Last updated: 2 October 2026

1. Data controller

Raoul Graziano. For any request about your data, write to business@raulhartzen.com.

2. What data I process, why and for how long

Browsing and security

The site is hosted on Cloudflare, Inc. (USA), which processes technical data such as IP address, browser, requested page and time to deliver the pages and protect them from attacks. Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). I keep no browsing logs.

Anti-spam protection

To block automated submissions, before you subscribe to the newsletter your browser solves a small calculation generated by this site's server (proof-of-work). It uses no cookies, collects no data and involves no third parties. Requests that come too often from the same IP address are blocked for a few seconds by Cloudflare and for one minute by the site's server, which for this purpose keeps a counter linked to the IP address for up to 24 hours. Legal basis: legitimate interest in security (Art. 6(1)(f) GDPR).

Contact by email

If you write to business@raulhartzen.com, I use your email address and the content of your message only to reply to you. Legal basis: your request (Art. 6(1)(b) GDPR). I keep messages as long as needed to handle the request and no longer than 24 months. The site has no contact forms.

Newsletter

If you subscribe, your email address is stored with MailerLite (MailerLite Limited, Ireland, data stored in the European Union) to send you releases and news. Legal basis: your consent (Art. 6(1)(a) GDPR), confirmed by a verification email (double opt-in). You can withdraw it at any time with the unsubscribe link in every email; data is kept until you unsubscribe. The emails contain no open or click tracking. The newsletter is only for people aged 16 or over.

Artwork and downloads

Track lists, artwork and audio files are fetched from SoundCloud and YouTube by this site's server and then sent to you. Your browser does not connect to SoundCloud or YouTube to show or download them, and those services do not receive your IP address.

YouTube and SoundCloud players

The players load only if you consent in the cookie banner or press the play button of a single player, which is labelled with what happens next. From that moment your browser connects to YouTube (Google) or SoundCloud, which may set cookies and process your data as independent controllers, also outside the EU. Legal basis: the consent you give by clicking (Art. 6(1)(a) GDPR). You can consent for all players from the cookie banner, or load a single player by pressing play. Consent given in the banner lasts 6 months and you can withdraw it at any time from “Cookie settings” at the bottom of every page; if you reject or close the banner, the players stay blocked until you press play on one of them. Policies: Google, SoundCloud.

3. Cookies and local storage

The site uses no analytics, profiling or advertising cookies. It only uses the following technical tools, which do not require consent:

Name	Type	Purpose	Duration
userLanguage	Browser local storage	Remembers the language you picked from the menu. Saved only when you pick a language.	Until you clear browser data
consentMedia	Browser local storage	Remembers your choice about external players in the cookie banner.	6 months
followedYoutube	Browser local storage	Remembers that you opened the YouTube channel link, to show the downloads.	Until you clear browser data
__cf_bm	Cloudflare technical cookie	Bot protection (Bot Fight Mode). Does not identify you.	30 minutes of inactivity
cf_clearance	Cloudflare technical cookie	Remembers that you passed a security check, only if Cloudflare showed you one.	Up to 30 minutes

Local storage data stays on your device and is not sent to anyone. You can delete it from your browser settings. Any YouTube and SoundCloud cookies are covered in "YouTube and SoundCloud players".

4. Providers and transfers outside the EU

I use these providers as data processors, under their data processing agreements:

• Cloudflare, Inc. (USA), hosting and security: transfer based on the EU-US Data Privacy Framework and standard contractual clauses.
• MailerLite Limited (Ireland), newsletter: data stored in the EU.

5. Your rights

You can request access, correction, deletion, restriction and portability of your data and object to processing (Arts. 15-22 GDPR) at any time, as well as withdraw your consent, by writing to business@raulhartzen.com. You can also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of your country.

Providing data is optional, but without it I cannot reply to you or send you the newsletter. There is no automated decision-making or profiling.