Privacy Policy
This Privacy Policy describes how the website msworks.it handles the personal data of the people who visit it. It is also provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR).
Data controller
Controller
Antonio Cirino Murabito
Certified email (PEC)
antonio.murabito@pec.it
Tax code and VAT number
MRBNNC06A05L407Y · 07344720821
Contact email
antonio.murabito@msworks.itCategories of data collected
A. Data you provide voluntarily
Sending an email to the addresses published on this site, or filling in one of its forms, is optional, explicit and voluntary, and results in us receiving the personal data you provide.
Contact form
Full name, email address and message. Needed to reply to your enquiry and manage the correspondence with you.
Newsletter
The sender's email address, needed to deliver the service.
Blog comments
Name, email address and the text of the comment, plus a non-reversible hash of the IP address for anti-abuse purposes. Comments are subject to automated moderation: see section 05.
B. Browsing data and analytics
In the course of their normal operation, the computer systems and software procedures that run this website acquire certain personal data whose transmission is implicit in the use of internet communication protocols. This site uses Vercel Analytics, a web analytics service provided by Vercel Inc. It collects aggregate statistics about how the site is used — pages visited, time on page, approximate geographic origin, device type — in order to improve performance and the user experience.
Note. Vercel Analytics does not set cookies: it recognises a visit through a hash of the request, which is discarded after 24 hours. The data collected is aggregate and does not allow individual users to be identified or re-identified.
C. Cookies
The site uses technical and essential cookies only. No profiling cookies and no third-party advertising trackers are used. For details, see the Cookie Policy.
Purposes of processing and legal basis
Personal data is processed for the purposes below. Next to each one, the legal basis that permits it.
Running the website
To ensure the site can be browsed correctly and its services used.
Performance of a contract or pre-contractual steps
Contact form
To reply to enquiries sent through the form and manage the correspondence with users, subject to explicit acceptance of this privacy policy.
Consent and legitimate interest
Sending the newsletter
To periodically send informational emails, updates or promotional material about M's Works, subject to explicit consent.
Consent
Blog comments
To publish the comment under the article, moderate its content and be able to contact its author, subject to explicit acceptance of this notice.
Consent and legitimate interest in moderation
Analytics and optimisation
To analyse site traffic in aggregate form through Vercel Analytics in order to improve performance.
Legitimate interest
Security and defence
To prevent or detect fraudulent activity or abuse that could harm the site.
Legitimate interest
How we process the data, and who receives it
Processing is carried out using computer and electronic tools, with organisational methods strictly related to the purposes stated. Besides the Controller, in some cases the data may be accessible to other people involved in running this site — administrative, sales, marketing and legal staff, system administrators — or to external parties appointed, where necessary, as Data Processors by the Controller.
The providers, and what they do
Vercel Inc.
USA · Data Privacy Framework
Provider of the hosting infrastructure and of the Analytics service.
Resend
USA · Data Privacy Framework
Platform used to manage and send the newsletter.
OpenAI Ireland Ltd.
Ireland · EU
Provider of the artificial intelligence system used for automated moderation of blog comments.
Notion Labs Inc.
USA · Standard Contractual Clauses
Internal tool used to manage contact enquiries and comments awaiting moderation.
OpenStreetMap Foundation
United Kingdom · Adequacy decision
Supplies the map imagery on the Contact page. Opening that page sends your IP address to their servers, which is technically unavoidable in order to download an image. It sets no cookies and does no profiling.
Blog comments and automated moderation
Blog articles can be commented on. To publish a comment we collect your name, email address and the text of the comment. The name and the text are public; the email address is never published and is only used so we can get back to you. We also record an encrypted, non-reversible hash of your IP address: we do not store the IP address in the clear, and the hash is used solely to limit automated submissions and abuse.
Transparency about our use of AI
Before publication, every comment is analysed by an artificial intelligence system.
The AI does not decide: if it flags a comment, that comment is not deleted but waits for a human review.
Purpose
To detect spam, advertising, insults, hate speech, sexually explicit material, unlawful content or third parties' personal data, so that the comment space stays usable and lawful.
System used
A language model provided by OpenAI (currently gpt-4o-mini), queried through an API. The data is not used to train the models.
Data sent to the provider
The text of the comment only. Name, email address and the IP hash are not sent to the artificial intelligence system.
Legal basis
The Controller's legitimate interest (Art. 6(1)(f) GDPR) in preventing abuse and unlawful content on its own pages.
No profiling
The system assesses the individual comment. It is not used to profile, classify or evaluate people, nor for any purpose other than moderation.
Human oversight and the right to a review
The automated assessment does not produce a final decision: if the system approves the comment, it is published immediately; if it flags the comment as unsuitable, or if the assessment is unavailable, the comment is not deleted but waits for a human review by the Controller, who decides whether to publish it. No decision is therefore taken solely on the basis of automated processing within the meaning of Art. 22 GDPR.
If you believe your comment was flagged by mistake, you can ask for it to be reviewed by writing to antonio.murabito@msworks.it, quoting the article and the text you submitted.
This is the only place on the site where an artificial intelligence system is used. Our broader position on the subject is set out on the Transparency about our use of AI page.
Transfers of data outside the EU
The data processed may be transferred to countries outside the EU, for example the United States for services such as Vercel or email marketing providers. Any such transfer takes place on the basis of an adequacy decision of the European Commission, such as the Data Privacy Framework, or on the basis of Standard Contractual Clauses (SCCs).
Retention periods
Data is processed and kept for as long as the purposes for which it was collected require.
Contact form data
Max 2 years
Kept for as long as needed to handle the enquiry and to meet any legal obligations.
Newsletter data
Until withdrawal
Kept until you unsubscribe.
Blog comments
12 months
The published comment and the author's name stay online for as long as the article is published, or until removal is requested. Email address and IP hash are kept for 12 months. Comments that are not approved are kept for 6 months and then deleted.
Browsing data
As long as needed
Kept for the time technically required for statistical analysis, then deleted or anonymised.
Your rights
As a data subject you have the rights set out in Articles 15-22 GDPR, including the right to:
Request access to your personal data
Request its rectification or erasure
Request that processing be restricted
Object to the processing, in particular for the newsletter
Withdraw your consent at any time
To exercise your rights, send a request to the Controller's contact details given in this document.
Write to the controller