Privacy notice
Last updated: 4 November 2026
This notice explains how personal data are processed when you visit hyrionchronicles.com or submit a business or collaboration enquiry through its contact form.
1. Data controller and website designer
The data controller for the processing described in this notice is Ignazio Romano. Ignazio Romano is also the web designer who designed and developed this website for Hyrion Chronicles.
For privacy enquiries or to exercise your rights, contact partnerships [at] hyrionchronicles.com (replace [at] with @), preferably using the subject “Privacy request”. You may contact this address directly without using the website form.
2. Personal data processed
The contact form collects your name, email address, optional company name and the message you choose to send. Subsequent correspondence may contain further information you provide. Please do not include sensitive personal information or unnecessary information about other people.
Technical data may include your IP address, request times, browser and device information, and security verification results. Hosting and security services may process connection logs to operate and protect the website. The form’s local rate limiter stores a keyed hash of the connecting IP address, an attempt count and an expiry time, rather than the raw IP address.
3. Purposes and legal bases
- Responding to enquiries and assessing proposed collaborations: our legitimate interest in managing incoming business correspondence and professional relationships (Article 6(1)(f) GDPR). If you personally request steps towards a contract with you, the relevant processing is based on Article 6(1)(b) GDPR.
- Protecting the website and mailbox against spam and abuse: our legitimate interest in securing these services and keeping the contact channel available to genuine visitors (Article 6(1)(f) GDPR).
- Meeting applicable legal obligations: Article 6(1)(c) GDPR, where an obligation requires the retention or disclosure of particular records.
- Establishing, exercising or defending legal claims: our legitimate interest in protecting legal rights (Article 6(1)(f) GDPR), where necessary.
Submitting an enquiry does not subscribe you to a newsletter. Contact details collected through this form are not used for unsolicited marketing.
4. Whether you must provide data
Sending an enquiry is voluntary. Your name, email address and message are required to use the form and allow a meaningful response; your company name is optional. Without the required information or a successful security check, the form cannot submit your enquiry. You may instead use the contact email above.
5. Service providers and recipients
Access is limited to the controller and persons authorised to assist with enquiries or technical administration, where necessary for their duties. Service providers include Fastnom for hosting and email services and Cloudflare, Inc. for Turnstile security verification. Providers processing data on the controller’s behalf are subject to the applicable data-processing arrangements. Data may also be disclosed to professional advisers or competent authorities where necessary for the purposes stated above or required by law. Personal data are not sold or published.
6. Cloudflare Turnstile
When the contact form is enabled, it uses Cloudflare Turnstile to distinguish legitimate visitors from automated traffic. Turnstile processes technical browser, device and network signals. Our server sends the verification token and connecting IP address to Cloudflare to validate the security check.
Cloudflare acts as a processor when providing this protection on our behalf and as a separate controller for certain processing to improve Turnstile’s bot detection. See the Turnstile Privacy Addendum and Cloudflare Privacy Policy for the relevant processing, retention and rights information.
7. International transfers
Cloudflare operates internationally, so technical data may be processed outside the European Economic Area, including in the United States. Applicable transfer safeguards are described in Cloudflare’s Data Processing Addendum, including EU Standard Contractual Clauses where applicable. You can contact the controller for further information about the safeguards relevant to this website and how to obtain a copy.
8. Retention
Enquiries and related correspondence are retained for the time needed to respond, assess the proposal and complete any resulting discussions. Once that purpose ends, they are deleted unless a continuing business relationship, a specific legal obligation or a necessary legal claim justifies further retention. In those cases, retention is limited to the applicable obligation or the period necessary to manage that relationship or claim, with periodic review of whether the records remain necessary.
Local rate-limit entries expire after one hour and are removed on the next eligible form submission that triggers cleanup; they may remain stored longer if no such request occurs. Hosting logs, security-service data and backup copies follow the relevant provider’s retention settings and deletion cycles. Further information about the applicable settings is available from the controller.
9. Your rights
Subject to the conditions set out in the GDPR, you may request access, rectification, erasure or restriction of processing. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Data portability applies where its legal conditions are met, including automated processing based on consent or contract.
Send requests to the controller using the address in section 1. Proportionate information may be requested to verify your identity. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), or the competent supervisory authority where you live, work or consider an infringement has occurred.
10. Automated checks, cookies and external links
Automated anti-abuse checks can reject a form submission. This website does not use automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR.
The landing page does not include analytics, advertising trackers or an embedded YouTube player. Technical security functions may use browser technologies necessary for their operation, as explained in the relevant provider documentation. Links to YouTube and other external websites take you to services governed by their own privacy notices.
11. Updates
This notice may be updated when the website’s processing activities change. The date above identifies the latest revision.
