Privacy Policy

Last updated: 12 August 2026

1. Data Controller

The Data Controller is Enrico Penello, Salita Santa Brigida, 12 Uni, 16126 Genova, Italy, VAT number 02381070990. Privacy enquiries and requests may be sent to enrico@kinopatia.com.

2. Scope of this notice

This notice explains how personal data are processed when you visit the Kinopatia website. The website currently has no contact forms, newsletter, user accounts, e-commerce or advertising services. It does not use Google Ads, advertising profiling, User-ID or Vimeo-to-Google Analytics event tracking. Personal data are nevertheless processed through ordinary website delivery, security logs, consent preferences and, where chosen by the visitor, analytics and video playback.

3. Data processed

Technical and usage data: IP address, date and time, requested resource, response status, browser and device information, referrer and other data normally contained in web-server and security logs.
Cookie preference data: the consent choice stored by the consent-management platform.
Analytics data: website interaction and device data processed through Google Analytics 4 only after Analytics consent.
Vimeo data: technical connection data necessary to obtain preview information and, after an explicit click, to load and operate the Vimeo player.

4. Purposes and legal bases

Delivering the website, maintaining availability, diagnosing faults, preventing abuse and protecting systems: legitimate interests of the Controller in providing a secure and reliable service (Article 6(1)(f) GDPR) and, where applicable, compliance with legal obligations (Article 6(1)(c) GDPR).
Remembering cookie choices and implementing the visitor’s request: necessary technical operation and legitimate interests in demonstrating and respecting the choice made.
Measuring website use through Google Analytics 4: consent (Article 6(1)(a) GDPR).
Loading and playing a Vimeo video after the visitor’s explicit action: the visitor’s request and the Controller’s legitimate interest in presenting audiovisual work. Where access to non-essential storage requires consent, the applicable consent choice is respected.

5. Hosting and technical logs

The website is currently on staging and is intended to be migrated to OVHcloud. After migration, OVHcloud will act as the hosting provider and process technical data on behalf of the Controller under the applicable service terms. Hosting and security logs are retained only for as long as necessary for website delivery, security, technical diagnosis, abuse prevention, contractual requirements and applicable legal obligations, taking account of the settings and terms of the active hosting plan. The exact plan-specific period must be checked once the OVHcloud environment is active.

6. Google Analytics 4

Google Analytics 4 measurement ID G-MSFTZGX0ND is loaded only after Analytics consent. The implementation does not use Google Ads, advertising signals, ad personalisation or User-ID. Before consent, after rejection and after a saved withdrawal on subsequent navigation, the Google Analytics tag is not loaded.

The current GA4 user- and event-level retention value could not be verified through an already authorised session. Those data are retained for the period configured by the Controller in GA4, selected according to data-minimisation and analytical necessity, and in any event no longer than the maximum available period of 14 months. Standard aggregated reports may follow a different lifecycle. The setting should be manually verified after launch in GA4 under Admin > Data settings > Data retention.

7. Vimeo

Kinopatia uses Vimeo to present portfolio videos. A lightweight preview may make preliminary requests for video metadata or poster resources. The actual player iframe is created only after an explicit click and its effective URL includes dnt=1. Under this configuration, Vimeo DNT is intended to prevent Vimeo analytics/session-data collection and new non-essential cookies. It does not guarantee a completely cookieless connection: technically necessary security cookies may still be used and the browser may transmit Vimeo cookies created during an earlier visit.

8. Recipients and service providers

Personal data may be processed by service providers necessary to operate the website, including the current staging host and, after migration, OVHcloud; Google for consented Google Analytics 4; and Vimeo for preview delivery and video playback. Data are disclosed to other recipients only where required by law or necessary to establish, exercise or defend legal claims.

9. International transfers

Some providers may process data outside the European Economic Area. Where required, transfers are based on an adequacy decision, the European Commission’s Standard Contractual Clauses or another safeguard permitted by Chapter V GDPR, together with any supplementary measures considered appropriate. Further details are available in the providers’ privacy documentation.

10. Retention

Cookie preference data are kept for 180 days unless the choice is changed earlier. Analytics retention follows the criterion described above. Vimeo and hosting data are retained under each provider’s applicable terms and only for as long as necessary for the stated purposes, security and legal obligations. The Controller reviews the need for continued retention and deletes or anonymises data when they are no longer required.

11. Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights, contact enrico@kinopatia.com.

You also have the right to lodge a complaint with the competent supervisory authority. In Italy, this is the Garante per la protezione dei dati personali.

12. Changes

This notice may be updated when services, purposes, providers or legal requirements change. The current version and its last-updated date are published on this page.