Privacy & cookies — Dario Baldi

This notice explains how personal data is processed when you visit dariobaldi.com, contact Dario or use the private Studio area. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 30 October 2026.

1. Controller and contact

The data controller is Dario Baldi. For questions about your data or to exercise your rights, email drbaldidario@gmail.com.

2. Browsing and security

To deliver pages, the server receives technical data such as your IP address, the date and time of a request, the resource requested, browser and device information and, where available, the referring page. This information may appear in the hosting provider’s technical logs. It is used to operate the site, diagnose faults and prevent abuse. The legal basis is the controller’s legitimate interest in running and securing the site (Article 6(1)(f) GDPR).

The site does not install behavioural advertising tools, marketing pixels or a visitor analytics service. Fonts are hosted on the site without requests to Google Fonts. Browser caches of images, fonts and other files improve loading speed and are not a profiling system.

3. Contact form and email

If you use the form, your name, email address and message are processed. They are needed to receive and handle your enquiry. You may choose not to submit them and continue browsing, but without them it is not possible to reply through the form. Please avoid including special-category data, such as health information, or unnecessary information about other people.

The message is sent to Dario’s Gmail inbox through the site’s mail service; the form does not create a message archive in the WordPress database. Direct emails are also handled in the controller’s correspondence. Your details are used to reply and for any related professional exchanges, without automatically subscribing you to newsletters or promotional communications.

For enquiries about commissions or collaborations, the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For other communications, it is the legitimate interest in handling incoming correspondence (point (f)). Applicable legal obligations rely on point (c). Marketing consent is not requested for these purposes.

The form uses spam checks and a temporary submission counter based on an identifier cryptographically derived from the IP address using a secret key. The counter expires 15 minutes after the last counted attempt; it contains neither your message nor your plain IP address. Hosting logs are separate from this mechanism.

4. Videos and external links

Video cover images are hosted on the site. An external player is loaded only when you press Play: Vimeo or YouTube is not embedded before then, so you can browse without activating it. Videos hosted directly on the site are delivered by the hosting provider.

When you request an external video, its provider receives the technical data needed for the connection, including IP address, browser information and referring page, and may use its own storage or cookies. Vimeo is requested with Do Not Track enabled; this limits tracking but may still allow essential cookies. YouTube uses youtube-nocookie.com in Privacy Enhanced Mode, which does not mean that Google processes no data. The site’s purpose is to deliver the audiovisual content you request, based on the legitimate interest in presenting the portfolio and responding to your choice to play it.

For providers’ purposes, retention, recipients and rights, see Vimeo’s privacy policy, Vimeo’s cookie policy, Google’s privacy policy and YouTube’s Privacy Enhanced Mode. Playing a video does not authorise the site to install marketing tools.

Instagram, Vimeo, IMDb and other external destinations are ordinary links, without embedded social widgets. If you open one, processing on the destination site is governed by its own notice.

5. Cookies and technical storage

The site does not set its own profiling cookies. Technical functions do not require prior consent, but are described here so you can make an informed choice.

WordPress and Studio login: cookies such as wordpress_test_cookie, wordpress_logged_in_* and wordpress_sec_* check cookie support and maintain authentication for authorised users. The test cookie is a session cookie; authentication duration depends on the login method. Studio magic-link login with “Remember me” keeps you signed in for 30 days, unless you log out, access is revoked or security checks intervene. The emailed link is single-use and expires after 15 minutes; it is not a cookie.
Administration preferences: wp-settings-* and wp-settings-time-* may store interface preferences for one year. They do not track visitors’ browsing.
Browser storage: WordPress may store an emoji display support check in browser session storage (wpEmojiSettingsSupports). It is not used to identify you or advertise to you.
External players: after Play, providers may use technical and security cookies, such as Vimeo’s cf_clearance or __cf_ob. Their names, presence and duration depend on the service and browser; details are in the provider policies linked above.

You can delete or block cookies and storage through browser settings and log out of Studio to end your session. Blocking technical cookies may prevent private access or some player functions. The current configuration has no consent banner for the site’s own marketing cookies because these tools are not installed.

6. Portfolio and private area

The portfolio displays images, excerpts and professional credits from project materials to document the controller’s artistic work. Already-public professional information is presented on the basis of the legitimate interest in describing completed work, subject to the rights of individuals and material owners. Contact Dario for correction, objection or removal requests concerning your personal data. Rights in the materials are addressed separately on the Rights and portfolio page.

Studio is restricted to authorised users. It processes account details, access information, drafts, uploaded files and revision history to manage and protect the site, based on the controller’s legitimate interest. There is no public registration. Only when an editor activates assistance tools may the editorial text and instructions or images needed for that operation be sent to OpenAI for writing, translation and image descriptions, or to fal for resolution enhancement. Contact-form messages are not automatically forwarded to these services. See OpenAI’s business terms and fal’s privacy policy.

7. Recipients and international transfers

Data may be processed by the controller, authorised maintenance personnel and providers needed to supply the service: Aruba for hosting and mail transport, Google for the Gmail inbox, video providers when you activate playback, and the editorial services described above when used in the private area. Data may also be disclosed to authorities where required by law. Contact messages are neither published nor sold.

Google, Vimeo, OpenAI and fal services may involve processing outside the European Economic Area, including in the United States. Applicable terms and safeguards declared by providers are available in their respective notices and terms. Google describes its mechanisms, including adequacy decisions and standard contractual clauses where applicable, on its data transfer page. You can ask the controller for information about safeguards relevant to your data. This notice does not claim that all data remains within the European Union. For hosting information, see Aruba’s privacy notice.

8. Retention

Messages and contact details are retained for as long as needed to handle the enquiry and related professional exchanges, taking into account whether the conversation has ended, the need to document agreements, applicable obligations and the protection of rights. Closed conversations should be reviewed periodically to remove those no longer needed. A single retention period is not set for enquiries of different kinds.

Technical and security data is retained to the extent needed to operate the service and handle incidents, taking account of providers’ technical retention cycles and applicable obligations. The form counter and sessions have the expiry rules described above. Studio accounts, drafts, history and the media archive are retained while needed for editorial management and recovery. Backups follow the retention and replacement cycle of the system holding them; deletion may therefore require completion of that cycle, without routine reuse of deleted data.

9. Your rights

Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Email drbaldidario@gmail.com; proportionate identity verification may be requested. A response is normally provided within one month, subject to the justified extensions allowed by law.

You may complain to the Italian Data Protection Authority or your competent supervisory authority. The site does not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

This notice will be updated when services or processing practices change. The date at the beginning identifies this version.