Privacy notice

Who is responsible

The data controller is Mario Gramegna, the author of Cardiodrome. Contact: contacts@cardiodrome.com.

What data

Through the early access form: name, role, institution, email address, whether you are asking on behalf of a training program, a course or a shock team, whether you want news, your suggestion or request if you write one, the language of the page and, when present, where you came from: the code of the link you followed (for example “linkedin”) or, without one, the referring site (for example “linkedin.com”), with the date of the request and the version of this notice.

The database of requests does not store your IP address or information about your browser.

Why, and on what legal basis

Sending you the link and managing your access: your request (Art. 6(1)(b) GDPR).

News: your consent, if you tick the box (Art. 6(1)(a)); you can withdraw it at any time by replying to any email or writing to the address above, without affecting what was done before.

Understanding who is interested (roles, institutions, number of requests), counting visits, and reading suggestions and requests, to decide how to develop the project, and protecting the site: legitimate interest (Art. 6(1)(f)).

There is no profiling, no automated decision-making and no marketing on behalf of others.

Who handles the data

Only the controller reads the requests. The site, the form and the database run on Cloudflare, Inc., which acts as a processor. Cloudflare may process data in the United States: the transfer is covered by the EU–US Data Privacy Framework, to which Cloudflare adheres, and by the Standard Contractual Clauses of the European Commission.

Messages to the contact address are forwarded by Cloudflare to the author’s Gmail mailbox, from which the link, news and replies are sent, possibly from the author’s personal address. Gmail is a service of Google Ireland Limited; Google may process emails in the United States, under the EU–US Data Privacy Framework.

Data are not sold or passed on to anyone else.

Technical data, cookies and storage

To deliver the site and protect it from abuse, Cloudflare processes the IP address and the technical data of each request in its own systems (legitimate interest, see above).

To count visits, the site pages use Cloudflare Web Analytics: a script records which page is viewed, the referring site, the country, the type of device and browser, and how fast the page loads. It sets no cookies and stores nothing on your device, and I only see aggregated numbers, never individual visitors. The site itself also counts, for each day, how many times the home page is opened from each link code or referring site: only that number, with nothing about who opened it.

Cardiodrome uses no analytics, advertising or profiling cookies. It sets one technical cookie of its own, “cd_invite”, only when you open the simulator with an invitation link, to keep your access for up to one year. Cloudflare may set its own technical security cookies when it needs to filter automated traffic. The simulator saves your preferences and an offline copy of itself on your device; these stay on the device. Technical cookies and storage do not require consent.

How long

Until you ask for deletion, and in any case no longer than 24 months after your last request: the database of requests then deletes them automatically, and emails exchanged with you are deleted within the same period. If you withdraw your consent to news, you stop receiving them.

Your rights

You can ask for access to your data, their correction or deletion, restriction of processing and data portability, and you can object to processing (Articles 15–21 GDPR), by writing to the address above.

Right to object: you can object at any time, for reasons relating to your situation, to processing based on legitimate interest, by writing to the address above.

You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work.

Is it mandatory?

Name and email are needed to give you access and to reach you about it; role and institution tell us who is interested. Without them the request cannot be sent. The news box is optional.