nicastro.in - Privacy Policy

最終更新日 27/09/2026

Version: 2.2 Effective date: 27/09/2026 Last updated: 27/09/2026

This Privacy Policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the Italian Privacy Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018). It fully replaces the previous version dated 30 May 2022. Version 2.1 added section 5.5 on Amazon affiliate links; version 2.2 adds section 6.2 on the newsletter.

1. Data Controller

Sara Nicastro Trieste (Italy) Email: saranicastro.sn@gmail.com

(“Controller”, “we”, “us”)

The Controller is a natural person. “Facondia Lab” is the name of the personal initiative under which the website, the apps and the books presented on nicastro.in are published; it is not a company or a legal entity separate from the Controller.

Data Protection Officer (DPO): no DPO has been appointed under Art. 37 GDPR, since the Controller does not carry out large-scale processing or systematic processing of special categories of data.

For any question about this Policy or the processing of your data, write to the email address above.

2. Scope of this Policy

This Policy applies to the website nicastro.in and all its pages, in every language in which it is available (“Site”).

It does not apply to:

• the Android applications presented on the Site (Chroma Closet, Elephant, Steampunk Morse Code, Park Pin): each has its own privacy policy, available in the Legal section of the Site;
• third-party websites and services reachable via links from the Site (Google Play Store, Amazon, etc.), which are governed by their own policies (for Amazon, see also section 5.5 on affiliate links).

3. At a glance

The Site is a static website with no user accounts, no forms of its own and no analytics. Personal data is processed as follows:

Each processing activity is detailed in the sections below.

4. Web server logs

Like every website, the Site is served by a server that automatically records some technical information on each request: IP address, date and time, address of the requested page, outcome of the request, browser user agent and referring page, if any.

• Purpose: delivering the Site, detecting faults, protecting the Site against abuse and attacks.
• Legal basis: the Controller’s legitimate interest in the proper operation and security of the Site (Art. 6(1)(f) GDPR). This processing does not require your consent and is not used to identify or profile you.
• Retention: logs are kept by the hosting provider for the technical time strictly necessary for the purposes above, according to its settings, and in any case no longer than permitted by applicable law. The Controller does not extract or analyse these logs systematically.
• Recipients: the Site’s hosting provider, acting as a processor under Art. 28 GDPR, with servers located in the European Union.

5. Advertising and affiliate links

The Site displays advertisements served by Google AdSense, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), part of the Google group. Advertising helps cover the cost of developing and maintaining the apps and the Site.

5.1 What Google does

When a page of the Site loads, the AdSense code contacts Google’s servers, which select and display the ads. In doing so Google may:

• read and set cookies and other identifiers in your browser (the list is in the Cookie Policy);
• receive your IP address, information about your device and browser, and the address of the page you are visiting;
• if you have given consent, use this information, together with data collected on other sites and apps that use Google services, to show you personalised ads based on your interests and to measure ad performance.

Google processes this data as an independent data controller, for its own purposes and under its own privacy policy. To learn how Google uses data collected on partner sites:

• How Google uses information from sites or apps that use its services
• Google Privacy Policy
• Types of cookies and technologies used by Google

5.2 Your consent

If you connect from the European Economic Area, the United Kingdom or Switzerland, on your first visit the Site shows you a consent management banner (a Google-certified consent management platform, compliant with IAB Europe’s Transparency & Consent Framework v2.2). Through the banner you can:

• accept the use of advertising cookies and ad personalisation;
• reject, using a button with the same prominence as the accept button;
• manage options in detail, purpose by purpose and vendor by vendor.

Until you make a choice, or if you reject, Google does not use profiling cookies in your browser. In that case the Site may still show non-personalised ads, based solely on the content of the page you are viewing and on generic information such as language and the approximate location derived from your IP address, without building a profile of your interests.

You can change or withdraw your consent at any time by reopening the preferences panel through the “Cookie preferences” link in the Site footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. The Site shows the banner again 6 months after your last choice, or earlier if purposes or vendors change.

5.3 Other settings

Independently of the banner, you can manage Google ad personalisation from your Google account at adssettings.google.com, and behavioural advertising preferences for many operators at www.youronlinechoices.eu.

5.4 Data transfers outside the EU

Google may transfer the data it collects to servers located in the United States and other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and relies on the Standard Contractual Clauses approved by the European Commission for transfers not covered by the Framework. More information: Google and international data transfers.

5.5 Amazon affiliate links

Some pages of the Site (books and resources linked to books) contain purchase links to Amazon that include an affiliate identifier. The Controller participates in the Amazon Associates program: if you buy a product through these links, Amazon pays the Controller a small commission on the sale, at no extra cost to you.

These links are ordinary hyperlinks: the Site sets no cookies and collects no data at the moment of the click. Once you reach the Amazon website, Amazon itself — as an independent data controller — may set its own cookies and process your data under its own privacy policy (available on the Amazon site for your country, e.g. amazon.com).

If the Site were to adopt more advanced affiliate tools in the future that set their own cookies or scripts (for example automatic redirection to the Amazon marketplace for your country), this Policy and the consent banner will be updated accordingly.

