Legal

Privacy Policy

How tashiardit.com handles personal data.

Last updated: 5 September 2026.

Who is responsible. This site is operated by Ardit Tashi, Milan, Italy. For any question about your data, use the contact form or the email address in the footer.

What is collected

When you use the contact form. Your name, email address and message. These are transmitted to my mailbox via Brevo (Sendinblue), an email provider based in the EU, and are used only to reply to you. They are not added to a mailing list and are not sold or shared.

When you simply browse. Counts of pages viewed, approximate country, referring site and device type, collected by Cloudflare Web Analytics. Nothing is stored on your device and no identifier is created, so these figures cannot be traced back to you or joined up across visits.

Only if you allow it — Google Analytics. If you choose Allow on the cookie notice, Google Analytics 4 also runs. It sets _ga cookies that let Google recognise the same browser returning, and it sends Google your truncated IP address, the pages you view, and general device and location information. It is off until you choose it: the page tells Google that analytics storage is denied before any Google code loads, so declining means no Google request is ever made and no cookie is ever set. Advertising and personalisation signals are refused in all cases, and Google Signals — which would link browsing across your devices — is not enabled.

Replying to your enquiry is processing necessary to take steps at your request (GDPR Art. 6(1)(b)).

Cookieless visit counts rest on legitimate interest in knowing how the site is used (Art. 6(1)(f)); they involve no storage on your device, so no separate consent is required for them.

Google Analytics runs only on your consent (Art. 6(1)(a), and Art. 5(3) of the ePrivacy Directive for the cookies themselves). You can withdraw that consent at any time, as easily as you gave it, from Cookie settings at the foot of any page — which stops the collection and deletes the _ga cookies already set.

How long it is kept

Contact messages are kept as long as the conversation is useful, and deleted on request.

Cloudflare's visit counts contain no personal data. In Google Analytics, event data is deleted after 2 months (the shortest period Google offers) and user-level data after 14 months, and the _ga cookies it sets expire after two years unless you clear them or withdraw consent first.

Who else sees it

  • Cloudflare — hosting, content delivery and cookieless visit counts; processes IP addresses to serve the site and block abuse.
  • Brevo — delivery of contact-form messages.
  • Google (Google Ireland Ltd, with processing also in the United States) — only if you allow analytics. Transfers outside the EEA rely on Google's certification under the EU–US Data Privacy Framework and on the standard contractual clauses in Google's terms.
  • Heyzine — the portfolio and thesis flipbooks are embedded from Heyzine and load from its servers when you open a page containing one.
  • Instagram, LinkedIn — only if you click through to those platforms.

No data is sold, and none is used for advertising or profiling.

Your rights

Under the GDPR you may request access to your data, correction, deletion, restriction of processing, portability, or object to processing. Where processing rests on your consent, you may withdraw it at any time without giving a reason and without affecting what was lawfully done beforehand — for analytics, Cookie settings at the foot of any page does exactly that. Write to me and I will act within 30 days. You may also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Links to my other websites carry a source tag (a utm_source parameter) so I can see that a visit came from this portfolio. It records the source of the visit, not who you are.

I use a private, self-hosted keyword-research tool for my own websites. It reads aggregate keyword statistics from Google's Keyword Planner through the Google Ads API, using a Google Ads account and a Google sign-in that belong to me. This page is linked from that tool's Google API registration because Google requires any application using its API to publish a privacy policy.

That tool concerns my accounts and my sites only. It does not run on this website, it does not collect, store or process any data about you as a visitor, and nothing about your visit here is sent to it or to Google through it. The Google data it reads is search statistics, not information about people. Google's handling of my own account is governed by Google's privacy policy.