Privacy Policy

Privacy Policy Autorium (Yuri Autorino)

Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Effective date: May 24, 2026

1. Data Controller

Yuri Autorino, operating under the trade name Autorium · Behavioral Decision Strategy Registered Office: Naples, Italy VAT No.: 10974061219 Email: y.autorino@theautorium.com

No Data Protection Officer (DPO) has been appointed as the conditions provided for by Art. 37 GDPR for mandatory designation are not met.

2. Types of data collected and purposes of processing

Purpose

Responding to inquiries via contact form

Website traffic statistical analysis (Google Analytics 4)

Technical website operation (Framer)

Data processed

Name, organization, email, description of the request

Anonymous technical data: pages visited, session duration, aggregated geographic area

Technical session data

Legal basis

Consent (Art. 6.1.a GDPR)

Legitimate interest (Art. 6.1.f GDPR)

Nature

Optional

Necessary

Failure to provide data for optional purposes does not affect site navigation. Failure to provide contact form data only makes it impossible to receive a response to the request.

3. Processing methods

Data is processed using computer systems, in compliance with the principles of lawfulness, fairness, transparency, and minimization required by the GDPR. Adequate technical and organizational security measures are adopted to prevent unauthorized access, loss, or disclosure of data.

4. Retention period

Data collected through the contact form is kept for the time necessary to handle the request and no longer than 24 months from receipt. Anonymous analytical data is retained according to the terms of Google Analytics 4, maximum 14 months by default.

5. Recipients and transfer of data

Data is not sold or transferred to third parties for commercial purposes. It is processed exclusively by the controller. The site makes use of the following technical providers operating as data processors:

Framer Inc. (site hosting and infrastructure): framer.com/privacy

Google LLC (Google Analytics 4): policies.google.com/privacy

These entities may process data in third countries outside the EU. The transfer takes place in compliance with the guarantees provided by articles 44 et seq. of the GDPR, in particular on the basis of the Standard Contractual Clauses approved by the European Commission.

Note for future use: should advertising via LinkedIn Ads be activated, LinkedIn Ireland Unlimited Company would be added as a technical provider with access to browsing data via the LinkedIn Insight Tag. In that case, this policy will be updated before the campaigns are activated.

6. Rights of the data subject

Pursuant to articles 15-22 of the GDPR, the data subject has the right to access their personal data, request its rectification or erasure, request the restriction of processing, object to processing, request data portability, and withdraw consent given at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise your rights, you can write to: y.autorino@theautorium.com

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): www.garanteprivacy.it

Purpose / Processed data / Legal basis / Nature

Response to requests via contact form / Name, organization, email, description of the request / Consent (art. 6.1.a GDPR) / Optional

Statistical analysis of website traffic (Google Analytics 4) / Technical anonymous data: pages visited, session duration, aggregated geographical area / Legitimate interest (art. 6.1.f GDPR) / Optional

Technical functioning of the website (Framer) / Technical session data / Legitimate interest (art. 6.1.f GDPR) / Necessary

Failure to provide data for optional purposes does not affect website navigation. Failure to provide contact form data only results in the impossibility of receiving a response to the request.

3. Methods of processing

The data is processed using computer tools, in compliance with the principles of lawfulness, fairness, transparency and minimization provided for by the GDPR. Technical and organizational security measures appropriate to prevent unauthorized access, loss, or disclosure of data are adopted.

4. Retention period

Data collected via the contact form is kept for the time necessary to manage the request and no longer than 24 months from receipt. Anonymous analytical data is kept according to Google Analytics 4 terms, up to 14 months by default.

5. Recipients and transfer of data

Data is not sold or transferred to third parties for commercial purposes. It is processed exclusively by the data controller. The website makes use of the following technical providers operating as data processors:

Framer Inc. (website hosting and infrastructure): framer.com/privacy

Google LLC (Google Analytics 4): policies.google.com/privacy

These entities may process data in non-EU third countries. The transfer takes place in compliance with the guarantees provided by articles 44 and following of the GDPR, in particular on the basis of the Standard Contractual Clauses approved by the European Commission.

Note for future use: should advertising via LinkedIn Ads be activated, LinkedIn Ireland Unlimited Company would be added as a technical provider with access to navigation data via LinkedIn Insight Tag. In that case, this privacy policy will be updated prior to the activation of the campaigns.

6. Rights of the data subject

Pursuant to arts. 15-22 of the GDPR, the data subject has the right to access their personal data, request its rectification or erasure, request the restriction of processing, object to processing, request data portability, withdraw consent given at any time without affecting the lawfulness of the processing prior to withdrawal.

To exercise your rights, you can write to: y.autorino@theautorium.com

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): www.garanteprivacy.it