Privacy policy: data the site processes

I am Giorgio Alfredo Pagano, a freelance Drupal developer, and giorgiopagano.org is my personal website: this page describes the personal data the site processes. Updated on 1 October 2026. Every item described here was checked that day against the configuration of the live site.

Who is the data controller?

The controller is me, Giorgio Alfredo Pagano. You can reach me through the Contact page, or at the giorgiopagano.org email address that answers your first message.

What data does the contact form collect?

The form collects your name, your email address, the subject and the text of your message. If you tick the box for it, you receive a copy as well. This data has one purpose: replying to you. Until you confirm through the link you receive by email, the message waits on the server for at most 24 hours; without confirmation it is deleted and never reaches me.

Data	Where it goes	How long it is kept
name, email, subject, message	an email to my mailbox on the giorgiopagano.org domain	up to 12 months from receipt
copy of the email sent	the site's database	30 days, then deleted automatically
message waiting for confirmation	the site's database	at most 24 hours, then deleted if you do not confirm
confirmation link	an automatic email to your address	stays in your mailbox

The legal basis is your request: by writing to me you ask for a reply, and the processing serves to give it (Article 6(1)(b) GDPR).

How does the form's spam protection work?

The form uses Friendly Captcha in local mode: your browser solves a small calculation that the site itself generates and checks. The check runs entirely on giorgiopagano.org, so Friendly Captcha's own services receive no data. The widget's code is served by the site, from the /libraries/friendly-challenge/ folder.

To set the difficulty of the calculation, the site counts for 30 minutes how many requests come from the same IP address, stored with its last part set to zero. After 30 minutes the count is deleted.

Two more checks run on the site. Honeypot adds a hidden field to the form and a minimum filling time of 5 seconds: if a submission breaks them, the site stores the full IP address and the time for 5 minutes, long enough to slow down repeated attempts, and deletes them at the next scheduled task. Antibot accepts the submission only after a mouse movement, a touch or a key press, and stores no data.

What does the site record when you visit a page?

This site does not record visits.

The notice "What this site records when you visit", at the foot of this page, reads these settings from the site's live configuration: if they ever change, the notice changes with them.

What does the system log contain?

Drupal keeps a log of errors and technical events, for example a missing page or a scheduled task. Each entry carries the full IP address of whoever made the request. The log keeps the latest 1,000 entries and drops the oldest as new ones arrive: on 1 October 2026 it covered about two days.

Where is the data stored?

The site, its database and its email are hosted by Netsons s.r.l., in its data centre in Milan. Netsons processes the data on my behalf as a data processor (Article 28 GDPR). The site loads no third-party scripts, fonts or services, and no data goes to artificial intelligence systems.

What does the AI disclosure mean?

At the foot of every page a notice states how much artificial intelligence contributed to the text, produced by the AI Disclosure module. It describes how the content was written and concerns the text, not its reader: showing it involves no personal data.

What rights do you have over your data?

You can ask to see the data about you, correct it, delete it, restrict its use, object to processing based on legitimate interest, and receive it in a machine-readable format (Articles 15-21 GDPR). A request through the Contact page is enough, and I reply within one month.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (opens in a new tab).

Does the site use cookies?

For visitors, none. People who log in as administrators receive a session cookie. The details are in the Cookie policy.

Sources

All checks were made on 1 October 2026.

Configuration of the live site: contact form site_contact with Honeypot (hidden field, 5 seconds, 300-second expiry in honeypot_user) and Antibot (no data stored), Friendly Captcha with the local endpoint (per-IP count on a truncated address, expiring after 30 minutes, SiteVerify::SCALING_TTL_SECONDS), Easy Email deleting stored emails after 30 days, system log capped at 1,000 entries. Author's check.
Regulation (EU) 2016/679, GDPR (opens in a new tab), EUR-Lex: Articles 6, 13, 15-21 and 28. Primary source.
Native Observability (opens in a new tab), drupal.org. Primary source.
AI Disclosure (opens in a new tab), drupal.org. Primary source.