Last updated: 28 October 2026

This notice explains how personal data is processed when you visit www.vincenzoportuese.com or write to us through the contact form, under Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.

1. Data controller

Vincenzo Portuese, Via Degli Ulivi 9/A, 95037 San Giovanni la Punta (CT), Italy.
For any privacy request: webmaster@vincenzoportuese.com

2. What data we collect

  • Browsing data. The server hosting the site automatically records some technical data: IP address, browser, operating system, pages requested, date and time. It is needed to run the site and keep it secure.
  • Data sent through the contact form. Name, email address, the text of your message and, where given, the artwork you are asking about.
  • Cookies. The site uses technical cookies and, only with your consent, other cookies. Details are in the Cookie Policy.

3. Why we process it and on what legal basis

  • To answer your questions about the artworks and, if you wish, arrange a purchase: pre-contractual and contractual steps taken at your request (Art. 6(1)(b) GDPR).
  • To protect the site from misuse, spam and cyber attacks: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
  • To meet legal obligations, such as tax and accounting rules if a sale takes place (Art. 6(1)(c) GDPR).

Artworks are sold on request only: there are no online payments on this site and we do not collect card or bank details.

We do not profile visitors, send newsletters or marketing messages, or make automated decisions.

4. Providing your data

Writing to us is optional. Without your name, email and message, however, we cannot reply.

5. How long we keep it

  • Contact form messages: as long as needed to handle your request, and no longer than 24 months after the last contact. A technical copy of the email sent by the site stays in the site’s log for 14 days and is then deleted automatically.
  • If a sale takes place: tax and accounting records for 10 years, as required by Italian law (Art. 2220 of the Civil Code).
  • Browsing data and security logs: only as long as strictly necessary, according to the technical settings of the hosting provider and the security system.
  • Site backups: kept on a rotating basis; older copies are replaced by newer ones.

6. Who processes data on our behalf

Besides the controller, data is processed only by the following providers, appointed as processors (Art. 28 GDPR) and only for the service stated:

  • Aruba S.p.A. (Italy): website hosting and email.
  • Google Ireland Ltd.: storage of site backups on Google Drive.
  • Defiant Inc. (Wordfence, United States): protection of the site from attacks, including checking IP addresses against its own services.

Data is never sold or passed to third parties for marketing. It may be disclosed to public authorities only where the law requires it.

7. Transfers outside the European Union

Some providers (Google, Defiant) may process data in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for participating companies, or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

8. Your rights

You can ask at any time to access, correct or erase your data, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest (Arts. 15–22 GDPR). Write to webmaster@vincenzoportuese.com: we reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live.

9. Children

The contact form is not intended for children under 14.

10. Changes

This notice may be updated. The date of the latest change is shown at the top.