Last updated: September 25, 2026
This Privacy Policy describes how personal data of users visiting elenabarilli.com is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”).
1. Data Controller
The Data Controller is:
Elena Barilli
Email: info@elenabarilli.com
For any request concerning the processing of personal data, users may contact the Data Controller at the email address indicated above.
2. Personal Data Collected
The website is primarily intended to present and showcase the artistic works of Elena Barilli.
Through the contact form available on the website, the following personal data may be collected:
- first name;
- last name;
- email address;
- any information voluntarily included by the user in the message.
In addition, during normal browsing, the IT systems used to operate the website may automatically collect certain technical data, such as IP address, browser type, operating system, date and time of the request, and other information relating to navigation.
3. Purposes and Legal Basis of Processing
Personal data submitted through the contact form is used exclusively to:
- respond to users’ enquiries;
- provide information about artworks;
- manage enquiries relating to the purchase, availability or commission of artworks;
- manage subsequent communications related to the request received.
The legal basis for processing is the performance of pre-contractual measures taken at the request of the data subject and, where applicable, the legitimate interest of the Data Controller in responding to communications received.
Personal data is not used for marketing or newsletter purposes without an appropriate legal basis and, where required, the user’s consent.
4. Methods of Processing
Personal data is processed using electronic and digital tools, with appropriate technical and organisational measures designed to protect it against unauthorised access, loss, disclosure or misuse.
5. Data Retention
Personal data received through the contact form is retained for the time necessary to manage and respond to the user’s request and, where applicable, for any additional period required to protect the rights of the Data Controller or comply with legal obligations.
Technical browsing data is retained in accordance with the retention periods applied by the systems used for the operation and security of the website.
6. Recipients of Personal Data
Personal data is not sold or publicly disclosed.
It may be processed by technical service providers necessary for the operation of the website, acting in accordance with their respective responsibilities under applicable data protection laws.
The website is hosted using hosting services provided by Register.it.
The contact form is managed through WPForms, a WordPress plugin used to allow users to submit enquiries.
If WPForms Lite is used without the Lite Connect feature enabled, form submissions are generally sent by email and are not stored as entries in the WordPress database.
If the WPForms Lite Connect feature is enabled, form submissions may also be securely backed up on WPForms infrastructure. According to WPForms, these backups are encrypted before transmission and may be retained for up to one year.
Personal data may also be disclosed to public authorities or other parties where required by law.
7. Transfers of Personal Data Outside the European Economic Area
The Data Controller does not directly transfer personal data to countries outside the European Economic Area.
If technical service providers used for the operation of the website involve transfers of personal data to third countries, such transfers must take place in accordance with the safeguards and requirements established by the GDPR.
8. Analytics and Profiling
The website currently does not use Google Analytics, Meta Pixel or other tools intended for user profiling or advertising tracking.
No automated decision-making or profiling activities are carried out.
9. Cookies
The website may use technical cookies that are strictly necessary for the proper operation of the website and the services requested by users.
At present, the website does not use profiling cookies or tracking tools for advertising or analytics purposes.
User consent is not required for strictly necessary technical cookies.
10. Data Subject Rights
Under the GDPR, users may exercise, where applicable, the following rights:
- obtain confirmation as to whether personal data concerning them is being processed;
- access their personal data;
- request correction of inaccurate personal data;
- request deletion of personal data;
- request restriction of processing;
- object to processing in the cases provided by law;
- request data portability where applicable.
Requests may be sent to:
Users also have the right to lodge a complaint with the competent supervisory authority. In Italy, this is the Garante per la Protezione dei Dati Personali.
11. Provision of Personal Data
Providing personal data through the contact form is voluntary.
However, failure to provide the necessary information, particularly name and email address, may make it impossible to respond to the enquiry.
12. Changes to this Privacy Policy
This Privacy Policy may be updated periodically, for example following changes to the services used by the website or applicable legislation.
The updated version will be published on this page together with the date of the latest update.