Privacy Policy

Website: https://mpapini.com
Last updated: 24/10/2026

This policy explains what we do with your personal information when you visit mpapini.com, use the contact form, or contact us by email or WhatsApp. It follows the General Data Protection Regulation of the European Union (GDPR) and the Data Protection Act 2018 of Ireland.

This policy covers:

1. Who we are and how to contact us

Data controller	Murilo Denardi Papini, based in Dublin, Ireland
Email	[email protected]
Telephone	+353 (83) 080 8044
Website	https://mpapini.com
Data Protection Officer (DPO)	Murilo Denardi Papini, at the same email address and telephone number above. For any privacy matter, contact him.

This website is a professional portfolio. You can browse it and contact us about services, agency collaborations or job opportunities.

2. What information we use, why, and our lawful basis

By law, we may only use personal information if we have a "lawful basis" (Article 6 GDPR). Below is each situation in which this happens on this website.

Situation	Information	Why we use it	Lawful basis
Contacting us through the form	Your name, email address, message and the language of the page you were on.	To understand and reply to your enquiry, for example about services, collaborations or job vacancies. You are not automatically added to any marketing list.	Taking steps at your request before a possible contract (Article 6(1)(b)) and our legitimate interest in replying to professional enquiries (Article 6(1)(f)).
Contacting us by email, telephone or WhatsApp	What you send us: your name, telephone number or email address, and the content of the conversation.	To reply to your enquiry.	The same bases as the form.
Protecting the form against automated messages (spam)	Technical information about your browser and connection, analysed by Cloudflare Turnstile. Our server also keeps counters with pseudonymised identifiers of the connection address (IP) and of the email address entered, in windows of 15 minutes to 24 hours.	To check that the sender is a person and to limit abuse. Your name, email and message are not sent to Cloudflare. We do not use this for advertising or profiling.	Our legitimate interest in protecting the website and the form against abuse (Article 6(1)(f)).
Visit statistics (only if you accept)	A random online identifier (cookie), IP address, approximate location, pages visited (browsing journey), device and browser type, and how you arrived at the website, processed by Google Analytics 4 and loaded by Google Tag Manager.	To measure how many people visit the website and which pages are viewed, so we can improve it. We receive aggregated statistical reports.	Your consent (Article 6(1)(a)). You can withdraw it at any time, as explained in the Cookie Policy.
Website fonts (Google Fonts)	Your IP address and browser data, which your browser sends to Google to download the fonts (DM Sans and Barlow Condensed).	To display the website with the chosen typography. No cookie is set for this.	Our legitimate interest in displaying the website with the chosen typography (Article 6(1)(f)).
Google Search Console	Aggregated data that Google itself collects in its search engine, such as search terms and clicks. It installs nothing in your browser.	To see how the website appears in search results.	It does not identify you and involves no personal data of yours that we process directly.
Hosting technical records	HostGator states that it collects information about the use of the service and of devices, such as the IP address. Its documents do not detail which records it keeps.	To deliver and protect the hosting service.	Our legitimate interest in keeping the website hosted and protected (Article 6(1)(f)).

What we do not do. The website has no user accounts, newsletter, advertising or social media pixels. We do not make automated decisions about you or build profiles for advertising. We do not ask for sensitive data (such as health, ethnic origin or religion): please do not include it in your message.

Do you have to provide this information? The form is voluntary. But without a name, email address and message we cannot receive or answer your enquiry; you can use email or WhatsApp instead. Refusing analytics cookies does not stop you from using the website.

3. Your data protection rights

Depending on the situation and the lawful basis, you have these rights:

Access: to ask for copies of the personal information we hold about you, and to know where it comes from and who we share it with.
Rectification: to ask us to correct information you think is inaccurate or incomplete.
Erasure: to ask us to delete your personal information.
Restriction: to ask us to limit how we use your information.
Objection: to object to processing carried out on the basis of legitimate interests.
Portability: to ask that the information you gave us be transferred to you or to another organisation.
Withdrawing consent: where consent is the lawful basis (analytics cookies), you can withdraw it at any time, without affecting what was done before.

There are exceptions that may mean you do not receive everything you ask for. To exercise any right, write to [email protected], stating the right in the subject line. We will reply without undue delay and in any event within one month (Article 12(3) GDPR). As a rule, we do not charge anything.

4. Where we get information from

Directly from you: when you fill in the form or contact us by email, telephone or WhatsApp.
Automatically from your browser: the technical information described in section 2 (anti-spam check, fonts and, only if you accept, analytics).

