The Machine Question is an independent research project exploring artificial intelligence through philosophy, technology and human cognition. Essays on intelligence, creativity and the evolving relationship between humans and machines.
Privacy & Personal Data Protection
Privacy
Policy
How paolocalvi.co.uk collects, uses and protects personal information.
This Privacy Policy explains how personal data is processed in connection with paolocalvi.co.uk. The Data Controller is established in Italy and the processing activities covered by this Policy are primarily carried out in Italy. The principal framework is therefore the European Union General Data Protection Regulation and applicable Italian data protection law, together with United Kingdom data protection legislation where its territorial scope applies.
Transparency principle
Personal data is processed only for defined purposes, on an appropriate legal basis and subject to the rights available under the law applicable to each processing activity.
Updated 21 August 2026
02
At a glance
Privacy should be understandable before it is exhaustive.
The essential information is set out here first. The sections that follow provide the complete legal and technical detail concerning each processing activity.
What is collected
The website may process technical and browsing data, information voluntarily provided by email, newsletter subscription data and, where consent has been given, analytics or information associated with optional third-party content.
Why it is processed
Data is processed only for specific purposes, such as operating and securing the website, responding to communications, managing requested subscriptions and, where permitted, understanding how the site is used.
Consent
Where consent is the appropriate legal basis, optional technologies and processing activities are activated only after the user has made a freely given choice. Consent may subsequently be withdrawn.
Data sharing
Personal data is not sold. It may be made available to service providers and processors only where required to operate the website or provide a service requested by the user, subject to applicable safeguards.
Your control
Depending on the law applicable to the processing, individuals may exercise rights concerning access, correction, erasure, restriction, portability and objection, as well as rights relating to consent.
Regulatory protection
Individuals may also have the right to lodge a complaint with the competent data protection authority. The appropriate authority depends on the applicable legal framework and circumstances of the processing.
The principle
The objective is not to collect as much information as possible, but to process only the information reasonably necessary for the operation, security and legitimate functions of this website.
03
Legal framework
Data Controller, scope and applicable law.
paolocalvi.co.uk is operated from Italy. This determines the primary legal framework governing the processing of personal data, while additional rules may apply where processing falls within the territorial scope of another data protection regime.
Data Controller
Paolo Calvi
Paolo Calvi determines the purposes and means of the personal data processing activities described in this Privacy Policy and acts as Data Controller for the website paolocalvi.co.uk.
Italian data protection law
Because the Data Controller is established in Italy and the relevant processing activities are primarily carried out there, processing is governed principally by Regulation (EU) 2016/679 and the Italian Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, as subsequently amended and supplemented.
European data protection framework
The EU General Data Protection Regulation provides the principal framework for the processing described in this Policy. Individuals within the European Union and, where relevant, the wider European Economic Area benefit from the rights and safeguards provided by the applicable European data protection regime.
UK data protection law
Where a processing activity falls within the territorial scope of United Kingdom data protection legislation, the relevant provisions of the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable UK privacy and electronic communications rules are taken into account.
Territorial principle
A website being accessible from another country does not, by itself, determine the law governing every processing activity. The relevant question is where the Controller is established and whether a particular processing activity falls within the territorial scope of additional legislation.
Interpretation
References in this Policy to “applicable data protection law” mean the legal rules governing the specific processing activity in question. Where more than one legal framework is relevant, this Policy should be read so as to preserve the rights and safeguards available to the individual under the law applicable to that activity.
04
Personal data
Personal data we process.
The type of information processed depends on how the website is used. Most visitors can read the editorial content of paolocalvi.co.uk without creating an account, completing a public profile or providing personal information directly to the website.
Browsing and technical data
When the website is accessed, the systems and infrastructure used to deliver it may automatically process certain technical information necessary for communication between the user’s device and the website, for security, diagnostics and normal operation.
May include
IP address, date and time of access, requested resource, browser and device information, operating system, referring page, response status and technical log information.
