Privacy policy

Last updated: 26 October 2026

This notice explains how personal information is handled when you contact or support Baci Sospesi or leave a contribution in the Cloud. You can leave a contribution using the Baci Sospesi Cloud form.

Who is responsible for your data

Barbara Sbrocca is the data controller for bacisospesi.com. For questions about your personal data or to exercise your rights, use the private personal data request form below.

The Baci Sospesi Cloud

The message form requires your message and your permission to publish it. Your email address is optional: you can leave a Bacio without providing one. If you provide an email, it is stored privately with your contribution and can be used to notify you when your Bacio is published and to respond to requests concerning your contribution or your data. No author name or email address is automatically added to the public message. If you choose to include your first name in the message itself, that name becomes part of its public text.

Every new message is held privately for Barbara Sbrocca to review. It becomes visible in the Cloud only after her approval, including to the person who submitted it. Depending on traffic on the platform, review may take from a few minutes to a few hours. Offensive or denigrating messages will be deleted.

Publication of the message and the associated handling of your email rely on the consent you give through the unchecked confirmation box. The website records the privacy-policy version and time of that consent. You can withdraw it through the private personal data request form below. Withdrawal does not affect the lawfulness of processing that took place beforehand.

Write only what you intend to make public. You may include your first name if you wish. Leave out surnames, email addresses and other identifying or sensitive information about yourself or other people. Public messages can be read, copied or saved by visitors; removing a message here cannot remove copies other people have made.

Optional project news

With your optional, separate consent, you can receive news about Baci Sospesi, no more than twice a month. You can withdraw consent at any time through the unsubscribe link in news emails or the private personal data request form below. The legal basis is consent under Article 6(1)(a) GDPR.

Storage and publication

Cloud submissions are stored in this website’s WordPress database. Only authorised people managing the project can access private submission details. The gallery retrieves only messages marked for public display; it never displays the email field, sender name, address, avatar or browser information.

Messages are moderated before publication. If you provide an email, it may be used for a service notification when your message is approved. Optional news updates require separate consent. Temporary keyed fingerprints help prevent repeated submissions; the connection-address fingerprint expires after one hour, and no raw IP address or browser information is stored with your contribution.

Unpublished Cloud submissions are automatically and permanently deleted ninety days after submission, together with their associated private email and submission metadata. For approved contributions, the private email address is automatically removed twelve months after submission, along with the fingerprint used to prevent duplicates and any obsolete private-preview access data. The approved message and its consent record are preserved until you ask for the message to be removed. These deletions are carried out automatically by the website’s scheduled clean-up. A separate newsletter subscription in SendFox remains active until you unsubscribe or ask for it to be removed; deleting an email from a Cloud contribution does not automatically cancel that subscription.

Private enquiries and personal data requests

You can contact Baci Sospesi through the private contact form, providing your first name, surname, email address and enquiry. Requests are stored in the private WordPress administration area and reviewed before a response. They are not published, automatically forwarded by email or used for marketing. Personal data requests can be submitted through the separate private form below; only the email and request text are required.

Ordinary enquiries are processed to answer your correspondence on the basis of legitimate interests under Article 6(1)(f) GDPR, or steps you request before an agreement under Article 6(1)(b), where applicable. Personal data requests are processed to comply with GDPR obligations under Article 6(1)(c). Only authorised people can access the private records. Ordinary enquiries are kept for twelve months after the last relevant exchange, unless continuing correspondence or legal obligations require longer. Privacy requests are retained for as long as needed to deal with and document the request and meet legal obligations. The private forms limit repeated submissions to one every twenty-four hours per email address and connection. Temporary keyed fingerprints used to protect the service expire within twenty-four hours; the raw connection address is not stored in the request.

Supporting the project through PayPal

The support buttons open PayPal’s website in a new tab. PayPal handles the transaction under its own privacy notice. This website does not collect your card or bank details. The recipient may receive the contributor’s name, email, amount, date, transaction reference and any accompanying message; delivery details may be needed if an agreed screenprint or other form of gratitude is sent.

Contribution information is used to acknowledge and record support, arrange any agreed delivery, and meet applicable record-keeping obligations. Retention depends on those obligations. No tax deductibility or charitable receipt is promised by this website.

The contribution link currently leads to Barbara Sbrocca’s PayPal page, as linked from sbrocca.com.

Service providers, external links and cookies

SendFox provides the email delivery and optional project-news subscription service. For a publication notification, it receives the recipient’s email address and the service email content. If you separately choose project news, it also stores your email in the dedicated list. See SendFox’s privacy policy for information about its handling of personal data.

The website is hosted by Awareness Software Ltd, with servers located in the European Economic Area (EEA). The website’s data, including its WordPress database and Cloud submissions, are stored in the European Union.

When you access the website, the hosting provider automatically collects and stores technical information in server log files, such as your IP address, browser type, operating system and access timestamps. This processing is based on legitimate interests under Article 6(1)(f) GDPR to ensure website stability, load balancing and cyber security. These hosting logs are separate from the information stored with a Cloud contribution.

A Data Processing Agreement (DPA) with Awareness Software Ltd is in place under Article 28 GDPR. It governs the provider’s handling of personal data on behalf of the project in accordance with European data protection requirements.

Cloudflare provides the domain’s DNS services, and incoming email to the domain is configured to route through Cloudflare. Email routing is separate from the mailbox used to receive and store correspondence. See Cloudflare’s privacy policy for information about its handling of personal data.

Links to SoundCloud, YouTube, Amazon Music, podcast and magazine websites, PayPal and sbrocca.com take you to separate websites with their own privacy and cookie practices. Audio players and PayPal checkout are not embedded in these pages; those services are contacted when you choose to open their links.

WordPress also uses technical cookies for authenticated access to the site and its administration. No analytics, advertising or profiling integration is currently installed.

Your rights

Subject to the conditions in applicable data protection law, you can request access to your personal data, correction, deletion, restriction of processing or portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw consent at any time.

Contact Barbara Sbrocca through the private personal data request form below and explain your request. To locate a Cloud contribution, use the email supplied with it and, if possible, include the message text or link. Additional information is requested only where needed to verify your request. Requests are normally answered within one month, subject to any extension allowed by law.

You can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or the supervisory authority competent for you. The Cloud does not use your contribution to make automated decisions about you.

Changes to this notice

This notice is updated when the website’s services or handling of personal information change. The update date appears once at the top of this page. The website records the notice version associated with the consent given for each contribution.