Privacy Policy
Last updated: August 2026.
This English translation is provided for convenience. In the event of any inconsistency or divergence, the Italian version shall prevail.
In accordance with the legislation currently in force on the protection of personal data, Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (Privacy Code), as amended by Legislative Decree 101/2018, the following notice explains the processing of personal data relating to users who visit and use the Network Caffè website (also referred to below as the “Website”). This notice describes the purposes and methods of processing, the legal bases on which it relies and the rights granted to users, in language intended to comply with European legal standards.
Data Controller
The Data Controller for personal data collected through the Website is Network Caffè, represented by its operator, a private individual, also referred to as the “Controller”. The Controller has chosen to remain anonymous as Network Caffè (or the Management of Network Caffè), as a private individual rather than a company. Any request concerning the processing of personal data or the exercise of the rights granted by the GDPR, listed below, may be sent to the Controller at privacy@netcaffe.biz.
Types of Data Collected
Different types of personal data may be collected while a user browses and interacts with the Website.
Browsing Data
The Website is built using PHP technology and is hosted on Hostinger’s infrastructure. During their normal operation, the computer systems and software procedures used to run the Website acquire certain personal data whose transmission is inherent in the use of internet communication protocols. This information is not collected in order to identify users, but by its nature it may allow indirect identification through processing and association with data held by third parties. Browsing data may include, for example: the IP addresses or domain names of the devices used to connect to the Website; the time of the request; the URL of the requested resource; the method used to submit the request to the server; the response status code; the size of the data returned; and other parameters relating to the user’s operating system and computing environment.
This data is recorded in server logs and used solely to obtain statistical information about use of the Website and to monitor its correct operation. The hosting provider processes this data in aggregated form to provide the Controller with traffic statistics, such as the number of requests, unique IP addresses and countries of origin, without this involving the installation of cookies on the user’s device. Browsing data is normally deleted immediately after processing; for example, log files are kept for only a few days and in any case no longer than seven days, unless they are required by the competent authorities to investigate criminal offences.
Data Voluntarily Provided by the User
The optional, explicit and voluntary sending of communications to the Controller, for example through email addresses published on the Website or through any contact forms that may be made available, results in the acquisition of personal data voluntarily supplied by the user. This may include, by way of example, the sender’s email address, first and last name, the content of the request or message and any other information supplied by the user. This data will be used exclusively to respond to the user’s request or to provide the requested service or assistance. Providing this data is optional, but failure to provide it may make it impossible to receive a response or use certain services requested by the user.
Cookies and Tracking Technologies
The Website uses technical cookies where they are necessary for its correct operation, such as session cookies, and the analytical cookies used by the Statcounter service described below. Network Caffè does not use profiling cookies for advertising or marketing purposes. Because the Website is hosted on third-party infrastructure, the hosting provider may also automatically install certain third-party technical cookies that are required for the operation of the platform and over which the Controller has no direct control.
Traffic Statistics Through Statcounter
The Website uses Statcounter, a web traffic analysis service provided by Statcounter, a company based in Ireland. Statcounter helps the Controller understand how visitors interact with the Website, for example how they reached it, how long they spend on it and which pages attract the greatest interest, so that its content, structure and functionality can be improved.
For this purpose, Statcounter uses cookies and similar technologies to collect data relating to visits, including: the date and time of the visit; IP address; browser and operating system; device information, such as device type and screen size; and referral data, such as the search-engine link through which the visitor reached the Website. This data is used exclusively for statistical purposes and not to identify individual visitors.
During a visit to the Website, Statcounter may place a third-party cookie named “is_unique” in the user’s browser. It is used only to distinguish new visitors from returning visitors and to estimate the number of unique visitors to the Website; it does not store personal information. A first-party cookie with a similar counting function may also be placed and may contain a random identifier generated on the first visit.
Statcounter cookies are activated only after the user has given consent through the banner displayed on the Website. Consent may be withdrawn at any time with effect for the future. Users may also prevent Statcounter cookies from being installed through their browser settings or by activating the refusal cookie made available by Statcounter at https:/
Further details on the types of cookies used, their purposes and consent management are provided in this “Cookies and Tracking Technologies” section. Users may in any event manage and disable cookies through their browser settings. Disabling or blocking technical cookies may impair certain Website functions or the use of its services.