6. Email contact and newsletter

6.1 Email contact

If you write to the email address in section 1, we process your email address, your name (if you provide it) and the content of your message for the sole purpose of replying to you and handling your request.

• Legal basis: the Controller’s legitimate interest in replying to those who contact them (Art. 6(1)(f) GDPR) or, if the request concerns the exercise of your rights, compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Retention: for the time needed to handle the request and, afterwards, for the time needed to document that a reply was given in case of dispute, no longer than 24 months from the last exchange, unless the law requires otherwise.
• Recipients: the Controller’s email service provider (Google LLC, Gmail service), acting as a processor.

6.2 Newsletter

The newsletter is optional and run by hand by the Controller, without any email-marketing platform. You can subscribe from the Site’s Newsletter page, through a Google form (Google Forms) hosted on Google’s servers, or by writing to facondia.lab@gmail.com.

• Data processed: email address, the themes you choose (for example wardrobe & style, food & meal prep, productivity apps), Site language and sign-up date.
• Purpose: sending you occasional emails, only when there is something new (apps, books, resources) on the themes you chose. No profiling, no open or click tracking, no disclosure to third parties.
• Legal basis: your consent (Art. 6(1)(a) GDPR), given by subscribing. You can withdraw it at any time, without affecting the lawfulness of earlier emails.
• How to unsubscribe: reply “unsubscribe” to any newsletter email, or write to facondia.lab@gmail.com. Your address is removed from the list without undue delay and in any case within 30 days.
• Retention: until you unsubscribe or the newsletter is discontinued; afterwards the data is deleted from the list.
• Recipients: Google LLC (Gmail, Google Forms and Google Sheets, used to receive sign-ups, keep the list and send the emails), acting as a processor. For transfers outside the EU, section 5.4 applies.
• Google form: the sign-up form opens on Google’s domain (docs.google.com), outside the Site. While you fill it in, Google may process browsing data under its own privacy policy. If you prefer, you can subscribe by email without using the form.

7. Data we do NOT process

• The Site does not require registration and has no user accounts.
• The Site has no forms of its own for contact, sign-up or comments: newsletter sign-up happens by email or through the external Google form described in section 6.2.
• The Site uses no analytics tools (no Google Analytics or equivalent).
• Typefaces (fonts) are hosted directly on the Site’s server: no data is sent to Google Fonts or any other font provider.
• The Site stores no first-party cookies and saves nothing in your browser, except the record of the choice you make in the consent banner (see the Cookie Policy).
• The Site is not directed at children under 14 and does not knowingly collect data about them. If you believe a child has provided us with personal data, contact us and we will delete it.

8. Recipients and processors

Data may also be disclosed to competent authorities where required by law, by a court order or to protect the Controller’s rights in legal proceedings. No data is sold or transferred to third parties for marketing purposes.

9. Retention periods

10. Your rights

Under Articles 15-22 GDPR you have the right to:

• access your personal data and obtain a copy;
• obtain the rectification of inaccurate data or the completion of incomplete data;
• obtain the erasure of your data (“right to be forgotten”), in the cases provided for;
• obtain the restriction of processing;
• receive your data in a structured, machine-readable format (portability), where processing is based on consent or a contract and carried out by automated means;
• object to processing based on legitimate interest, on grounds relating to your particular situation;
• withdraw consent at any time, without affecting the lawfulness of prior processing: for advertising, through the “Cookie preferences” link in the footer; for the newsletter, as described in section 6.2;
• not be subject to decisions based solely on automated processing which produce legal or similarly significant effects on you (the Site makes no such decisions).

To exercise your rights, write to saranicastro.sn@gmail.com. We will reply within one month of receiving your request, extendable by two months in particularly complex cases (Art. 12(3) GDPR). Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

For data processed by Google as an independent controller (section 5), you may also exercise your rights directly with Google through the tools described in its privacy policy.

Complaint to a supervisory authority: if you believe the processing infringes data protection law, you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy; www.garanteprivacy.it), or with the supervisory authority of the EU Member State where you live or work.

11. Visitors from other countries

The Site is available in thirteen languages and can be accessed from anywhere in the world. If you connect from a country outside the European Economic Area, the United Kingdom or Switzerland, local law may grant you rights similar to those described in section 10 (for example the rights of access, deletion and opt-out from targeted advertising under the laws of certain US states, Korea’s PIPA, Japan’s APPI or China’s PIPL). We honour them, where compatible, for anyone who asks at the email address in section 1. The Controller does not sell personal data. The settings to limit Google ad personalisation (section 5.3) are available everywhere.

12. Security

The Site is served exclusively over an encrypted HTTPS connection. Since there are no accounts or user-entered data, the risk surface is limited to the processing described above, for which the Controller and its providers adopt appropriate technical and organisational measures (Art. 32 GDPR). No system can, however, guarantee absolute security.

13. Changes to this Policy

We may update this Policy, for example when introducing new services or to reflect regulatory changes. Each version shows its effective date and last-updated date at the top. In case of substantial changes affecting consent-based processing, the consent banner will be shown to you again. We encourage you to check this page periodically.

14. Contact

For any question about this Policy or the processing of your personal data:

Sara Nicastro Trieste (Italy) Email: saranicastro.sn@gmail.com