passes it to third parties, and nothing is written
  to your device. The Garante also asks that the identifier must not single out an individual user,
  usually by masking at least the last part of the IP address. Umami instead computes the
  identifier from the full IP address, but it does not store the IP and changes the salt every
  month, so the identifier tells a browser on a network apart only within a month. This is my own
  assessment: if you disagree, you can object as described in section 8. The script also checks whether a `umami.disabled` key is present in
  local storage, an opt-out switch it never writes itself and that never leaves your device.
- **Retention**: the data stays in my Umami account for 6 months, the retention period of the plan
  I use.

### 3.3 Performance measurement

I also use Vercel Speed Insights, which measures how quickly pages actually render for the people
reading them (the Core Web Vitals). It writes nothing to your device either: its script reads the
page's loading metrics and the connection type from your browser and sends them to Vercel. The
recording is anonymous, so it can neither reconstruct a browsing session
across pages nor identify anyone. Each measurement carries the route and URL, the connection speed,
the browser, device type and operating system, the country, the metric itself and the page element
it refers to.

- **Purpose**: spotting and fixing the pages that render slowly.
- **Legal basis**: legitimate interest in the correct operation and quality of my own site
  (Article 6(1)(f) GDPR). Here too, having your browser send information falls under Article 122
  of the Codice Privacy, and here too I don't ask for your consent because the tool meets the
  Garante's conditions referred to in 3.2: no identifier, aggregate statistics for this site only,
  and Vercel, as processor, does not combine them with other processing.
- **Retention**: Vercel does not publish a retention period for these measurements; the dashboard
  available to me shows the last 24 hours or the last 7 days.

### 3.4 Session recording (Microsoft Clarity, only with your consent)

If you accept it in the banner shown on your first visit, I use Microsoft Clarity to see how
individual pages are used: clicks, scrolling, mouse movement, the page as it is displayed,
including its text, page views and the referrer, including whether a visit originates from a link
generated by an AI assistant such as ChatGPT, Perplexity or Copilot. Along with this data Clarity
receives your IP address, from which it derives your country, and some characteristics of your
device: model, operating system and its version, browser, language, time zone, screen resolution
and colour depth, number of processors, memory and touch support. Clarity also receives the same contact and download events described in 3.2, with the
page and language they happened on. If you decline, or until you choose, Clarity is not loaded at
all.

Even after you accept, Clarity writes no cookies: they are turned off for the project, and the site
tells Clarity not to use storage on your device for either analytics or advertising. Each page view
therefore becomes a separate recording, under an identifier that Clarity assigns to it. This site
has no forms, accounts or login, so there is no free-text input for Clarity to capture. If your
browser sends the Global Privacy Control (GPC) signal, Clarity records nothing even after you have
accepted it; the script is still downloaded from Microsoft's servers, which receive that request as
they would for any web resource.

Microsoft does not act on my behalf here. Under the
[Clarity terms](https://clarity.microsoft.com/terms), Microsoft and I are **independent
controllers** of this data, and Microsoft may use it for any purpose allowed by the
[Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement): to provide and
improve its products, to provide Microsoft Advertising, and to build user profiles, advertising
included. The site tells Clarity that advertising storage is denied, which according to Microsoft
means Clarity shares nothing with Microsoft Ads; what Microsoft does with the data beyond that is
governed by its own privacy statement, not by me. For collecting the data on the site and passing it
to Microsoft, which happen through the script I placed there, I remain responsible together with
Microsoft, as the Court of Justice of the EU has made clear (case C-40/17, Fashion ID).

- **Purpose**: understanding how the site's content and layout are actually used, in more detail
  than the aggregate figures in 3.2, and measuring how much traffic comes from AI assistants.
- **Legal basis**: your consent (Article 6(1)(a) GDPR and Article 122 of the Codice Privacy). You
  can withdraw it at any time from "Privacy preferences" at the bottom of every page: Clarity stops
  recording at once and the page reloads without it. What it had already recorded up to that
  moment, including your clicks in the preferences panel, is sent to Microsoft as the page reloads.
  Withdrawal does not affect the lawfulness of what was collected before. Your choice is asked for
  again after six months.
- **Retention**: recordings are kept for 30 days; those I mark as favourite or label, and a sample
  picked at random by Clarity, are kept for up to 9 months, as are heatmap and click data. Clarity
  deletes them
  automatically, backups included, once the period elapses.

### 3.5 Contacting me

If you write to me by email, through the address published on this site, or by message on WhatsApp
or LinkedIn, I process what you send: your name, your email address or phone number, and the
content of your message. The WhatsApp buttons open a chat with a pre-filled message naming the page
you came from, which you can edit or delete before sending.

