Privacy
Privacy notice
This notice explains how personal data is processed when someone reads https://www.fourtyozone.dev (Opens in a new tab). An inquiry is sent through the contact form only after the person allows the Google reCAPTCHA v3 check.
On this page
Controller
- Controller
- Mauro Mirra
- Status
- Natural person carrying out an independent professional activity
- Brand
- FOURTYOZONE
- VAT number
- IT16564051007
- Location
- Rome, Italy
- Website
- https://www.fourtyozone.dev
The website presents that professional practice, carried out through an Italian VAT registration. FOURTYOZONE is the brand, not a separate company and not an incorporated entity. The site is not a shop. It does not create accounts and it does not send promotional messages. This notice covers this website only.
The same email address is the contact for rights requests, for questions about this notice, and for a person who does not use the website form. The public location is Rome, Italy. A street address and a certified email address (PEC) are not published. That is the controller’s choice. This notice does not state that the omission satisfies every disclosure rule.
Website and contact
Current state
The website can be read in Italian and in English. Language follows the page address. Italian is served without a language prefix. English is served under /en.
The contact page can be opened. An inquiry is sent to the controller only after the person allows the Google reCAPTCHA v3 check. If the person refuses, the form does not send. The person can still write to the email address in the controller section. Writing directly does not mean that no provider handles the message: the mail service still receives it.
No audience analytics, advertising, remarketing, or session recording was found on the published site checked on 28 October 2026.
Contact form
The contact form sends the inquiry to the controller’s mailbox. Google’s script loads only after the person allows the reCAPTCHA v3 check. If the person refuses, the form does not send. Direct email remains available at the address in the controller section, and that message is still handled by the mail provider.
Categories of personal data
Ordinary browsing
Opening a page sends a technical request to Vercel, which hosts the website. Vercel’s documentation describes an IP address, the requested address, the date and time, and browser or device information as information its platform and logs can include. Those items are not listed here as a known inventory of fields stored for this website. The hosting section describes the plan and the documented period for viewing request logs.
The website does not offer a visitor account, a payment, a comment, or a newsletter.
Contact form
The contact form may process the following:
- name;
- email address;
- organization, if provided;
- request type;
- message;
- the contextual fields that belong to the selected request type, if filled in;
- the language of the page from which the request is sent;
- technical information used for abuse checks, including the result of the reCAPTCHA check described below.
The form does not ask for a password. Someone writing a support request is asked not to include passwords, keys, or access tokens.
Google reCAPTCHA v3
reCAPTCHA v3 is the abuse check for the form. It is not used on this website for advertising. Google’s guide describes version 3 as a tool that gives the site owner more data about traffic. This website does not send that result to an audience-analytics tool. On the published site checked on 29 October 2026, while sending was off, the related script was not loaded.
The behavior of the check is:
- on the contact pages only, and only after an explicit choice to allow the check, the browser may load Google’s script. Before that choice the script is not loaded;
- the choice is stored in localStorage, under the key fz.recaptcha-consent, with only the values granted and denied. It is not a cookie of this website. It is separate from storage Google manages, including a cookie named _GRECAPTCHA and a localStorage key named _grecaptcha;
- refusal or withdrawal removes the submit control. Withdrawal clears fz.recaptcha-consent, does not reload the page, and leaves the text already entered in place. It does not erase data Google has already received, a cookie Google has already set, or Google-managed storage such as _grecaptcha. A script already loaded on the page may remain until the person leaves it;
- the token is created at submission. Google’s guide says it expires after two minutes and can be verified only once. That lifetime is the token’s, not the cookie’s;
- the server sends that token to Google, together with a secret that stays on the server, so the token can be verified;
- the website does not add the IP address to that server-side verification.
The reCAPTCHA FAQ, updated by Google on 2 April 2026, says reCAPTCHA sets a cookie named _GRECAPTCHA when the check is executed, for risk analysis, and describes that cookie as necessary for the service. That description does not decide whether Italian law requires consent before the script loads. Another Google document writes the same name as _grecaptcha. No duration is stated. The same page says www.google.com may set other cookies, without listing them. The integration uses www.google.com. The cookie was not observed on 29 October 2026, because the script was not loaded.
Google’s verification response can include whether the token was valid, a score, the action name, a time, and a hostname. Google may collect more while the script runs. What else is collected, and how long Google keeps it, has not been established.
