Privacy policy

Data controller

The controller is [nome o ragione sociale del titolare], [indirizzo completo] ([P. IVA / codice fiscale, se applicabile]). Any request concerning this notice, including the exercise of the rights under articles 15 to 22 of the Regulation, may be addressed to [indirizzo email di contatto].

No Data Protection Officer has been designated. The conditions in article 37 of the Regulation are not met: the site carries out no large-scale systematic monitoring and processes no special categories of personal data.

Absence of analytics, advertising and cookies

This site sets no cookies, loads no analytics tag and carries no advertising. There is accordingly no consent to be given and no consent banner, because nothing here requires one.

This is a design decision and it is verifiable. In the network tab of the browser developer tools the only requests are for the page and its own assets: nothing is requested from googletagmanager.com, from an advertising network or from any content delivery network. Fonts are compiled into the site at build time rather than fetched at run time.

Should an analytics tag or advertising ever be added, each would require consent obtained in advance, and this notice would be amended to identify the recipient and the data collected before the first request was made.

Data entered into the tools

Data entered into the tools does not leave the user device. Each calculator, formatter, converter and generator on this site is JavaScript executed in the browser tab. The site consists solely of static files and has no server component that receives such data.

This is verifiable in the same way. No request follows the loading of the page, and the tools remain operative with the connection closed.

• Pay figures amounts entered into the salary calculators are values held in memory. They are not recorded, stored or transmitted.
• Documents and text JSON, CSV, XML and SQL content pasted into a formatter is parsed in memory and discarded when the tab is closed.
• Files opened by the user these are read through the browser FileReader interface, directly from the device. No upload to a server takes place.
• Generated passwords these are produced by the cryptographic random number generator of the browser. They are not transmitted and cannot be reconstructed by any party, the controller included.

Data stored on the user device

One entry is held in the local storage of the browser. It is not a cookie and it is not transmitted to any server. It persists until browsing data is cleared.

• toooly.theme the light or dark setting, written only where the user has operated the switch. It performs the function the user has requested and is therefore not subject to consent under the second exemption in article 5(3) of the ePrivacy Directive.
• No further data no identifier, profile or history of the tools used is stored. The controller can neither read this entry nor delete it.

Data collected by the hosting infrastructure

The site is served by Cloudflare, Inc. As with any web server, the infrastructure receives the technical data of which an HTTP request consists: IP address, resource requested, user-agent string, date and time, and referring page. This cannot be disabled, being the technical precondition for delivering the page, and it is the only personal data the operation of this site involves.

Cloudflare retains request logs for a limited period for the purpose of defending against attacks and abuse. The legal basis is the legitimate interest of the controller in the availability and security of the site, under article 6(1)(f) of the Regulation. The logs are not used for profiling, are not associated with data entered into the tools and are not consulted by the controller in the ordinary course.

A request to the domain without a language prefix results in a redirect to the Italian or English version of the site, based on the two-letter country code supplied by Cloudflare. The code is used for that redirect alone and is not retained.

Measurement of the site in search results

The controller uses Google Search Console, which is not a web analytics tool and is the only measurement this site carries out. Search Console reports data recorded by Google concerning searches carried out on google.com in which a page of this site appeared. The measurement takes place on the Google results page, not on the pages of this site.

The service involves no installation of any kind on the user device. Ownership of the domain is demonstrated by a DNS record, which does not pass through the browser, or by a google-site-verification meta tag, an inert HTML element that loads no script, generates no request and stores no data.

The data made available is aggregate: search term, the number of times a page of the site appeared for it, the number of clicks and the average position. Google withholds infrequent search terms in order to prevent the identification of individual users. No IP address, identifier or data attributable to an individual visitor is visible.

The purpose is editorial alone: determining what content to produce and what to correct.

Recipients of personal data

Personal data is not sold, exchanged or disclosed to data brokers. The recipients are as follows.

• Cloudflare, Inc. hosting and content delivery. It processes the technical request data described above as processor. It is the only processor of personal data engaged by this site.
• Google Ireland Limited in relation to Search Console alone, and not as a processor: it returns its own aggregate search data to the controller rather than processing data acquired from a visit to this site.
• Public authorities solely where a legal obligation exists and within the limits it sets.