- **Purpose**: replying to you and, where relevant, discussing a possible collaboration.
- **Legal basis**: for exchanges concerning a possible assignment, the performance of
  pre-contractual measures taken at your request (Article 6(1)(b) GDPR). For any other
  correspondence, legitimate interest in replying to those who write to me (Article 6(1)(f) GDPR).
- **Retention**: as long as the exchange is professionally relevant. Correspondence tied to an
  assignment is kept for the duration of the assignment and for the periods required by Italian tax
  and civil law.
- **Providing this data is optional**, but without at least an email address or a phone number I
  have no way to reply to you.

### 3.6 Downloading my CV

The CV published at `/cv` is a static PDF. Downloading it involves no form and no additional
collection beyond the technical logs described in 3.1.

## 4. Cookies and local storage

This site sets **no** cookies at all: no profiling, no marketing, no technical cookie either. Umami
(3.2) writes nothing to your device, and Microsoft Clarity (3.4) doesn't either, even once you have
accepted it. The banner you see on your first visit is not about cookies: it asks for your consent
to Clarity, because of what Microsoft may do with the data it collects.

The page's language follows the URL you open - English is the site's default - or the choice you
make with the switcher in the top right. That choice holds for the current visit only: it isn't
remembered from one visit to the next, since no cookie or other data is written to your device to
do that.

If you pick a colour theme (light, dark or system) with the toggle in the top right, that choice is
saved in your browser's local storage under the key `atanasiu.me-theme`, so it is kept from one visit to the
next. It stays on your device, is never sent to a server, and serves no analytical or advertising
purpose; you can remove it at any time by clearing this site's data in your browser.

Your answer to the banner is saved in local storage too, under the key `atanasiu.me-consent`, together with the date you gave it, so that the banner isn't shown
again on every page. It is kept for six months, after which the banner asks again. It stays on your
device and is never sent to a server; clearing this site's data in your browser removes it and
brings the banner back.

Apart from these two preferences, this site stores nothing on your device: no cookies, no session
storage, no IndexedDB, no fingerprinting of your browser. The hosting platform and Cloudflare may set strictly
technical cookies of their own where their security measures require it - bot mitigation,
verifying a suspicious request, or protection of a deployment - which serve no analytical or
advertising purpose.

## 5. Who else sees the data

These providers process data on my behalf, as data processors:

- **Vercel Inc.** - hosting, CDN and performance measurement. I use the free (Hobby) plan: Vercel's
  [Data Processing Addendum](https://vercel.com/legal/dpa) applies to the Pro and Enterprise plans,
  while for my plan the processing is governed by Vercel's
  [Terms of Service](https://vercel.com/legal/terms), which refer to the same addendum, and by its
  [privacy notice](https://vercel.com/legal/privacy-policy).
- **Cloudflare, Inc.** - content delivery and traffic protection, and the traffic statistics read
  by Microsoft Clarity, under a data processing agreement.
- **Umami Software, Inc.** - audience measurement (Umami), under a data processing agreement.
- **Google Ireland Limited** - Google Workspace, which hosts the mailbox that receives your
  messages.
- **Aruba PEC S.p.A.** - the certified email provider that operates the `pec.it` mailbox, if you
  write to me at the certified address.

These act as independent data controllers, under their own privacy policies:

- **Microsoft Ireland Operations Limited** - Microsoft Clarity: session recording and heatmaps,
  only if you accept them (3.4), and automated traffic analysis on the statistics read from
  Cloudflare (3.1). See the
  [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement).
- **WhatsApp Ireland Limited** - only if you choose to contact me on WhatsApp, for that exchange.
- **LinkedIn Ireland Unlimited Company** - only if you choose to contact me on LinkedIn, for that
  exchange.

Data may also be disclosed where required by law or by a legitimate request from a public authority.

## 6. Transfers outside the EEA

Four of the processors named above, and Microsoft as independent controller, are or rely on
companies established in the United States.