Transparency About the Use of Artificial Intelligence
The Controller uses artificial intelligence tools exclusively during the editorial production of Website content. In particular, these tools may support writing and the preparation of article drafts and may also be used to generate images accompanying the content. Every piece of content is in all cases reviewed, checked and approved by a person before publication.
Purposes of Processing and Legal Bases
Users’ personal data is processed lawfully, fairly and transparently for the following purposes, each relying on the corresponding legal basis under Article 6 GDPR.
Providing access to the Website and its content: browsing data is used to allow users to view web pages, ensure that the Website operates securely and efficiently and improve the browsing experience. Legal basis: performance of a service requested by the user through access to the Website, under Article 6(1)(b) GDPR, and the Controller’s legitimate interest in ensuring the correct operation and security of the Website, under Article 6(1)(f) GDPR.
Responding to user requests or communications: data supplied voluntarily, such as an email address and message, is processed to answer questions and requests for information or assistance, or to fulfil another explicit request made by the user. Legal basis: steps taken at the request of the data subject before entering into a contract or performance of a requested service, under Article 6(1)(b) GDPR, for example providing requested information or assistance, or the Controller’s legitimate interest in managing and responding to communications appropriately, under Article 6(1)(f) GDPR.
Statistical analysis of Website traffic: data collected through Statcounter is processed to produce statistics on visits and use of the Website and thereby improve its content, structure and functionality. Legal basis: the data subject’s consent under Article 6(1)(a) GDPR, given through the cookie banner and withdrawable at any time.
Compliance with legal obligations: user data may be processed where necessary to comply with legal obligations to which the Controller is subject, such as accounting or tax requirements or measures ordered by public authorities. Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.
Security management and abuse prevention: data, particularly browsing data, may be used to monitor Website security, prevent unauthorised access, unlawful use or cyberattacks and establish responsibility where computer-related offences are committed against the Website. Legal basis: the Controller’s legitimate interest in protecting its systems, activities and users against security threats under Article 6(1)(f) GDPR.
Use of technical and functionality cookies: any technical cookies used by the Website or hosting provider serve to ensure and improve Website functionality, for example session or preference management. Legal basis: the Controller’s legitimate interest in providing an efficient and functional Website under Article 6(1)(f) GDPR and, for strictly necessary cookies, the need to provide the service requested under Article 6(1)(b) GDPR.
In addition to the purposes above, the Controller may process data to protect its rights in court in connection with disputes, complaints or legal proceedings relating to the use of the Website or the services provided. In such cases, the legal basis is the Controller’s legitimate interest in establishing, exercising or defending legal claims under Article 6(1)(f) GDPR.
Processing Methods and Security Measures
Personal data is processed by the Controller and any authorised persons or external processors mainly by electronic and telematic means, including electronic systems and software, using appropriate technical and organisational measures designed to ensure data security and confidentiality in accordance with Article 32 GDPR. In particular, the Controller takes appropriate measures to prevent unauthorised access, disclosure, alteration or destruction of personal data.
Security measures include, by way of example: encryption of communications through HTTPS/SSL, protecting data transmitted between the user and the server; firewall systems and monitoring tools on hosting servers to prevent intrusions or unauthorised access; authentication and authorisation procedures restricted to personnel or collaborators authorised to process data; and regular backups to protect data integrity. External providers, such as Hostinger for hosting, are selected on the basis of reliability and security guarantees and act under data processing agreements compliant with the GDPR.
Processing follows the principle of data minimisation: only data relevant and necessary for the stated purposes is collected and processed. The Controller does not use personal data for automated decision-making, including automated profiling, that produces legal effects concerning the user.
Data Retention
Personal data is kept only for as long as is strictly necessary to achieve the purposes for which it was collected, in accordance with the storage limitation principle under Article 5(1)(e) GDPR and applicable legal obligations. In particular:
Browsing data and technical logs are kept for a few days and automatically deleted at the end of that period, normally no longer than seven days after collection, unless longer retention is required to investigate computer-related offences or by the competent authorities.
The retention period for detailed statistical data collected through Statcounter depends on the log quota associated with the plan used by the Controller; further information is available in Statcounter’s privacy policy. The duration of the “is_unique” cookie and the first-party counting cookie is described in the “Cookies and Tracking Technologies” section of this policy and in the relevant information provided by Statcounter.
