This notice covers a site without accounts, comments, newsletters, forms or direct payments, delivered through Cloudflare, with Google Analytics 4 enabled only after consent.
1. Controller and contact
Processing connected with the Subject Unknown website is managed by the operator of the editorial project of the same name. Privacy contact and website: info@subject.report — https://subject.report.
2. Data processed
During browsing, infrastructure and network/security services may process IP address, date and time, requested resource, referrer, user agent, browser, operating system, device, response codes, technical logs and security events.
Cloudflare Web Analytics collects aggregate performance data without cookies or browser storage. Cloudflare states that the IP address received with a beacon request is discarded at its data centre and is not stored in its analytics logs or databases.
Only after consent, Google Analytics 4 may process online identifiers, pages and navigation events, session duration and manner, approximate origin, and browser/device information. Advertising features, remarketing, Google Signals and User-ID are disabled; Google Ads is not linked and directly identifying data is not sent.
If a user emails info@subject.report, the address, message and communication metadata are processed to answer and manage the request.
3. Purposes, legal basis and retention
- Site delivery, stability and diagnosis: performance of the requested service and legitimate technical interest; Cloudflare Workers logs are retained for up to 7 days depending on plan and configuration.
- Protection through Cloudflare Bot Fight Mode/Bot Management and challenges: legitimate security interest; technical data and cookies follow the duration of the activated feature.
- Google Analytics 4: consent; user- and event-level data retention set to 2 months.
- Voluntary email: the user’s request or legitimate interest in correspondence; for as long as necessary, and longer only for legal obligations or the protection of rights.
4. Recipients and providers
Data may be processed as necessary by Cloudflare, Inc. for hosting/delivery through Cloudflare Pages and Workers, performance, Web Analytics and security; Google Ireland Limited for GA4 only after consent; the email provider for communications; and advisers or authorities when required.
5. International transfers
Cloudflare and Google are part of international groups. Transfers or access outside the EEA rely on the safeguards declared by the providers, such as applicable adequacy decisions and/or standard contractual clauses with supplementary measures where appropriate.
6. Cookies and preferences
Google Analytics is blocked until consent. Refusal does not restrict content. Consent can be changed or withdrawn at any time through “Manage preferences”; withdrawal stops future events and attempts to remove Analytics cookies set on the domain.
7. Rights
Where provided by Regulation (EU) 2016/679, individuals may request access, correction, erasure, restriction, portability and objection, and may withdraw consent. Requests should be sent to info@subject.report. A complaint may also be lodged with the Italian Data Protection Authority.
8. Required data and children
Essential technical data is required to deliver and protect the site. Analytics is optional. The project is not specifically directed at children and does not knowingly request their personal data.
9. Changes
This notice will be updated when processing, providers or configurations change. The date above identifies the current version.