Last updated: October 17, 2026
This Privacy Policy describes how **https://www.realeyesphotography.com/** collects, uses, and protects the personal data of users who visit the website and interact with its services, pursuant to Article 13 of EU Regulation 2016/679 (General Data Protection Regulation – GDPR).
—
## 1. Data Controller
The Data Controller of personal data collected through this website is:
– **Name:** Bernardo Maria Tuccillo
– **Location:** Rome (RM), Italy
– **VAT Number (P.IVA):** IT09690481214
– **Contact Email:** he***@*****************hy.com
—
## 2. Types of Data Collected
### a) Browsing Data
The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, browser type, operating system, domain names, time of requests, and other parameters relating to the user’s operating system and IT environment). This data is used solely to ensure the proper technical functioning and security of the website.
### b) Data Voluntarily Provided by the User (Contact Form and Email)
When users voluntarily fill out the contact form on this website or send an email to the addresses listed on this site, the Data Controller acquires the personal data provided by the user, specifically:
– **First Name and Last Name**
– **Email Address**
– **Phone Number**
– **Any additional personal data included in the message body**
This data is collected and processed exclusively to respond to the user’s inquiries, quote requests, or booking requests.
### c) Anti-Spam Protection (Google reCAPTCHA)
This website uses Google reCAPTCHA to protect contact forms from automated spam and abuse. reCAPTCHA analyzes visitor behavior (including IP address, mouse movements, time spent on the page, and browser information) to verify whether the input is made by a human or by an automated program.
### d) Analytics Data and Cookies (Google Analytics 4 / Google Tag Manager)
Subject to the user’s explicit consent given via the cookie banner, this website uses web analytics tools to collect aggregated statistical information on how visitors use and navigate the pages. For full details on the cookies installed and to manage or withdraw your consent at any time, please refer to our [Cookie Policy](/cookie-policy-eu/).
—
## 3. Purposes and Legal Basis of Processing
Personal data is processed for the following purposes and on the following legal bases:
1. **Responding to inquiries, quote requests, or communications (Contact Form / Email)**
– *Legal basis:* Execution of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR). Providing this data is necessary to receive a response from the Data Controller.
2. **Technical operation, IT security, and spam prevention (Hosting & Google reCAPTCHA)**
– *Legal basis:* Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) in ensuring website security and preventing fraudulent or automated abuse, or user consent where cookies are involved.
3. **Statistical traffic analysis (Google Analytics 4)**
– *Legal basis:* Explicit consent of the data subject (Art. 6(1)(a) GDPR) expressed through the cookie consent banner upon visiting the website.
4. **Compliance with legal, tax, and administrative obligations**
– *Legal basis:* Compliance with a legal obligation to which the Data Controller is subject (Art. 6(1)(c) GDPR), should a contractual relationship be established.
—
## 4. Third-Party Services and Data Recipients
Personal data is not sold or disseminated to unspecified third parties. However, data may be processed by trusted third-party providers acting as Data Processors or independent Controllers for technical and operational purposes:
– **Web Hosting (Aruba S.p.A.):** This website is hosted on servers managed by Aruba S.p.A. (Via San Clemente, 53 – 24036 Ponte San Pietro, BG, Italy), with data centers located within the European Union. [Aruba Privacy Policy](https://www.aruba.it/informativa_arubaspa.pdf).
– **Google Analytics 4 & Google Tag Manager (Google Ireland Limited):** Web analytics and tag management services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics is configured with IP anonymization and is activated only upon the user’s consent via the cookie banner. [Google Privacy Policy](https://policies.google.com/privacy).
– **Google reCAPTCHA (Google Ireland Limited):** Spam protection service provided by Google Ireland Limited, subject to Google’s [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms).
—
## 5. Processing Methods and Data Retention Period
Personal data is processed using electronic and automated tools, with appropriate organizational and technical security measures in place to prevent data loss, unlawful or improper use, and unauthorized access.
Data will be retained for the following periods:
– **Contact form and email inquiries:** For the time strictly necessary to handle and reply to the request, and up to a maximum of **24 months** from the last communication (unless a contractual relationship is established, in which case data will be retained for 10 years in accordance with Italian tax and civil law).
– **Analytics data (Google Analytics):** For the retention period set within the GA4 property (up to 14 months) and according to the cookie durations specified in the Cookie Policy.
—
## 6. International Data Transfers
Personal data is primarily stored and processed within the European Economic Area (EEA). Where the use of third-party services (such as Google LLC) involves the transfer of data to the United States, such transfers are carried out in compliance with Chapter V of the GDPR, relying on the European Commission’s Adequacy Decision for the **EU-U.S. Data Privacy Framework (DPF)** and/or Standard Contractual Clauses (SCCs).
—
## 7. Data Subject Rights
Pursuant to Articles 15–22 of the GDPR, you have the right at any time to request from the Data Controller:
– **Access** to your personal data and information relating to its processing;
– **Rectification** of inaccurate personal data or integration of incomplete data;
– **Erasure** of your personal data (“right to be forgotten”);
– **Restriction** of processing or **objection** to processing;
– **Data portability** (receiving your data in a structured, commonly used, and machine-readable format);
– **Withdrawal of consent** at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, you can send an email to: **he***@*****************hy.com**.
You also have the right to lodge a complaint with the competent Supervisory Authority (in Italy, the *Garante per la protezione dei dati personali* – [www.garanteprivacy.it](https://www.garanteprivacy.it), or the Data Protection Authority of your habitual place of residence within the EU).