Purposes
- Purpose
- Deliver the pages that were requested
- State
- Active
- Purpose
- Keep the website operating, including both languages
- State
- Active
- Purpose
- Protect the website and its delivery
- State
- Active
- Purpose
- Receive an inquiry and reply
- State
- Active
- Purpose
- Assess a project, consulting, or support request
- State
- Active
- Purpose
- Reduce automated submissions on the form
- State
- Active, with reCAPTCHA v3 after an explicit choice
Behavioral advertising, commercial profiling, sale of data, and newsletters are not purposes of this website.
Legal bases
The controller relies on the bases below. A basis under Regulation (EU) 2016/679 (GDPR) is separate from any consent that cookies or similar technologies may require. That subject is in the cookie notice. The notes state the interest, the necessity, and the balance relied on where the basis is legitimate interest. They are the explanation published in this notice. They are not a legal certification.
- Purpose
- Delivering the website to someone who opens it
- Basis
- Article 6(1)(f)
- Note
- The interest is making the professional website available. Returning a page requires the host to receive the request. There is no visitor account and no advertising use. Optional audience measurement is a separate purpose. The person may object to this hosting purpose.
- Purpose
- Technical operation and languages
- Basis
- Article 6(1)(f)
- Note
- Language follows the page address. It is not a profile.
- Purpose
- Hosting security
- Basis
- Article 6(1)(f)
- Note
- The interest is protecting delivery of the site. Which technical data the host actually records has not been confirmed. The controller relies on legitimate interest for that purpose. That is not a statement that every host log is necessary.
- Purpose
- Replying to an inquiry the person sent in order to discuss a possible engagement
- Basis
- Article 6(1)(b)
- Note
- These are steps requested by the person before a contract. Consent is not the basis for that request.
- Purpose
- Replying to a message that is not a request for those steps
- Basis
- Article 6(1)(f)
- Note
- The interest is answering a professional message the person chose to send. The data are the contents of that message. The person may object.
- Purpose
- Assessing the professional request
- Basis
- The same basis as the reply
- Note
- Assessment is part of answering the message.
- Purpose
- Optional audience measurement
- Basis
- Article 6(1)(a)
- Note
- Consent, if measurement is offered later. It is not running. The script loads only after you allow it. Refusal does not limit the site. You can withdraw the allowance. The detail is in the cookie notice.
- Purpose
- reCAPTCHA
- Basis
- Article 6(1)(f) for the abuse check
- Note
- This is separate from any consent required before information is stored on or read from the device. The script loads only after an explicit choice. Refusing means the form does not send. Direct email remains available and is still handled by the mail provider.
- Purpose
- Keeping a record for a legal obligation, a contract, or a legal claim
- Basis
- Article 6(1)(c), or Article 6(1)(f) for the establishment, exercise, or defense of a claim, or the retention the contract requires
- Note
- Only where that obligation, contract, or claim actually applies. Inquiry correspondence is not kept under these exceptions by default.
Recipients and service providers
The providers below host the website, carry mail for an inquiry, or run the abuse check on the form. Public documents were read on 28 October 2026. The hosting plan was checked again on 2 November 2026. That reading does not show that a contract has been accepted for this website.
Vercel
Vercel Inc., a Delaware corporation, hosts the website. The account is on the Pro plan. Application code for the site is configured to run in the United States. That configuration does not mean every request, log, or backup is processed only there. On 2 November 2026 a response from the canonical host carried an edge identifier beginning with fra1. That identifier is an edge hop, not the configured application region.
Vercel’s published data-processing addendum, updated on 17 March 2026 and effective on 31 March 2026, describes Vercel as a processor for the customer data of Enterprise and Pro customers, and as a controller for service-generated data and for account contact data. The terms of service of 19 October 2026 also refer to that addendum in broader wording. This account is on the Pro plan named in that processor wording. It has not been established that the addendum has been accepted for this account, or which role applies to visitor data.
Vercel’s documentation, as read for the former Hobby plan, described a one-hour period for viewing request logs. The account is no longer on that plan. The viewing period for the current Pro plan has not been confirmed for this website. The one-hour figure is not stated here as the period for the current plan, and it was not a statement that every copy of a log is deleted after one hour.
