PRIVACY / WEBSITE INFORMATION
Transparency,
from the start.
Last updated: 18 October 2026. This notice covers the NAMABAY presentation website and communications sent to its public contact address, not the future app.
1. Controller and contact details
Controller: Matteo Gelmini, contact for the NAMABAY project. Public professional contact and privacy contact: info@namabay.com, active for receiving messages through email forwarding.
2. Browsing and hosting
The website uses Cloudflare Pages. As of this update it is available at the test address namabay.pages.dev; the namabay.com domain is not yet connected. The website is static: it offers no forms, accounts or application database. The files examined contain no tracking scripts, remote fonts or third-party embedded content. The email link opens the visitor’s email application.
Technical data. To deliver pages, Cloudflare processes HTTP requests and IP addresses. Its documentation also covers routing and traffic data to deliver and protect the service. These data are separate from email correspondence.
Data accessible to the controller. Cloudflare Web Analytics is disabled. In the checks confirmed by the controller, no user-activated custom log collections were identified; Metrics showed no data in the interval examined, Observability Overview showed no events in the last hour examined, and no saved queries were present. These findings are limited to the screens and intervals examined: they do not establish that Cloudflare holds no logs or technical data.
For technical processing under the controller’s responsibility, the purpose is to make the website available and protect it, and the legal basis is legitimate interest (Article 6(1)(f) GDPR). Data necessary for transmission are essential to normal access to the pages.
Technical retention. Cloudflare applies criteria linked to purposes, the nature of the data, risks and applicable obligations. No numeric period is assigned to NAMABAY logs, and Pages Functions log retention periods are not extended to this static website. As no controller-activated custom collections were identified, no additional log archive with its own retention deadline is claimed.
3. Email communications: data, purposes and retention
Writing to info@namabay.com involves processing the sender’s email address, any name provided, the subject, content, any attachments and technical transmission data, such as message dates, times and headers. Free Porkbun forwarding to a Gmail mailbox managed by the controller is active and verified. The personal Gmail address is not published.
The data are used to read and respond to enquiries, provide project information and manage discussions with potential collaborators. Providing data is optional, but without contact details and the necessary information it may not be possible to respond. No automatic newsletter is planned.
For requests made by a data subject with a view to entering into a contract to which they would be a party, the legal basis is taking pre-contractual steps at their request (Article 6(1)(b) GDPR). For other information enquiries and professional contacts, including representatives of organisations, the basis is the controller’s legitimate interest in managing project-related correspondence and contacts (Article 6(1)(f)), respecting data subjects’ rights and freedoms. Any processing necessary to comply with specific legal obligations is based on Article 6(1)(c); processing necessary to protect legal rights is based on the legitimate interest under point (f).
Retention of communications that do not lead to a commercial relationship. Communications received at info@namabay.com that do not lead to commercial relationships will be retained for a maximum period of 12 months from the last communication, except where legal obligations or substantiated needs to protect legal rights require otherwise.
Commercial collaborations actually established. Separate retention criteria will apply, to be defined with regard to managing the relationship and its duration, applicable legal obligations and documented needs to protect legal rights. The relevant criteria will be communicated to data subjects when the related processing begins. No as-yet undefined numeric retention period is assigned to these relationships.
The 12-month limit concerns the controller’s retention of correspondence; it does not describe technical deletion timelines, backups or logs independently managed by providers. No automatic deletion mechanism in Gmail is claimed.
4. Providers, recipients and international transfers
Recipients involved in providing the services are Cloudflare for hosting and page delivery, Porkbun for email forwarding and Google for receiving and managing Gmail correspondence. The domain is registered with Porkbun. Data may also be processed by the technical providers these services use and disclosed to authorities where provided for by law.
According to its policy, Cloudflare acts as a processor for content and Customer Logs processed on a customer’s behalf, and as a controller for other processing for its own purposes. Its standard terms incorporate the relevant processing agreement.
Porkbun’s public agreement, incorporated into its service terms, governs processing on the customer’s behalf for forwarding; Porkbun processes account administration data for its own purposes. Personal Gmail is covered by Google’s Privacy Policy, which identifies Google Ireland Limited as controller for users resident in the EEA or Switzerland, subject to the stated exceptions. Personal Gmail is not described as Google Workspace, and no appointment of Google as processor under Workspace contracts is claimed.
The services may involve processing outside the European Economic Area, including the United States. Public documentation describes these mechanisms: for Cloudflare, the Data Privacy Framework for covered transfers and standard contractual clauses for transfers subject to the relevant conditions; for Porkbun, standard contractual clauses in the cases governed by its agreement; for Google, adequacy decisions, the Data Privacy Framework for covered transfers and standard contractual clauses where required. Neither exclusively European processing nor unverified bespoke agreements are claimed.
Safeguards and recipient information are available in the official documentation: Cloudflare agreement, Cloudflare sub-processors, Porkbun agreement and schedules, Google transfers. For information or to request a copy of the relevant safeguards, write to info@namabay.com.
Providers’ technical retention is separate from the controller’s email limit. Porkbun specifies the duration necessary for permitted purposes or required by law; Google distinguishes data kept in the account, deletion and technical copies, with possible retention for security and legal obligations. Further information: Cloudflare Privacy and Google retention. The 12-month limit is not presented as a deadline for providers’ logs or backups.
5. Cookies
The website files examined do not set cookies or use browser local storage; Cloudflare Web Analytics is disabled. No application-level tracking tools are present in the files examined. This does not exclude technical processing or possible platform security measures and does not mean that no logs exist.
6. Data subjects’ rights
In the cases and subject to the conditions set out in Articles 15–22 GDPR, you may request access, rectification, erasure and restriction of processing. Data portability applies to data provided by the data subject where processing is automated and based on consent or a contract.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. In that case the controller will stop processing unless there are compelling legitimate grounds overriding your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.
To exercise your rights, write to info@namabay.com. You will receive a response without undue delay and normally within one month; in the cases provided for in Article 12 GDPR, this period may be extended by two months, with reasons communicated within the first month. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing; consent is not the identified basis for the ordinary email enquiries described here.
You may lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority under Article 77 GDPR, particularly in the place of your habitual residence, work or the alleged infringement. The files examined do not provide for automated decision-making or profiling.
7. Project information
NAMABAY is a project in development. This website does not offer direct sales, accounts or photo uploads. No affiliations, approvals, partnerships or commercial authorisations are claimed to have been obtained.
NAMABAY is currently Matteo Gelmini’s personal project, with no incorporated company and no VAT number of its own. The public contact is info@namabay.com.