We do not obtain information about you from other sources.

5. Who we share it with

We do not sell your information. We share it only with those needed for the website to work:

Who	What they do	Information involved
HostGator Brasil LTDA (CNPJ 15.754.475/0001-40), Florianópolis, SC, Brazil. Hosting and sending of the form email	Hosts the website and sends the form message to our email over an encrypted SMTP connection. There is no third-party email API. HostGator acts as a processor: it processes data on behalf of the website, under its terms of service.	Name, email, message and language from the form; technical access data.
Google (Gmail)	The inbox [email protected], where messages arrive.	Messages received and replies sent.
Cloudflare, Inc. (Turnstile)	Anti-spam check on the contact page.	Technical information about the browser and connection.
Google (Google Analytics 4 and Google Tag Manager)	Visit statistics, only with your consent.	Online identifier, IP, approximate location, pages visited, device and browser.
Google (Google Fonts)	Delivers the website's fonts.	IP address and browser data.

We may also share information with public authorities, where the law requires it, and with professional advisers, where necessary to meet legal obligations or defend legal claims.

Links to WhatsApp, email, LinkedIn, Instagram and Behance open third-party services that we do not control and that have their own privacy policies. They are not embedded in this website.

6. Transfers outside Europe

Some providers process information outside the European Economic Area (EEA), so international transfers take place. They happen because these services operate in other countries. For them to be lawful, the GDPR requires a protection mechanism, such as an adequacy decision of the European Commission (Article 45) or the standard contractual clauses approved by the Commission (Article 46).

Provider	Where it may process information	Protection mechanism
Google (Analytics 4, Tag Manager, Fonts and Gmail)	The United States and other countries where Google has data centres.	Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection. Where this does not apply, Google uses standard contractual clauses.
Cloudflare, Inc. (Turnstile)	The United States and other countries where Cloudflare operates.	Cloudflare is certified under the EU-U.S. Data Privacy Framework. If the certification ceases to be valid, it relies on standard contractual clauses.
HostGator Brasil LTDA (hosting)	The United States. According to HostGator, teams in the Netherlands, the Philippines and India may also process the information.	HostGator states that it takes all reasonably necessary measures to ensure data is handled securely. It does not publicly state which transfer mechanism it uses.

To find out more about these safeguards or to request a copy, write to the email address in section 1. For hosting, we will ask HostGator for these details.

7. How long we keep it

Information	Retention period
Form messages and conversations by email, telephone or WhatsApp	Up to 1 year after the last contact, unless a contract is entered into or there is a legal obligation to keep them for longer. After that, we delete them.
Anti-abuse counters for the form	Windows of 15 minutes to 24 hours. Expired records are removed the next time the relevant file is used.
Analytics data, cookie choice and language	The period for each cookie and the retention in Google Analytics are in the Cookie Policy.
Hosting technical records	Set by HostGator, which does not publish the retention period for these records.

Where there is no fixed period, we keep information only for as long as needed for the purpose for which it was collected. To find out more about retention periods or the criteria we use, write to the email address in section 1.

8. Security, children, third-party links and cookies

Security. We use technical and organisational measures appropriate to the risk (Article 32 GDPR). For the form: anti-spam verification, field validation, a limit on attempts, an encrypted connection (HTTPS), encrypted email delivery and a fixed recipient that the visitor cannot change. The server does not store the text of messages in a database or in application logs. If a personal data breach occurs that must be reported, we will notify the Data Protection Commission and the people affected in the cases and within the time limits set by law (Articles 33 and 34 GDPR).

Children. The website is a professional portfolio and is not aimed at children. We do not knowingly collect information from children.

Cookies. The website uses cookies and similar technologies. The Cookie Policy explains which ones they are, what they are for and how to accept or reject them or withdraw your consent.

9. How to complain

If you have any concerns about how we use your information, please contact us first at [email protected]. If you remain unhappy, you have the right to lodge a complaint with a data protection authority (Article 77 GDPR). In Ireland, this is the Data Protection Commission:

Data Protection Commission
6 Pembroke Row
Dublin 2, D02 X963
Ireland
Website: dataprotection.ie
Complaints: forms.dataprotection.ie/contact (in writing, through the online form)

You can also complain to the authority of the European Union country where you live or work.

10. Changes to this policy

We will update this policy when there are relevant changes to how we use personal information. The date of the current version appears at the top. If a change requires your consent, we will ask for it before using it.