From threat to decision
Strategic Cyber Threat Intelligence, cyber geopolitics, and AI Risk for boards and organizations making decisions in complex, dynamic, and highly uncertain environments.
Privacy Policy
1. Data Controller
The Data Controller is Federica Bertoni. Email: federica.bertoni@federicabertoni.com. Certified email (PEC): bertonifederica@pec.it.
2. Types of data processed
This site may process the data necessary to enable normal browsing, handle contact requests, and potentially establish professional relationships. In particular:
- identifying information, such as first and last name;
- email address and, where applicable, organizational affiliation;
- information voluntarily included in messages sent by email;
- technical browsing data, such as IP address, browser, operating system, and technical logs;
- your preference choice and, only if authorized, local storage of accessibility settings, as described in the cookie and preferences policy.
The pages do not contain a submission form: the email link opens the user’s email application. Providing contact information is optional, but the data needed to respond to a request must be available for that request to be handled.
The site does not intentionally collect special categories of personal data within the meaning of Article 9 GDPR, unless the data subject voluntarily provides such information. During initial contact, please avoid sending confidential data or documents that are not necessary to assess your request.
3. Purposes of processing
Personal data is processed to respond to information requests, assess requests for professional collaboration, organize meetings, consultations, research, or training activities, manage professional relationships, ensure the site’s technical security, comply with legal obligations, and protect the Data Controller’s rights.
No automated decision-making or profiling is carried out through these pages.
4. Legal basis for processing
- Requests concerning engagements and professional relationships: taking pre-contractual steps at the data subject’s request or performing a contract, pursuant to Article 6(1)(b) GDPR.
- Legal obligations: compliance with obligations to which the Data Controller is subject, pursuant to Article 6(1)(c) GDPR.
- General correspondence, security, and protection of rights: legitimate interests in managing correspondence, protecting the site, and safeguarding the Data Controller’s rights, within the limits of Article 6(1)(f) GDPR and balanced against the data subject’s rights.
- Optional storage of accessibility settings: consent to storage on the device, pursuant to Article 122 of Italian Legislative Decree 196/2003, given in the “Cookies and preferences” panel. This consent may be withdrawn at any time. The technical record of the choice serves to respect it, falls within the exemption for strictly necessary functions, and does not enable profiling.
Accepting optional preferences is not required to contact the practice or receive a response.
5. How data is processed
Data is processed using electronic tools and organizational arrangements appropriate to ensuring its confidentiality, integrity, availability, and security. Reasonable technical and organizational measures are adopted to prevent unauthorized access, loss, alteration, or disclosure of information.
6. Data retention
Data is retained for as long as necessary to achieve the purposes for which it was collected, or for the period required by applicable law. For correspondence, the retention period is determined by the time needed to handle the request, any subsequent developments in the professional relationship, and the need to protect rights. Contact requests that do not lead to a professional relationship are periodically deleted.
Your preference choice is stored in your browser for 6 calendar months. Accessibility settings, if authorized, have the same expiration date and are deleted sooner if permission is withdrawn. Details are provided in the cookie and preferences policy.
7. Recipients and technical infrastructure
Personal data is not made public. It may be disclosed to parties working with the Data Controller for purposes strictly related to the technical management of the site or the provision of professional services, in accordance with applicable law and confidentiality obligations.
The site is delivered through Cloudflare’s infrastructure. Managing and protecting web requests involves processing technical connection data, such as IP addresses. The hosting provider’s technical security functions are distinct from the site’s optional preferences. Information about the provider’s services is available in Cloudflare’s privacy policy and its cookie documentation.
Accessibility choices stored by the site remain on the device: the scripts do not transmit them to the Data Controller or to third parties and do not detect assistive technologies to infer personal circumstances.
8. International transfers
Cloudflare’s infrastructure operates internationally; technical data processing may involve countries outside the European Economic Area. Information about the provider’s processing and transfers is available in its privacy policy. You may contact the Data Controller for information about the safeguards applicable to the processing of your data.
Where specific professional activities require personal data to be processed outside the European Economic Area, such processing must comply with the GDPR and the safeguards required by applicable law.
9. Data subject rights
Subject to the conditions set out in Articles 15–22 GDPR, data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, and data portability, and may withdraw any consent given without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to federica.bertoni@federicabertoni.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
10. Cookies and browsing preferences
The site’s pages do not directly set cookies or include traffic analytics or profiling tools. The site uses the browser’s local storage to remember your choices and, only if authorized, your accessibility settings. For purposes, duration, the hosting provider’s technical tools, and how to change or withdraw your choices, see the cookie and preferences policy.
11. Information security
Protecting information is a fundamental principle of the professional activities conducted through this site. Appropriate technical and organizational measures are adopted to reduce the risk of unauthorized access, loss, alteration, or disclosure of personal data.
12. Policy updates
This Privacy Policy may be updated to reflect changes in legislation, technology, or the organization of the professional practice. The version published on this page is the current version. Any new optional tools will require an updated policy and specific consent where necessary.
13. International professional activities
The professional activities described on this site may, where appropriate, also be carried out through international collaborations or under a UAE Freelance License – Web3 Consultant, in accordance with applicable law and the relevant scope of professional practice.
The use of such working arrangements does not in any way alter the principles of lawfulness, fairness, transparency, minimization, security, and confidentiality governing the processing of personal data, nor does it entail international data transfers outside the conditions and safeguards required by applicable law.