Aruba
The mail service for the form uses the host smtps.aruba.it on port 465, which Aruba’s hosting and domains mail guide documents for outgoing mail. It is not certified email. The message is intended for contact@fourtyozone.dev. The same mailbox is the destination of a form message and of a message written directly to that address. The form is configured to send there. The mail server still has to accept the message before it is in the inbox.
Aruba’s hosting and domains terms, read on 28 October 2026, describe Aruba S.p.A. as an autonomous controller for the data needed to provide the service, and the customer as an autonomous controller for third-party data the customer enters. The same text also appoints Aruba as processor for data the customer enters or transmits with the service. Which description applies to this mailbox has not been confirmed against the contract for the mailbox.
Aruba documents periodic backups of storage for a possible restoration, without a duration, and deletion of the contents 30 days after the contract ends. Aruba’s privacy notice states six years for telematic traffic data of mail or connectivity services. That period is not the lifetime of the text of a message, and the log periods of certified email do not apply to this mailbox.
Deleting a message from the mailbox would not show that a backup copy has already been removed.
Google reCAPTCHA v3
This is the abuse check for the form. After the person allows the check, Google receives the script traffic in the browser and, on submission, the token check from the server. The website uses the site-verify address documented for reCAPTCHA. Google Cloud documents dated from 2 April 2026 describe the customer as controller and Google as processor where that arrangement applies. It has not been verified whether the key for this website is covered by that arrangement.
Google Analytics is not used.
Vercel Web Analytics
Vercel Web Analytics is not running. No measurement script is loaded, and no page view is sent. If FOURTYOZONE later offers optional audience measurement, the provider is Vercel Inc. The purpose is aggregate measurement of visits to the public site and improvement of that site. The legal basis is consent, Article 6(1)(a) of the GDPR. The script is not loaded, and no page view is sent, unless you allow it. The choice, the time, and the notice version 2026-11-06 are stored in this browser under fz.analytics-consent for 183 days. That record is not a cookie and is not the reCAPTCHA choice. Withdrawal is available from Analytics preferences in the footer. If the script is already loaded, withdrawal opens the page again.
Vercel’s documentation, read on 6 November 2026, says a visit is distinguished by a hash of the request that lasts one day, and that a stored point can include the time, the page address, the referring page, the browser, the operating system, the device type, and a location that can be as specific as a city. Vercel says the stored point is not tied to an IP address. Cookieless does not mean that no personal data is processed. This site removes the query string and the fragment before sending, and does not send custom events or the contact form. The addendum of 31 March 2026 describes Vercel as processor for Pro customer data and as controller for service-generated data. Which role applies to these page views, and whether this account has accepted the addendum, are not confirmed. A support reply is not that acceptance. The same reply described 12 months as the standard reporting window on the Pro plan. It is not treated as the retention period for every analytics record. The transfer wording in the international-transfers section applies. Questions can be sent to contact@fourtyozone.dev.
International transfers
Where processing takes place outside the European Economic Area, the GDPR requires a transfer condition, such as an adequacy decision or appropriate safeguards. The applicable condition has not been confirmed for the providers below. Processing is not described as taking place only in the European Union or the European Economic Area, or only in the United States.
- Provider
- Vercel
- What is documented
- The website is hosted on Vercel’s Pro plan. Application code is configured to run in the United States. Requests may also pass through other parts of the hosting network. On 2 November 2026 a response from the canonical host carried an edge identifier beginning with fra1. The published addendum names the United States as a primary place of processing and provides for the European Commission’s standard contractual clauses (decision 2021/914) where those clauses apply. Vercel publishes a list of infrastructure providers whose stated location on that list includes the United States.
- What is not confirmed for this website
- It has not been established that the addendum, or those clauses, cover this account. It is not known whether logs, backups, and support stay in the European Economic Area.
- Provider
- Aruba
- What is documented
- The mail service uses smtps.aruba.it. Aruba’s privacy notice states that its archives are in the European Union and that a transfer may use an adequacy decision or standard contractual clauses.
- What is not confirmed for this website
- The host name does not show where backups and support are located. No safeguard is confirmed for this mailbox.
- Provider
- What is documented
- reCAPTCHA is a Google service. It was not loaded on the published website. The role described in the Google Cloud documents of 2 April 2026 applies only where that arrangement applies.
