Web Site Privacy Policy

This policy explains which personal data the website ottob.it collects, why, how long we keep it and which rights you have. It is provided under articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the Italian Legislative Decree 196/2003 (“Privacy Code”). For our games, see the App Privacy Policy.

1. Data controller

Filippo Bodei (OTTOBIT)
Desenzano del Garda (BS), Italy
VAT IT03625590983
Email: hello@ottob.it

Write to this address for any question about this policy or to exercise your rights.

2. Which data we process and why

2.1 Browsing data

Like any website, when you visit ottob.it the infrastructure hosting it automatically receives some technical data: IP address, browser and operating system, requested page, date and time of the request, response status. The site is hosted on Cloudflare, which processes this data to serve the pages and to protect the site from attacks and abuse.

• Purpose: running the website, security and abuse prevention.
• Legal basis: our legitimate interest in keeping the site working and secure (art. 6(1)(f) GDPR).
• Retention: only as long as strictly needed for these purposes, according to Cloudflare’s log retention. We do not use this data to identify you or to build profiles.

2.2 Data you send us with the contact form

If you write to us with the form on the Contact page, we process what you enter: name, email address, subject (optional) and the message. The message reaches us by email in our mailbox. The same applies if you write to us directly at hello@ottob.it.

• Purpose: replying to your request.
• Legal basis: steps taken at your request (art. 6(1)(b) GDPR) and our legitimate interest in replying to people who contact us (art. 6(1)(f) GDPR). We do not ask for your consent, because it is not needed to answer a request you made.
• Providing the data: name, email and message are needed to reply to you. The subject is optional.
• Retention: 24 months from our last exchange, unless the law requires us to keep it longer.

We never use the data from the form to send you newsletters or promotional messages you did not ask for.

2.3 Anti-spam protection of the form

To keep automated programs from abusing the form, the Contact page uses Cloudflare Turnstile. It looks at some technical signals (IP address, TLS connection fingerprint, browser type) to tell people from bots, without asking you to solve puzzles. We also limit how many messages the same IP address can send in a short time.

• Purpose: security of the form, preventing spam and abuse.
• Legal basis: our legitimate interest in the security of the site (art. 6(1)(f) GDPR).
• Retention: the data is processed by Cloudflare only as long as needed for the check. According to Cloudflare’s Turnstile privacy addendum, these signals are used only to recognize automated traffic, not to identify, profile or track people.

3. Cookies and similar technologies

The site does not use profiling or advertising cookies, nor analytics tools (such as Google Analytics), and sets no cookies of its own. Fonts are served by the site itself, without external services such as Google Fonts.

The only tools present are technical:

• on the Contact page only, Cloudflare Turnstile stores in your browser a technical value needed for the anti-spam check (in the localStorage of the challenges.cloudflare.com domain);
• in case of suspicious traffic, Cloudflare may set technical security cookies to protect the site.

These are strictly necessary for the site to work securely. Under art. 122 of the Privacy Code and the Italian Data Protection Authority’s cookie guidelines of 10 June 2021, they do not require your consent, so the site shows no banner. You can still delete or block cookies and stored data from your browser settings.

Links to app stores, Ko-fi and social networks are plain links: nothing is loaded from those services until you click them, and from then on their own privacy policies apply.

4. Who can access the data

The data is processed by OTTOBIT. In addition, the providers of the technical services we need may process it on our behalf, as processors under art. 28 GDPR:

• Cloudflare, Inc.: website hosting, content delivery network, security, anti-spam protection (Turnstile) and delivery of the contact form messages and of the email sent to hello@ottob.it;
• Microsoft Ireland Operations Limited (Outlook.com): the mailbox where messages to hello@ottob.it and from the contact form are forwarded, received and kept.

The data is not disclosed to the public or sold to third parties. It may be shared with the competent authorities only when the law requires it.

5. Transfers outside the European Union

Cloudflare, Inc. is based in the United States. Microsoft Ireland Operations Limited is based in Ireland, but Outlook.com data may also be processed by other Microsoft companies, including Microsoft Corporation in the United States. In both cases the data may therefore be transferred outside the European Economic Area. The transfer relies on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, which both Cloudflare and Microsoft have joined, and on the Standard Contractual Clauses approved by the Commission.

6. Your rights

At any time you can ask us for access to your personal data, its rectification or erasure, the restriction of processing, data portability, and you can object to processing based on our legitimate interest (articles 15 to 21 GDPR). Just write to hello@ottob.it.

If you believe your data is processed unlawfully, you also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work.

7. Changes to this policy

We may update this policy, for example if the site or the services we use change. The current version is always on this page, with the date of the last update at the top.