Your data, in plain words.

Who processes the data

If you only read this

Rorò asks nothing of you and uses no cookies, neither for profiling nor for advertising. Like every website, the server receives your IP address so it can send you the page.

Two things stay saved only in your browser and never reach us: the shopping list you tick off in the recipe and the list of photos you have sent, with the code needed to remove them.

Statistics

To know how many people read Rorò, we count visits, without cookies and without external services. Of each visit only daily totals remain: which page, which site you come from (for example Google or Instagram), the country, and whether you use a phone or a computer.

To count different people in a day, we use a code derived from your IP address and your browser, with a key that changes every day. It can’t be used to recognize you and is deleted after two days. We do this out of a legitimate interest: understanding how many people read the site (Art. 6(1)(f) GDPR).

If you send a photo

Sending a photo is optional. If you do, we collect:

• the photo. Before it is sent, the page redraws it and removes the GPS location and other hidden data, such as the phone model;
• the name and the dedication (“who did you make it for”), only if you write them;
• the date of the upload;
• a code derived from your IP address, not the address itself. It is used only to limit uploads to 6 per day per person.

If you report a photo, we save the same kind of code, so that each person counts only once.

If you email Giacomo

At the bottom of the recipe you can send Giacomo a suggestion for the page. Your email program opens: if you send the email, Giacomo receives your address, the name you write with and what you write. He uses them only to read the suggestion and, if needed, to reply to you.

Why, and on what basis

• Publishing the photo in the gallery: with your consent (Art. 6(1)(a) of EU Regulation 2016/679, the GDPR), which you give when you send the photo. If there are other people in the photo, you confirm that they agree. For minors, their parents must agree. If you are under 14, a parent must send the photo.
• The upload limit and reports: to keep the gallery free of spam and abuse, which is a legitimate interest (Art. 6(1)(f)).
• Emails with suggestions: to read them and reply to you, which is a legitimate interest (Art. 6(1)(f)).

No automated decisions are made: Giacomo looks at every photo before publishing it.

Who sees the data

• Anyone who visits the site sees the approved photos, with the name and dedication if you wrote them.
• Giacomo sees the pending photos, to approve or reject them.
• Google LLC, if you write an email: Giacomo’s mailbox is on Gmail. Google too may transfer data to the United States, with the safeguards provided by the GDPR.
• Cloudflare, Inc. hosts the site, the database, the photos and the statistics, and runs the anti-bot check (Turnstile). It is the provider that processes data on Giacomo’s behalf. It may transfer data to the United States with the safeguards provided by the GDPR (EU-US Data Privacy Framework and standard contractual clauses).

The data is not sold or used for advertising.

For how long

• Published photos: until you remove a photo, ask for it to be removed, or the gallery closes.
• Rejected photos: deleted immediately, along with the name and dedication.
• The code derived from the IP address for photos and reports: deleted together with the photo or report it is linked to.
• Emails: they stay in Giacomo’s mailbox for as long as they are needed. You can ask at any time for them to be deleted.
• The statistics code: two days. The daily totals, which contain no personal data, are kept.

What you can do

• Remove your photo yourself, at any time, from the gallery: “Your photos,” then “Remove.” This works from the same phone or computer you sent it from.
• Write to Giacomo to see, correct or delete your data, or to have a photo you appear in removed, even if someone else sent it.
• Withdraw your consent whenever you like: the photo is removed. What was done before remains valid.
• Object to processing carried out on the basis of legitimate interest, such as the statistics.
• Lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority; garanteprivacy.it).

For all requests: giacomo.rocchetti.mi@gmail.com. You will get a reply within one month.

Last updated: November 2, 2026.