- What is not confirmed for this website
- Neither Google’s processing location nor a transfer safeguard is confirmed for this website.
Retention
The website does not keep inquiry messages in a database. A sent inquiry is held in the controller’s mailbox under the rule below.
The controller has adopted the following rule for inquiry correspondence. It is an organizational commitment. The website does not delete messages automatically.
An inquiry message is kept while it is needed to answer that inquiry, and for 12 months after the last relevant communication about it. Those 12 months are the deadline. The mailbox is reviewed at least every six months so that a message whose deadline has arrived, or will arrive before the next review, is found in time. The message is deleted by hand on or before its own deadline. The review does not add time to the 12 months.
This timetable covers inquiry correspondence. It does not cover records that a legal obligation, a contract, or the establishment, exercise, or defense of a legal claim requires to be kept. Those records follow the period that obligation, contract, or claim requires. They are not a general extension of every inquiry.
If an inquiry becomes part of an ongoing engagement, the correspondence that belongs to that engagement follows the retention that engagement requires, rather than the 12-month inquiry rule.
Deleting a message from the mailbox does not, by itself, remove the mail provider’s backup copies. Hosting logs and provider backups may follow different schedules. The period for viewing Vercel request logs on the current Pro plan has not been confirmed. Aruba’s public terms do not state how long backups are kept.
Rights of the data subject
Anyone may write to contact@fourtyozone.dev to request, within the limits of the GDPR:
- access;
- rectification;
- erasure;
- restriction;
- objection, in particular where the basis is legitimate interest;
- portability, where processing is automated and based on a contract or on consent, and where the data allow it;
- withdrawal of consent, only where a processing activity is based on consent.
No right works in the same way for every activity. Portability is not a general tool for obtaining every email in any format, and an objection does not by itself remove a duty to retain data. A request may be refused or limited where the law allows it, with an explanation.
Withdrawal of consent, if a later activity is based on consent, does not affect the lawfulness of processing already carried out. If the consent concerned reCAPTCHA, withdrawal clears the site’s own choice, stored in localStorage under the key fz.recaptcha-consent. The submit control is removed, the form does not send, and the text already entered stays on the page. The page is not reloaded. Withdrawal does not erase data Google has already received, a cookie Google has already set, or other storage Google manages, such as a localStorage entry named _grecaptcha. A Google script that has already loaded on that page may remain until the person leaves the page, so withdrawal does not by itself end every Google process already started. The person can still write to the controller’s email address. A message sent that way is handled by the mail provider.
A complaint may be lodged with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it (Opens in a new tab)).
The controller may ask for information needed to recognize the person making the request. The website does not open an account for that purpose.
Security
The public website is served over HTTPS. The responses limit some misuse, including embedding the page in another site and how much of the previous address is sent to other sites.
The message is intended to travel encrypted to the mail server, and not into a database on the website. Access to the mailbox remains with the controller. Inquiries are checked before acceptance, including checks intended to reject malformed or automated submissions. The reCAPTCHA secret, when used, stays on the server. The application log of a contact attempt records a request identifier, the result, the request type, the page language, whether the abuse check passed, and a mail status code when sending produces one. It does not record the name, the email address, or the message text.
These measures reduce risk. They do not make the system free of incidents. Acceptance by the mail server does not, by itself, show that the message is already in the inbox.
Required and optional data
Merely reading the website does not require a form.
A request needs a request type, a name, an email address, and a message long enough to understand the request. Without those elements the form does not send.
Organization is optional, as are the contextual details tied to the request type, such as a current website, a consulting area, or a support reference. The language that is recorded is the language of the page. It is not a separate question.
If the person does not allow reCAPTCHA, the form does not send. The person can write to the email address in the controller section. A message sent that way is still handled by the mail provider. Technical data used to deliver and protect the website is not a form field. Its use depends on the infrastructure and, for reCAPTCHA, on the form being active.
Automated decision-making
The website does not carry out profiling for offers, credit, employment, or other similarly significant legal effects.
reCAPTCHA produces an automated score used to accept or refuse sending the message. Refusing to send a form is not described here as a decision about credit, employment, or a person’s legal status. Whether Article 22 of the GDPR requires further information about that score has not been determined.
Updates
This notice may be updated if the website, the providers, or the law change.