Privacy
Data protection notice.
Information about data processed through browsing, email communications and Google Tag Manager using advanced Consent Mode v2.
1. Data controller
Alessandro Balzani, medical doctor and self-employed professional, professionally established in Rome, Italy — Italian VAT no. 17504301007 — registered with the Rome Medical and Dental Council no. 70367. Privacy contact: info@balzani.net.
This is an informational and professional website. It does not provide online diagnosis, medical advice or healthcare services, does not handle emergencies and has no forms intended to collect health data.
2. Processing activities
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, date and time, requested URL, response status, user-agent and other technical server-log data. | Delivery, security, abuse prevention and fault diagnosis. | Controller’s legitimate interests in website security and operation, Article 6(1)(f) GDPR. | For the technical period set by the provider and longer only where required for an incident, abuse investigation or authority request. |
Theme preference balzani-theme and privacy choice balzani-consent-v2, stored locally in the browser. | Remember requested settings and record separate Analytics and Google Signals choices on that device. | Technical necessity for the requested service under section 122(1) of the Italian Privacy Code; legitimate interest in preference management. | Theme until deleted by the user; privacy choice for 180 days. |
| Consent state and technical data in cookieless pings: date and time, URL without query or fragment, referrer origin, user-agent, IP address received by Google and a random number generated on page load. | Basic measurement and statistical modelling through advanced Consent Mode v2, including while consent is denied. | The controller relies on legitimate interests in aggregate measurement under Article 6(1)(f) GDPR, limited to pings without access to Analytics cookies; this basis requires a balancing assessment and a specific compatibility review under section 122 of the Italian Privacy Code. | No Analytics cookie is written while analytics_storage is denied; data received by Google follows the property settings and provider rules. |
| Online identifiers, device/browser information, pages viewed, referral source and approximate location through Google Analytics 4. | Statistics to understand and improve website use. | Consent under Articles 6(1)(a) and 7 GDPR and section 122 of the Italian Privacy Code. | Cookies configured for up to 180 days; user/event-level Analytics data for the shortest available period selected by the controller. Aggregate reports may persist longer. |
| Google data relating to signed-in users who enabled Ads Personalisation, processed through Google Signals; this may include interests, demographics and cross-device linking. | Aggregated cross-device reports, demographics/interests and ad-personalisation features. | Specific consent under Articles 6(1)(a) and 7 GDPR and section 122 of the Italian Privacy Code. | According to the property and Google settings; signed-in Google data also respects the Analytics retention period where that period is shorter than Google’s default. |
| Data voluntarily provided by email. | Respond to non-urgent professional enquiries and manage possible pre-contractual relations. | Article 6(1)(b) and (f) GDPR; legal duties or establishment and defence of claims where applicable. | Normally up to 24 months after the communication is closed, unless law, a professional relationship or legal defence requires longer. |
3. Google Tag Manager, Analytics, Signals and consent
Google Tag Manager container GTM-KSH7HCZX and Google Analytics 4 measurement ID G-45FGZM7Q8R are provided by Google Ireland Limited. The website uses global advanced Consent Mode v2: the container loads immediately with analytics_storage, ad_storage, ad_user_data and ad_personalization denied. Google may therefore receive cookieless measurement pings before a choice; advanced mode does not mean that no data is transmitted.
“Reject all” keeps all four consent types denied and permits only the cookieless pings used by advanced mode. “Analytics” grants analytics_storage while keeping advertising consent denied. “Google Signals and advertising features” also grants ad_storage, ad_user_data and ad_personalization, enabling Google Signals and ad personalisation if activated in the property.
The website has no sign-in system and does not send user_id, names, email addresses, telephone numbers, health data or user-provided data for enhanced conversions. Choices can be changed at any time through “Cookie settings”. Withdrawal restores denied consent, deletes accessible first-party Google cookies where technically possible and returns measurement to cookieless pings; it does not stop the container from loading.
Technical details and durations are set out in the Cookie Policy.
4. Recipients and international transfers
Data may be processed by Aruba S.p.A. for hosting and email and by Google Ireland Limited and Google group entities from container load for cookieless pings; after the relevant consent, also for cookie-based Analytics, Google Signals and advertising features. Data may also be disclosed to public authorities where required by law.
Google use may involve processing outside the European Economic Area. Google states that it uses applicable safeguards, including adequacy decisions for entities participating in the EU–US Data Privacy Framework and Standard Contractual Clauses, as relevant. See Google’s Privacy Policy and the European Commission’s EU–US transfer information.
5. Required and optional data; health information
Necessary technical data is required to display the website. Under the advanced architecture selected by the controller, Google Tag Manager and cookieless pings operate without consent; Analytics cookies, Google Signals and advertising consent remain optional and separately controllable. Sending email is voluntary, but a return address is needed for a reply. Do not send health information, clinical documents or other special-category data: this address is neither a care channel nor an emergency service.
6. Your rights
Where applicable under Articles 15–22 GDPR, you may request access, rectification, erasure, restriction, portability, objection and recipient information. Consent may be withdrawn without affecting earlier lawful processing. No solely automated decisions producing legal or similarly significant effects are made.
Send requests to info@balzani.net. You may also lodge a complaint with the Italian Data Protection Authority or your competent EEA supervisory authority.
7. Updates
This notice will be updated when processing, providers or applicable rules change. The date above identifies the current version.