Data voluntarily supplied for requests, such as email communications or contact-form submissions, is kept for as long as necessary to handle the user’s request and for a reasonable subsequent period in order to manage any follow-up. As a rule, once the request has been completed or the service provided, this data may be deleted or anonymised no later than an indicative period of 12 months after the last communication, unless further retention is required, for example to protect rights in a dispute for the applicable limitation period.
Data processed to comply with legal obligations, such as accounting or tax documentation, will be retained for the period required by applicable law; for example, civil and tax records are generally retained for ten years.
Where processing is based on consent, such as Statcounter analytical cookies, the relevant data is kept until consent is withdrawn or until the retention period communicated when consent was obtained has expired. If consent is withdrawn, data relating to that purpose will be deleted or anonymised promptly, subject to any applicable legal retention obligations.
When the retention periods described above expire, personal data will be erased, anonymised or aggregated so that data subjects can no longer be identified, unless further storage is required by specific legal obligations, orders from public authorities or the protection of the Controller’s rights, in the latter case only for the applicable limitation period.
Disclosure and Recipients of Personal Data
Personal data collected through the Website will not be disseminated, meaning made indiscriminately available to the public. Within the purposes described above, however, data may be disclosed to properly appointed third parties bound by confidentiality in the following circumstances.
Technical and IT service providers: the Controller uses third parties to provide services required to operate the Website and achieve the stated processing purposes. In particular, Hostinger, the web-hosting provider, processes data on behalf of the Controller by managing servers and technical infrastructure. Statcounter processes Website traffic statistics as described in this policy and its own privacy policy. Other providers of IT or communications services, such as email services, cybersecurity services and technical maintenance providers, may also access personal data to the extent necessary to provide their services. These third parties process data under the Controller’s instructions and pursuant to contractual arrangements compliant with Article 28 GDPR, which impose data-protection and confidentiality obligations.
Professional advisers and collaborators: where necessary, the Controller may involve external professionals, such as legal, accounting or IT advisers, in activities related to Website management or compliance with legal obligations. These parties may process data as external processors or, in limited circumstances such as a legal adviser defending a claim, as independent controllers, always in accordance with applicable data-protection law.
Public authorities and bodies: data may be disclosed to governmental, judicial or administrative bodies, such as the Italian Data Protection Authority, law-enforcement agencies or courts, where required by applicable law or a lawful order, or in order to exercise or defend a right in court. In such cases, the recipients process the data as independent controllers.
Outside the categories described above, personal data will not be disclosed to other third parties without the data subject’s consent. In particular, Network Caffè does not sell, transfer or commercially share user data with third-party companies. An up-to-date list of third parties appointed as processors may be requested from the Controller at any time using the contact details provided.
Place of Processing and International Data Transfers
Personal data is processed mainly in Italy, at the Controller’s place of operation, and in the data centres used by the hosting provider. The Controller operates in Italy as a private individual and, where possible, favours infrastructure located within the European Union for the storage and processing of user data. Statcounter is provided by a company based in Ireland, within the European Union.
Some third-party services used by the Website may nevertheless involve the transfer of data to third countries outside the European Economic Area. For example, Hostinger may allocate or back up data on servers located outside the European Union, depending on the selected data centre, or other IT providers may be based outside Europe. In such cases, the Controller ensures that transfers are carried out in compliance with Articles 44 and following GDPR. Transfers will take place only to third countries recognised by the European Commission as providing an adequate level of protection under Article 45 GDPR, or will be subject to appropriate safeguards such as the European Commission’s standard contractual clauses under Article 46 GDPR, or, where applicable, explicit consent or another derogation permitted by Article 49 GDPR.
Users may request further information about specific transfers outside the European Union and the safeguards applied by contacting the Controller. All measures necessary to ensure a level of protection compliant with European data-security and protection requirements are applied even where data is transferred outside the European Union.
Rights of the Data Subject
Users of the Website, as data subjects whose personal data is processed, enjoy the rights granted by Articles 15–22 GDPR. In particular, at any time and in the circumstances provided by law, users have the following rights.
Access: to obtain confirmation as to whether personal data concerning them is being processed and, where that is the case, access to the data and information on the purposes of processing, categories of data processed, recipients or categories of recipients to whom the data has been or will be disclosed, the expected storage period and the existence of any automated decision-making, under Article 15 GDPR. On request, a copy of the personal data being processed will be provided in a commonly used electronic format, provided this does not adversely affect the rights and freedoms of others.
