Data controller
The data controller is Andrea Marcellan, trading as Liuteria Marcellan, VAT No. 04355070287, with operating address at Via Beato Luigi Guanella 2A, Padua, Italy. The controller can be contacted through the Contact page or by post at the address above.
Data processed
The website processes data voluntarily provided by users, such as name, email address, optional telephone number, message content and information about an instrument. Technical providers making the website available may also process navigation and technical log data, such as IP address, user agent, date and time of a request, where necessary for security and service delivery.
Purposes and legal bases
Data submitted through the form is used to answer enquiries, provide preliminary assessments, prepare quotations and manage any pre-contractual or contractual relationship. The legal basis is taking steps at the data subject’s request before entering into a contract or performing a contract (Art. 6(1)(b) GDPR). For communications not directly related to a contract, processing may rely on the controller’s legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). Optional processing such as Analytics and external content is based on consent (Art. 6(1)(a) GDPR and applicable rules on cookies and tracking technologies). Administrative, tax and legal obligations rely on compliance with a legal obligation (Art. 6(1)(c) GDPR).
Retention
Enquiries that do not lead to a professional relationship are normally retained for no longer than 24 months after the conversation is closed, unless longer retention is necessary to establish, exercise or defend a legal claim. Where a contractual relationship arises, data required for administrative, accounting, tax and legal purposes may be retained for the periods required by law, normally up to 10 years after the relationship ends, subject to longer periods required by litigation or applicable law.
Providers and external services
Hosting. The website is published through GitHub Pages. The hosting provider may process technical logs and connection data required for website security, availability and delivery. See GitHub’s privacy statement.
The contact form does not send data to an external form service: completing it prepares a new message in the user’s email application. Data is transmitted only when the user chooses to send the email.
Google Analytics 4. Google Analytics 4 (measurement ID G-D0XZLH5S90) is loaded only after consent to the Analytics category. The website uses Google Consent Mode in “basic” configuration: before consent, the Analytics tag is not loaded and no Analytics request is sent to Google. Advertising features and ad-personalisation signals are disabled. Once Analytics is authorised, Google may set first-party cookies and process technical information about the visit. See Google’s privacy policy.
Google Maps. The embedded map remains blocked until consent to the “External content” category. The separate “Open in Google Maps” link transfers data to Google only if the user chooses to follow it.
Google Fonts and YouTube preview images. To render the site typography, stylesheets and font files are requested from Google servers. Some video cards also use preview images served from YouTube’s image domain. These technical requests may transmit data such as the IP address, browser and connection information to Google. The resources are used for presentation and content previews and do not embed the YouTube player in the page. Google’s processing is described in the privacy notice linked above.
WhatsApp and social links. WhatsApp buttons and links to YouTube, Facebook, Instagram and Engine of Creation are ordinary outbound links; no social content is embedded in the page. Those providers receive data only when the user chooses to open the link or app.
Transfers outside the EEA
Some providers may process data in countries outside the European Economic Area. Where this occurs, transfers rely on mechanisms permitted by the GDPR and identified by the relevant provider, such as adequacy decisions, participation in the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.
Recipients
Data may be processed by the controller and by technical providers necessary to deliver the website, receive messages, perform authorised statistical measurement and provide content requested by users. Data may also be disclosed to professional advisers or public authorities where required by law or necessary to protect legal rights. Personal data is not sold.
Data-subject rights
Where the conditions of Arts. 15–22 GDPR are met, data subjects may request access, rectification, erasure, restriction, portability and object to processing. Where processing relies on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Requests can be submitted through the Contact page.
Complaint
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority or, where applicable, the competent supervisory authority in their Member State.
Whether providing data is mandatory
Providing fields marked as required in the contact form is necessary for the controller to answer the enquiry. Optional data may be omitted. Consent to Analytics and external content is always optional and refusing it does not prevent use of the website’s essential functions.
Changes
This notice may be updated to reflect technical, organisational or regulatory changes. The latest revision date is shown at the top of the page.