Privacy Policy
Website: https://www.francesco.world/www/
Last updated: 9 August 2026
This notice explains what personal data this website collects, why it is collected, who else sees it, and what rights you have over it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
It is written to be read, not to be survived. If anything in it is unclear, please ask.
1. Who is responsible for your data
The data controller for this website is:
Francesco Baldassarri
Email: francesco@francesco.world
Write to that address about anything in this notice, including to exercise any of the rights set out in section 7. No Data Protection Officer has been appointed, and none is required for processing of this scale.
2. What this website does not do
It is worth stating the absences plainly, because they determine how little there is to describe.
- No analytics of any kind. There is no Google Analytics, no Tag Manager, no Matomo, no Plausible, no Clarity, and no equivalent.
- No advertising. No ad networks, no advertising partners, no personalised advertising, and no advertising measurement.
- No tracking pixels or social media SDKs. The links to GitHub, LinkedIn, Reddit, Substack, Discord and about.me are ordinary hyperlinks. They send nothing anywhere until you deliberately click them.
- No profiling and no automated decision making within the meaning of Article 22 GDPR.
- No user accounts, no comment system, and no newsletter signup handled on this site.
- Personal data is never sold, rented, or disclosed for anyone's marketing purposes.
The site is a personal publication about machine learning. It has no commercial data interest in its readers.
3. Data processed when you simply read a page
3.1 Server log files
Like every web server, the server hosting this site writes a short record of each request. Those records contain your IP address, the date and time of the request, the page or file requested, the HTTP response status, your browser's user agent string, and the referring page where your browser sends one.
- Purpose: operating the site, diagnosing faults, and protecting it against abuse and attack.
- Legal basis: Article 6(1)(f) GDPR, being the legitimate interest in running a functioning and secure website.
- Recipient: Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, acting as a data processor under Article 28 GDPR.
- Retention: the logs stay on Aruba's systems under its standard hosting configuration. They are not exported, copied, or separately retained by the controller. If you need the exact period applying at a given moment, ask at the address in section 1 and it will be confirmed with the provider.
These logs are not combined with any other data, and they are not used to build a picture of individual readers. Aruba is an Italian company, and states that the personal data it processes is held in archives located in European Union countries, so these records do not leave the EEA.
3.2 Typefaces loaded from Google
The site's stylesheet loads two typefaces (Montserrat and Open Sans) from Google's font service at fonts.googleapis.com and fonts.gstatic.com, rather than from this website's own server. Your browser makes this request automatically on every page, before you interact with anything and without any action on your part.
As a consequence, your IP address, your browser's user agent string, and the address of the page you are viewing are transmitted to Google. Google does not set a cookie in order to serve the fonts; the request itself is what discloses those details. In respect of the data it receives this way, Google acts as an independent controller, and its own privacy policy at https://policies.google.com/privacy governs what it does with it.
- Purpose: consistent typography across browsers and devices.
- Legal basis: Article 6(1)(f) GDPR, being the legitimate interest in presenting the site as designed.
- Transfer outside the EEA: see section 6.
If you would rather this did not happen, any browser extension that blocks third party requests, or a browser setting that blocks remote font loading, will prevent it. The site remains completely readable; it simply falls back to a typeface already installed on your device.
4. Data you actively choose to give: the contact form
The contact page at /contact/ presents a form with four required fields (your name, your email address, a subject line, and your message), and it also accepts optional file attachments.
When you submit the form, its contents are assembled into an email message and sent to the controller's mailbox. Nothing is written to a database, and nothing is stored on the web server: while the submission is being processed the values are held briefly in a PHP session on the server, and they are discarded once the email has been sent or once you leave the site.
- Purpose: to read your message and reply to it.
- Legal basis: Article 6(1)(f) GDPR, being the legitimate interest, both yours and the controller's, in corresponding about a message you chose to send. Where your message concerns a possible professional engagement, Article 6(1)(b) applies in addition, as processing necessary for steps taken at your request before entering into a contract.
- Recipient: the email is delivered to a Microsoft Outlook mailbox, so Microsoft Ireland Operations Limited processes it in its capacity as an email service provider.
- Retention: your message remains in that mailbox for as long as the correspondence may reasonably need to be referred back to, and is deleted once it no longer serves that purpose. You may ask for it to be deleted sooner at any time, and it will be.