Rectification: to have inaccurate personal data corrected or updated and incomplete data completed, taking into account the purposes of processing, under Article 16 GDPR.
Erasure, or the “right to be forgotten”: to have personal data erased where the conditions laid down by Article 17 GDPR apply, for example where the data is no longer necessary for its original purposes, the user withdraws the consent on which the processing is based and there is no other legal ground, or the data has been unlawfully processed. The Controller will take reasonable steps to inform other controllers processing the personal data affected by the erasure request that the data subject has requested the deletion of links to, copies of or replications of that data.
Restriction of processing: to obtain restriction so that personal data is stored but not processed further in the cases set out by Article 18 GDPR, including where the user contests its accuracy for the period required for verification; processing is unlawful and the data subject requests restriction instead of erasure; the Controller no longer needs the data but the user needs it for the establishment, exercise or defence of legal claims; or the user has objected to processing pending verification of whether the Controller’s legitimate grounds override those of the user.
Data portability: to receive personal data supplied to the Controller in a structured, commonly used and machine-readable format and, where technically feasible, have that data transmitted directly to another controller chosen by the user, where processing is based on consent or a contract and carried out by automated means, under Article 20 GDPR. This right does not apply to non-automated processing, such as paper records, or to processing based on legal grounds other than consent or contract.
Objection: to object at any time, on grounds relating to the user’s particular situation, to the processing of personal data based on the Controller’s legitimate interests under Article 21 GDPR. Following an objection, the Controller will no longer process the personal data unless compelling legitimate grounds for processing override the interests, rights and freedoms of the data subject, or processing is required for the establishment, exercise or defence of legal claims. Users also have the right at any time to object to processing for direct-marketing purposes, a practice the Controller does not currently carry out, including profiling to the extent that it is related to such marketing.
Withdrawal of consent: where processing is based on the data subject’s consent, as in the case of Statcounter analytical cookies, users may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Consent may be withdrawn through the same mechanism used to give it or by contacting the Controller. After withdrawal, data may be processed only where another legal basis applies, such as a legal obligation or an overriding legitimate interest.
Lodging a complaint with a supervisory authority: users who believe that personal-data processing through the Website breaches applicable law may lodge a complaint with the competent supervisory authority, particularly in the Member State of their habitual residence, place of work or the place of the alleged infringement. In Italy, the competent authority is the Garante per la Protezione dei Dati Personali, available at www.
Exercising Your Rights
Users may exercise the rights listed above at any time by contacting the Controller. Requests may be sent to privacy@netcaffe.biz with the subject line “Exercise of privacy rights”, stating the right being exercised and the information to which the request relates. Before responding, the Controller may need to verify the requester’s identity to ensure that personal data is not disclosed to unauthorised persons.
Requests concerning data-subject rights are handled free of charge, except where requests are manifestly unfounded or excessive. In those cases, the Controller may charge a reasonable fee reflecting administrative costs or refuse the request under Article 12(5) GDPR. The Controller will respond within 30 days of receiving a request, as provided by Article 12 GDPR. Where necessary because of particular complexity, this period may be extended up to a maximum of three months; in that case, the Controller will inform the data subject within 30 days that additional time is needed and explain the reasons for the delay.
Children
The services and content offered by the Website are generally intended for a general audience. The Controller does not knowingly collect or process personal data relating to children under 14, the minimum age in Italy for independently consenting to the processing of personal data in connection with information-society services under Article 2-quinquies of Legislative Decree 196/2003. If personal data relating to a child is found to have been collected inadvertently without the required parental consent, the Controller will erase it promptly. Parents and guardians are invited to report any unauthorised processing of children’s data using the contact details provided.
Changes to This Privacy Policy
This Privacy Policy may be updated or amended over time, including where the services provided change or data-protection law is updated. Material changes will be brought to users’ attention, for example through notices on the Website. Users are nevertheless invited to consult this page periodically to review the latest version of the policy.
The date on which this Privacy Policy was last updated appears at the end of the document. Continued use of the Website after an update constitutes acknowledgement of the changes.
Manage analytics consent
You can update the preference saved in this browser at any time.