Privacy Policy
ATTURA.COM is a private, non-commercial photography portfolio. It has no shop, no contact form, no sign-up, no newsletter and no user accounts, so there is nothing here that asks you for your name, your address or any other detail about you. The only thing this site would like to know — and only if you allow it — is which photographs people look at, and for how long.
1. Who is responsible
The data controller is Gianluca Attura, a natural person operating this site in a private, non-professional capacity, reachable at privacy@attura.com.
No Data Protection Officer has been appointed: the site does not carry out large-scale or systematic monitoring within the meaning of Article 37 GDPR.
2. What is processed, and on what legal basis
2.1 Server logs — always, no consent required
Like any web server, the hosting environment records standard technical access data: the IP address of the request, the date and time, the file requested, the HTTP status, the referring page and the browser identification string. This happens for security, diagnostics and reliability, and is not used to identify or profile visitors.
- Legal basis: legitimate interest in keeping the site available and secure (Art. 6(1)(f) GDPR).
- Retention: the logs are rotated and overwritten by the hosting environment; they are not archived, not exported and not analysed for statistical purposes.
- Recipients: the connection between you and the server is carried by network and connectivity providers, as it is for any website. They carry traffic and nothing more: the encrypted connection is terminated on the controller's own server, so the pages you request, the cookies and any analytics data are not readable by them, and the addresses involved are handled only for as long as it takes to route the connection. The logs themselves stay on the server: they are not shared with anyone, not exported and not used for statistics.
2.2 Google Analytics 4 — only with your consent
Nothing is loaded until you choose. If you accept — entirely, or only some categories — the site loads Google Analytics 4 (property G-VH71714D13) and measures how the galleries are used. Each item below is collected only if the category it belongs to is switched on; the categories, the cookies they set and the switches themselves are on the Cookie Policy page. What is collected is limited to what the pages themselves generate:
- audience measurement — pages viewed, order of pages, entry page and time spent on each page;
- audience measurement — technical context: approximate location (country/region/city, derived from the IP address), device type, screen size and pixel density, browser and operating system, language, connection type, colour-scheme preference, and the site or search engine you arrived from;
- photograph interaction — which photographs are enlarged, how long each one stays on screen, how they are navigated (arrows, keyboard, swipe) and how the viewer leaves;
- photograph interaction — which thumbnails stay in view long enough to count as a pause, and how far down a gallery you scroll;
- photograph interaction — attempts to right-click, drag, copy or save a photograph, recorded as a count only, to understand how often the images are being taken;
- performance and errors — loading speed and page-quality measurements (Core Web Vitals), loading errors, and interaction problems such as repeated clicking on an unresponsive element.
What is never collected: your name, e-mail address, telephone number, postal address or any other direct identifier — the site has no field in which you could type one; the precise content of anything you type anywhere; your exact location; any special category of data under Article 9 GDPR. No advertising feature is used: Google Signals is disabled, ad personalisation is disabled, advertising storage is refused in every scenario including after you accept, and the property is not linked to Google Ads or to any advertising product. Your data is not sold, rented or used to build an advertising profile.
- Legal basis: your consent, freely given and revocable (Art. 6(1)(a) GDPR) — and, for storing and reading information on your device, Art. 122 of Legislative Decree 196/2003.
- Retention: event-level data is deleted by Google after 14 months; aggregate reports remain available afterwards. The record of your own consent choice expires after 6 months, at which point you are asked again.
What happens if you refuse. A refusal is never transmitted to ATTURA.COM or to any third party: no event is sent, no cookie is set and Google Analytics is not loaded. Your answer is written only in your own browser, in local storage, under attura_consent, together with the date, so that the site can honour it and not ask you again for six months. It remains stored locally in your browser and is not transmitted to ATTURA.COM or to any third party. It can only be accessed locally by scripts running under the ATTURA.COM origin. Clearing your browser data erases it. See the Cookie Policy for the exact contents.
2.3 Photographs of identifiable people
Some photographs — above all in the People gallery — show people who can be recognised. Publishing them is itself a processing of personal data, and it is also governed by the right to one's own image under Articles 96 and 97 of Italian Law 633/1941.
- Legal basis: the controller's legitimate interest in artistic and documentary expression on a private, non-commercial site (Art. 6(1)(f) GDPR), read with the reconciliation between data protection and freedom of expression provided by Art. 85 GDPR and Artt. 136–139 of Legislative Decree 196/2003. Art. 97 of Law 633/1941 allows publication without consent where it is justified by the person's public standing, by a public office, by cultural or educational purposes, or where the picture is connected to facts or events of public interest.
- No commercial use: no photograph on this site is sold, licensed, sponsored or used in advertising. Nobody is named or identified by caption.
- Special care is taken with close single portraits and with pictures of minors.
If you recognise yourself in a photograph and would rather not appear here, write to privacy@attura.com and it will be taken down. No reason has to be given and no explanation will be asked for. This is the right to object under Art. 21 GDPR, but on this site it does not need to be argued: a request is enough.
3. Who else sees the data
The only third party receiving analytics data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as data processor under the Google Analytics Terms of Service and the Google Ads Data Processing Terms. The account is configured so that the only data-sharing option enabled is technical support; sharing for Google product improvement, benchmarking, sales-representative access and modelling contributions are all switched off.
4. Transfers outside the European Economic Area
Google Ireland Limited may transfer data to Google LLC in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection by its decision of 10 July 2023. That decision was challenged and upheld at first instance by the EU General Court in Case T-553/23 (Latombe v Commission, 3 September 2025); an appeal is pending before the Court of Justice and no hearing date has been announced. In addition, Google's terms incorporate the European Commission's Standard Contractual Clauses, which continue to apply as a separate safeguard should the adequacy decision cease to be valid. Google Analytics 4 does not log or store IP addresses: the address is used in transit to derive an approximate location and is then discarded, and traffic originating in the EU is collected through Google's European domains.
If you would rather not rely on any of this, refuse the optional categories on the Cookie Policy page. The site works exactly the same.
5. Your rights
Under Articles 15 to 22 GDPR you may ask to:
- know whether data concerning you is processed, and obtain a copy of it (access);
- have inaccurate data corrected (rectification);
- have data deleted (erasure);
- have processing restricted;
- object to processing based on legitimate interest;
- receive the data in a structured, machine-readable format (portability);
- withdraw your consent at any time, on the Cookie Policy page or through the “Cookie preferences” link at the foot of every page.
For a photograph in which you are recognisable, see also section 2.3: a request to remove it is granted without discussion.
Write to privacy@attura.com. Please bear in mind an honest limitation: the analytics data is pseudonymous and holds nothing that would let anyone connect it to you, so in most cases the controller cannot single out “your” records (Art. 11 GDPR). The most effective remedy is the one you control directly: withdraw consent, and clear the cookies from your browser.
If you believe your data has been handled unlawfully you have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome (garanteprivacy.it) — or with the authority of the EU country where you live or work.
6. No profiling, no automated decisions
There is no automated decision-making and no profiling that produces legal or similarly significant effects. Nothing here is used to target advertising or to make a decision about you.
7. Children
This site is not directed at children and does not knowingly collect data from them. Nothing on it asks anyone to identify themselves.
8. External links
Where the site links to a third-party platform, this policy stops at the link. Once you leave ATTURA.COM the privacy practices of that platform apply.
9. Changes
If the way data is handled changes, this page is updated and its version number raised. Where the change concerns something you consented to, you will be asked again before anything new happens.