Supplying this data is entirely voluntary. There is no obligation to use the form, and the only consequence of not using it is that no message is sent.
Please do not send special category data. Information revealing health, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, or biometric or genetic data (Article 9 GDPR) should not be put into this form. It is an ordinary email form, and it offers no special protection for such material.
Anti spam measures. The form contains a hidden field that human visitors never see, and a single use token tied to your browsing session. Both exist solely to reject automated submissions. Neither is used to identify, profile, or track you, and neither survives the submission.
5. Who else receives your data
Only the following, and each only for the narrow purpose described.
| Recipient | What they receive | Why | Role |
|---|---|---|---|
| Aruba S.p.A. (Italy) | Server log data, including your IP address | Hosting the website | Processor (Art. 28 GDPR) |
| Microsoft Ireland Operations Limited | The contents of any contact form message you send | Delivering and storing that email | Processor |
| Google Ireland Limited and Google LLC | Your IP address, user agent and referring page, when fonts are requested | Serving the two web fonts | Independent controller |
There are no other recipients. Data is not transferred to advertisers, data brokers, or analytics providers, because none are used.
Personal data may additionally be disclosed where disclosure is required by law, by a court, or by a competent supervisory authority. Should that ever happen, you will be informed unless the law forbids it.
6. Transfers outside the European Economic Area
Two of the recipients above are capable of processing data outside the EEA. Hosting is not one of them: Aruba holds the data it processes within the European Union, so your page requests and server logs stay inside the EEA.
Google. Font requests may be served by, or forwarded to, Google LLC in the United States. Google Ireland Limited and Google LLC participate in the EU-U.S. Data Privacy Framework. The European Commission's adequacy decision for that framework, Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, remains formally in force. It is, however, the subject of ongoing legal and political challenge at EU level, and its long term durability should not be assumed. This is one of the reasons the controller intends to serve these fonts locally instead.
Microsoft. Email is handled by Microsoft Ireland Operations Limited within the EU, though Microsoft's group companies may process data in the United States under the same framework and under Standard Contractual Clauses adopted by the European Commission.
You may request further detail about either transfer at the contact address in section 1.
7. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- Access the personal data held about you, and receive a copy of it (Art. 15).
- Rectify data that is inaccurate or incomplete (Art. 16).
- Erase your data, where one of the grounds in Article 17 applies.
- Restrict processing while a dispute about accuracy or lawfulness is resolved (Art. 18).
- Portability: receive data you provided in a structured, commonly used, machine readable format (Art. 20).
- Object to processing carried out on the basis of legitimate interest, on grounds relating to your particular situation (Art. 21). Because most of the processing described here rests on legitimate interest, this is the right most likely to be relevant to you.
To exercise any of these, write to francesco@francesco.world. You will receive a reply without undue delay, and in any event within one month, as Article 12(3) requires. There is no charge.
Right to lodge a complaint. If you believe your data has been handled unlawfully, you may complain to the Italian supervisory authority:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
Telephone: (+39) 06 696771
Email: protocollo@gpdp.it (certified mail: protocollo@pec.gpdp.it)
Website: https://www.garanteprivacy.it
If you live in another EU or EEA country, you may complain to your own national supervisory authority instead.
8. Security
The site is served over HTTPS. Contact form submissions are protected against cross site request forgery by a single use session token. Attachments are passed straight into the outgoing email, and are never written to a publicly reachable location on the server.
No transmission over the internet can be guaranteed absolutely secure, and no claim to the contrary is made here.
9. Children
This site is aimed at a professional and technical readership, and is not directed at children. No data is knowingly collected from anyone under 14, the age at which Italian law permits a child to consent to information society services on their own behalf. If you believe a child has sent personal data through the contact form, please write to the address above and it will be deleted.
10. Cookies
Cookies and equivalent storage technologies are covered separately, in the Cookie Policy.
In short: this site sets no analytics, advertising, or profiling cookies of any kind. The only storage it uses is technical and strictly necessary, which is why no consent banner is required.
11. Changes to this notice
This notice will be updated whenever the site changes in a way that affects it, most immediately when the Google Fonts described in section 3.2 are replaced with locally served copies. The date at the top always reflects the current version. Material changes will be noted here rather than made silently.
This notice describes the francesco.world website as configured on 9 August 2026.
