Privacy Policy
This page explains what happens to the information you submit through the contact form on this website. Last updated 17 August 2026.
DRAFT — LEGAL REVIEW RECOMMENDED before this site goes live. This page was prepared from the actual data flow of this site plus Formspree's published documentation; it has not been reviewed by a lawyer and is not a substitute for one.
Francesco La Rosa (P.IVA 03765610831), based in Messina, Italy, is the controller for personal data submitted through the contact form on francescolarosaph.com. You can reach the controller via the contact page.
The form has 5 required fields and 4 optional ones. Nothing is collected anywhere else on the site beyond standard page-view analytics (see Section 6).
| Field | Required? | Purpose |
|---|---|---|
| First name, last name | Required | To address you and identify the enquiry |
| Required | To reply to you | |
| Project type | Required | To route and prepare for the enquiry |
| Message | Required | To understand what you're asking for |
| Company / brand | Optional | Only relevant for commercial/brand enquiries |
| Location | Optional | Helps assess travel/logistics |
| Date / timeline | Optional | Helps assess availability |
| Budget range | Optional | Helps prepare a relevant, non-generic reply |
A hidden honeypot field (never visible or fillable by a real visitor) helps filter automated spam submissions and contains no personal data.
When you submit the form, a small script running in your own browser (not on a server, and not using AI) labels the enquiry HIGH, MEDIUM or LOW FIT. The label is calculated only from the project type, budget range and timeline you entered in that same submission — no other data source is used.
This calculation is used only to help Francesco prioritize the order in which he replies to enquiries. It does not decide whether you receive a reply, does not filter or block any submission, and does not produce any automated acceptance, rejection, or other legal or similarly significant decision about you. A human reads and responds to every enquiry regardless of its label. The label is sent along with your message and is not stored or used for any other purpose.
Your data is processed to respond to your enquiry and, if a project goes ahead, to prepare and deliver it. The legal basis is Article 6(1)(b) GDPR — processing necessary to take steps at your request prior to entering into a contract, or to perform a contract already agreed. No marketing use, profiling with legal effect, or automated decision-making occurs.
Submitting the form sends your data to two places:
| Recipient | Role | What's known publicly |
|---|---|---|
| Formspree, Inc. | Processor (form-handling service) | Hosts the form backend on AWS infrastructure in the United States. States AES-256 encryption at rest, TLS 1.2+ in transit, and SOC 2 Type II certification. Acts as a data processor; francescolarosaph.com is the independent controller. States it retains data "only for as long as necessary" without a published fixed period. Formspree's Privacy Policy · Formspree's Security page. |
| Francesco's email inbox | Controller's own mailbox | The submission is forwarded by Formspree to the email address Francesco uses to receive enquiries. Standard email-provider processing applies from that point (as it would for any email you send him directly). |
Because Formspree's infrastructure is US-based, this involves an international transfer of your data outside the EU/UK. Formspree states it uses Standard Contractual Clauses as a data processor for such transfers. This has not been independently verified beyond Formspree's own published statements — see the legal-review note at the top of this page.
This site is prepared for Google Analytics 4, but GA4 is not active — no analytics data is currently being collected or sent anywhere. The code that would activate it only runs on the live production domain, never on a development copy of the site, and it will not go live until a real GA4 property exists. This policy will be updated with GA4's specific data practices (cookies, retention, IP handling) before that happens — not after.
Francesco retains enquiry emails for as long as reasonably needed to respond, and — if a project is booked — for the duration of the professional/commercial relationship and any legal retention period that applies afterward (e.g. Italian tax and accounting record-keeping requirements). Formspree's own retention of submission data is governed by its own policy (see Section 5) and is outside this site's direct control.
Under GDPR, you can ask to access, correct, delete, or receive a copy of your data, and you can object to or ask to restrict its processing. To exercise any of these, contact Francesco via the contact page. If you believe your data has been mishandled, you also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).
This policy may be updated as the site or its tools change — most notably when GA4 is activated. The "last updated" date at the top will always reflect the most recent version.