Rights of the data subject

The data subject has the right to obtain confirmation of the processing of personal data concerning them and a copy of that data (article 15), rectification (article 16), erasure (article 17), restriction of processing (article 18), portability (article 20) and to object to processing based on legitimate interest (article 21).

These rights may be exercised by writing to [indirizzo email di contatto]. A reply will be provided within one month, as article 12(3) requires.

Given that the site holds almost no data relating to the user, a request for access will ordinarily be answered by a statement to that effect. Request logs are held briefly by Cloudflare and are not indexed by person. There is no account, profile or history to supply.

A complaint may be lodged with the supervisory authority. In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garante@gpdp.it.

Legal bases for processing

The legal bases for the processing carried out are set out below, as article 13(1)(c) of the Regulation requires. There are two, and consent is not among them, no processing on this site resting on it.

• Delivery of the page requested performance of a contract, article 6(1)(b). The request data is the technical precondition for delivery.
• Availability and security of the site legitimate interest, article 6(1)(f). The interest pursued is a functioning service; the data processed is the request log; no profiling is carried out and the right to object under article 21 may be exercised.
• No further bases no consent, no vital interests, no task carried out in the public interest and no legal obligation beyond compliance with a lawful order of a competent authority.

Retention periods

The retention periods, or the criteria for determining them, are set out below as article 13(2)(a) of the Regulation requires.

• Data entered into a tool until the tab is closed. It is never written to disk and never leaves the browser.
• The theme setting in the browser of the user until browsing data is cleared. The controller can neither read nor delete it.
• Server request logs retained by Cloudflare for a short operational period, in the order of days, under its own retention policy. They are not copied to any system under the control of the controller.
• Correspondence an email concerning the exercise of rights is retained for the period necessary to answer it and to demonstrate that it was answered, and is then deleted.

Transfers to third countries

Cloudflare serves the site from a data centre near the user, ordinarily within the European Union, but is a company established in the United States and subject to United States law, so part of the processing takes place outside the European Economic Area.

Chapter V of the Regulation permits this only where a transfer mechanism is in place. Cloudflare is certified under the EU-US Data Privacy Framework and its standard contractual clauses apply in addition.

No other transfer takes place. With no analytics tag and no advertising, the only data leaving the browser is the request itself, which must reach a server in order for a page to be delivered.

Security measures

Article 32 of the Regulation requires measures appropriate to the risk. The principal measure here is structural: a site that holds no personal data cannot disclose it. There is no database, no user account, no password and no upload directory.

• Transport encryption the connection is encrypted throughout and HTTP requests are redirected. Nothing is served in clear text.
• No personal data at rest the site consists of static files. There is no store that could be queried, extracted or held to ransom.
• No third-party code at run time no analytics tag, no tag manager, no chat widget, no advertising script and no font or script loaded from a content delivery network. Every asset the page requests is served from this domain.

Personal data breaches

Where a breach occurs that is likely to result in a risk to the rights and freedoms of the data subject, article 33 of the Regulation requires notification to the Garante within 72 hours of the controller becoming aware of it, and article 34 requires direct communication to the persons concerned where the risk is high.

A breach could not concern data entered into the tools, which never reaches the controller. It could at most concern a window of request logs held by Cloudflare. The communication would identify what was affected.

Nature of the provision of data

The provision of personal data is not obligatory, and article 13(2)(e) of the Regulation requires that to be stated. There is no form to complete, no account to create and no mandatory field anywhere on the site.

The technical data of the request is unavoidable in the sense that no web page can be delivered without it. It is the only personal data the use of this site involves, and there is nothing else to decline.

Minors and automated decision-making

The site is not directed at minors and requests personal data from no one, of any age. No tool requires an account or an identity.

No automated decision-making and no profiling within the meaning of article 22 of the Regulation is carried out.

Amendments to this notice

This notice was last amended on 2026-10-18. Where an amendment affects the data collected or the recipients of that data, the notice will say so, and any processing requiring consent would be introduced only after that consent had been obtained.