Privacy notice
How this site handles personal data
Notice given under Article 13 of Regulation (EU) 2016/679 (GDPR) to visitors of andreacundari.com. Last updated: 17 August 2026.
1. What this site does not do
This site's own code sets no cookies of any kind. It uses no browser storage, no analytics or measurement tools, no forms, no social buttons, and it requests nothing from third-party servers: the typefaces and the single photograph are hosted on the same server as the pages. Verified on 17 August 2026: no response from the server carries a cookie.
One clarification, because this page has to be exact rather than merely reassuring: the Cloudflare network described in section 4 adds the standard network-error reporting headers to responses. If a request fails, the browser may send Cloudflare a technical report of that error without you clicking anything. It carries no browsing content and does not measure audience.
That is why there is no consent banner. There would be nothing to consent to, and asking for consent that serves no purpose would be dishonest.
2. Who is responsible
Data controller: Horizon Peak S.r.l.s., registered office at Via Aldo Moro 1, 87056 Santo Stefano di Rogliano (CS), Italy, tax code and VAT number 03962080788, represented by Andrea Cundari.
To exercise your rights or ask a question: andrea@andreacundari.com, or by certified email to horizonpeak@pec.it, the company's certified email address.
A second controller, for one specific part. The Italian version of this site also lists acundari@gmail.com and acundari@pec.it, which belong to the professional practice. For correspondence sent to those two addresses the controller is Andrea Cundari, Dottore Commercialista, registered with the ODCEC of Cosenza under no. 743/A, at the same address, and not the company. The distinction is not a formality: they are two different persons in law, with different professional obligations.
No Data Protection Officer has been appointed, because none of the cases listed in Article 37 of the Regulation applies.
3. What is recorded anyway, and for how long
Even without cookies, a website cannot work unless the server takes note of the requests it receives. For every page or file requested, one log line is written containing the IP address of the requester, the date and time, the address requested, the outcome of the request, the browser type and the referring page, if any.
- Purpose: to operate the site, to notice faults, and to defend it against abuse and intrusion attempts.
- Legal basis: the controller's legitimate interest in providing and protecting the service (Article 6(1)(f) of the Regulation).
- Retention: fourteen days, on the logs of the server that hosts the pages. Deletion is not left to good intentions: automatic rotation removes the oldest file every day and keeps fourteen of them. Logs held by Cloudflare, which sits in front of the server, follow that provider's own retention periods.
These records are not used to identify visitors, are not combined with any other source, and feed no profiling of any kind.
4. Where the data sits and who sees it
The pages are hosted on a server in Italy (Aruba S.p.A.). Traffic to the domain passes through Cloudflare, Inc., which acts as the delivery and protection network: in order to deliver the request, Cloudflare sees it pass through, and therefore also processes the visitor's IP address.
Both providers act as processors on the controller's instructions. Processing by Cloudflare may involve a transfer to the United States, governed by the safeguards under Chapter V of the Regulation adopted by that provider, including the European Commission's standard contractual clauses.
Beyond this, the data is disclosed to nobody and never published, unless disclosure is required by law or by a judicial authority.
5. If you write to me
There are no forms on this site: the email and certified email addresses are links that open your own mail program. If you choose to write, the controller identified in section 2 for that address processes the data in your message (name, address, content and attachments) in order to reply and to take any pre-contractual steps that follow, on the basis of Article 6(1)(b) and (f) of the Regulation.
Correspondence is kept for as long as it takes to handle the request and any relationship arising from it, and in any case for the periods imposed by legal, accounting and tax obligations. Providing your data is voluntary: without it, there is simply no way to reply.
6. No automated decisions
There is no profiling and no automated decision-making within the meaning of Article 22 of the Regulation.
7. Links to other sites
The pages contain links to external services, including LinkedIn, Substack and the systems built by the controller. Until you click them, no request is sent to any of them. Once you open one, you leave this site and that service's own privacy notice applies, over which the controller has no control.
8. Your rights
At any time you may ask the controller for access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest (Articles 15 to 22 of the Regulation). Requests go to the addresses in section 2 and are answered within one month.
If you believe the processing infringes the Regulation, you may lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it), with the supervisory authority of your own country of residence, or bring the matter before a court.
9. Changes
This notice may be updated if the way the site is built changes. The date at the top always marks the current version. If the site ever introduced tools that collect data, a consent request would appear first, and this page would say so.