- **Vercel Inc.** is certified under the EU-US Data Privacy Framework, on which transfers to Vercel
  rest. Its Data Processing Addendum, which incorporates the Standard Contractual Clauses, applies
  to the Pro and Enterprise plans and not to the plan I use (section 5).
- **Cloudflare, Inc.** is certified under the EU-US Data Privacy Framework, and its
  [Data Processing Addendum](https://www.cloudflare.com/cloudflare-customer-dpa/) additionally
  incorporates the Standard Contractual Clauses.
- **Microsoft Clarity** is supplied to me by Microsoft Ireland Operations Limited, and Clarity data
  is stored in the Microsoft Azure cloud, including in the United States. According to the
  [Clarity FAQ](https://learn.microsoft.com/en-us/clarity/faq), the transfer from Microsoft Ireland
  Operations Limited to Microsoft Corporation rests on the Standard Contractual Clauses between the
  two companies. Microsoft Corporation is certified under the EU-US Data Privacy Framework but
  [states](https://learn.microsoft.com/en-us/compliance/regulatory/gdpr) that it does not rely on it
  for transfers from the EU.
- **Google Workspace** is supplied to me by Google Ireland Limited. Where data reaches Google LLC in
  the United States, the transfer rests on Google's
  [Cloud Data Processing Addendum](https://cloud.google.com/terms/data-processing-addendum), which
  incorporates the Standard Contractual Clauses, and on Google LLC's own certification under the
  EU-US Data Privacy Framework.
- **Umami Software, Inc.** is established in the United States. I have chosen its European region
  for data storage, but the service also relies on US
  [subprocessors](https://umami.is/subprocessors), including for CDN, hosting, logging and
  generative AI services.
  Transfers to the United States rest on the Standard Contractual Clauses incorporated in the
  vendor's [Data Processing Agreement](https://umami.is/dpa).

Data travels encrypted to all of these providers. The Cloudflare, Google and Umami addenda linked
above incorporate the Standard Contractual Clauses, and you may request a copy by writing to the certified address (PEC)
[atanasiu@pec.it](mailto:atanasiu@pec.it). The Data Privacy Framework certifications of Vercel,
Cloudflare and Google can be checked on the
[Data Privacy Framework list](https://www.dataprivacyframework.gov/list).

## 7. Security

Traffic is served exclusively over HTTPS with HSTS and passes through Cloudflare's network, which
filters attacks before they reach the site. The site sends a Content Security Policy that
restricts the origins a page may load code, styles, fonts and images from and, through the
`connect-src` directive, the origins it may send data to. It is accompanied by the usual protective
headers (`X-Content-Type-Options`, `Referrer-Policy`, `X-Frame-Options`, `Permissions-Policy`),
which limit what a page may do and how it may be embedded.

## 8. Your rights

Under Articles 15 to 21 GDPR you have the right to obtain access to your data, its rectification or
erasure, and the restriction of its processing. Portability (Article 20 GDPR) covers the exchanges
described in 3.5 that rest on pre-contractual measures and the session recordings in 3.4, which
rest on your consent; every other processing described in this policy rests on legitimate interest
and is not portable.

### Withdrawing consent

You can withdraw your consent to session recording (3.4) at any time from "Privacy preferences" at
the bottom of every page, as easily as you gave it (Article 7(3) GDPR). For the data Microsoft
processes as independent controller, you can also exercise your rights directly with Microsoft, as
described in its privacy statement.

### Right to object

Where the processing rests on legitimate interest - technical logs (3.1), audience measurement
(3.2), performance measurement (3.3) and ordinary correspondence (3.5) -
**you have the right to object to it at any time, on grounds relating to your particular
situation**, under Article 21 GDPR. A message is enough, and if I cannot demonstrate compelling
legitimate grounds that override your interests, the processing stops. For the traffic statistics
read by Microsoft (3.1), which I cannot limit to a single visitor, it stops by ending the
integration for everyone.

To exercise these rights, write to the certified address (PEC)
[atanasiu@pec.it](mailto:atanasiu@pec.it). I will reply
within one month, as required by Article 12(3) GDPR. Note that for technical logs and analytics I
hold no identifier that lets me link the data to you, so I may be unable to act on a request without
additional information that identifies the records concerned (Article 11 GDPR).

If you believe your data is processed unlawfully, you may lodge a complaint with the Italian
supervisory authority, the
[Garante per la protezione dei dati personali](https://www.garanteprivacy.it), or with the
supervisory authority of your country of residence, and you retain the right to a judicial remedy.

## 9. External links

Pages on this site link to third-party services - WhatsApp, LinkedIn, GitHub, Google Maps, and the sources cited in
articles and projects. Once you follow one of those links, that site's own privacy policy applies. I
have no control over, and no responsibility for, how those services process your data.

## 10. Minors

This site addresses a professional audience and is not directed at minors. I do not knowingly
collect data relating to anyone under the age of 14.

## 11. Changes to this policy

This policy may be updated as the site changes. The date shown at the top always reflects the
version in force, and any substantial change will be visible there.