Privacy Policy

The data controller responsible for your personal data is:

Information you give us. When you book a discovery call through our scheduling page or contact us directly, we collect your name and email address, plus any details you choose to share about your project.

Information collected automatically. We may use privacy-respecting website analytics (e.g. pages visited, referring source, approximate device/browser type) to understand how the site is used. Where consent is required, this is gathered through our cookie banner.

What we do not collect. Payment information, government IDs, precise geolocation, biometric or other sensitive personal data. We do not run tracking pixels or build advertising profiles.

• To respond to your inquiry and schedule meetings.
• To follow up on conversations you’ve started with us.
• To understand, in aggregate, how the website is used and improve our content.
• To comply with legal obligations where applicable.

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing.

Where the GDPR applies, we rely on the following legal bases:

• Consent — for non-essential cookies and analytics, managed via our cookie banner.
• Legitimate interest / pre-contractual steps — when you reach out about working with us.
• Legal obligation — where required to comply with the law.

We use a small number of trusted providers to operate this site. Each one is bound by its own privacy terms.

• Cookiebot — manages cookie consent and stores your consent record.
• Discovery-call scheduling — bookings made via book.stefanodecillis.com are processed by our self-hosted scheduling service to confirm the meeting and send calendar invitations.
• Web hosting — the site is served via a hosting provider that may process limited technical logs (e.g. IP address) for security and abuse prevention.

Cookies and similar technologies are described in detail in our cookie banner (managed by Cookiebot), which lets you accept or reject non-essential categories. You can change your preferences at any time by reopening the banner.

We keep your data only as long as we need it:

• Inquiries & booking data — for as long as needed to communicate with you, and for up to 24 months afterwards for record-keeping, unless you ask us to delete it sooner.
• Analytics data — retained in aggregated form for up to 14 months.
• Consent records — stored as required by Cookiebot for compliance evidence.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• request correction or deletion of it;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent at any time;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at [email protected]. Because we’re established in Malta, our lead supervisory authority is the Office of the Information and Data Protection Commissioner (IDPC), but you may also contact the supervisory authority in your country of residence.

We apply reasonable technical and organizational measures to protect the information you share with us. No system is perfectly secure, but we keep our footprint small and limit who can access your data.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent version. Material changes will be highlighted on this page.

Questions about this policy or how we handle your data? [email protected]