Information provided directly
If a user voluntarily contacts Paolo Calvi by email or through another communication channel made available by the website, the information supplied in that communication may be processed in order to understand and respond to the request.
May include
Name, email address, contact details, the content of the message and any other information voluntarily included by the sender.
Newsletter data
Where a newsletter or editorial update service is made available, subscription data may be processed for the purpose of sending the communications requested by the subscriber and maintaining evidence of the subscription and consent process where required.
May include
Email address, subscription date, confirmation status, consent records and technical information associated with subscription management.
Analytics and third-party data
Where analytics services, embedded media or other optional third-party technologies are used, additional information may be processed only under the conditions described in this Policy and, where required, after the user has made the relevant consent choice.
Depending on the service
Device identifiers, interaction information, approximate location derived from network data, consent state and technical information generated when optional content or services are activated.
Data minimisation
The website is not designed around the collection of personal profiles.
paolocalvi.co.uk is primarily an editorial and research website. Personal data is therefore not requested merely in order to access ordinary published content. Where information is processed, the objective is to limit it to what is reasonably necessary for the relevant purpose.
Sensitive information
The website does not ordinarily request special category personal data, criminal offence data or similarly sensitive information. Users are therefore asked not to include such information unnecessarily in emails or other voluntary communications. If sensitive information is nevertheless provided, it will be handled only where a lawful basis and any additional legal condition required for that processing exist.
Where data comes from
Personal data processed through the website generally originates either from the individual directly or from the technical systems required to establish, secure and measure an interaction with the website.
05
Purpose & legal basis
Why personal data is processed.
Personal data is processed only where there is a defined purpose and an appropriate legal basis. The applicable basis depends on the nature of the interaction with the website and on the specific processing activity involved.
Legal framework
For processing subject to the EU GDPR, the relevant lawful bases are those set out in Article 6 GDPR. Where the UK GDPR applies, the corresponding lawful bases under Article 6 UK GDPR are relied upon. Italian data protection legislation, including Legislative Decree No. 196/2003 as amended, applies where relevant to processing carried out in Italy.
01
Delivering the website
Technical information may be processed to transmit pages and resources requested by visitors, maintain normal website operation, manage network communications and provide the editorial content requested through the user’s browser.
Lawful basis
Legitimate interests
Article 6(1)(f) EU GDPR / UK GDPR — operating and making the website available in a technically reliable manner.
02
Security and abuse prevention
Technical and log data may be processed to protect the website, hosting environment and associated systems against unauthorised access, malicious activity, spam, automated abuse, attacks, vulnerabilities and other security incidents.
Lawful basis
Legitimate interests
Article 6(1)(f) EU GDPR / UK GDPR — maintaining the security, integrity and resilience of the website and its infrastructure.
03
Responding to communications
Information voluntarily provided by email or another available communication channel may be used to read, assess, manage and respond to the sender’s enquiry or request.
Lawful basis
Request / legitimate interests
Article 6(1)(b) where processing is necessary to take steps at the individual’s request before entering into a contract; otherwise Article 6(1)(f), where appropriate, for managing legitimate correspondence and enquiries.
04
Newsletter and editorial updates
Where a subscription service is offered, the subscriber’s details may be used to deliver the requested newsletter, essays, publication notices or other editorial communications and to administer the subscription.
Lawful basis
Consent
Article 6(1)(a) EU GDPR / UK GDPR where consent is required. Applicable electronic communications and direct marketing rules are also observed.
05
Optional analytics and measurement
Where non-essential analytics or similar measurement technologies are used, information may be processed to understand how published content and website functions are used and to improve the editorial and technical experience.
Lawful basis
Consent where required
Article 6(1)(a) EU GDPR / UK GDPR where the relevant processing or access to information on a user’s device requires prior consent.
06
Compliance and legal claims
Information may be retained or otherwise processed where necessary to comply with applicable law, respond to lawful requests from competent authorities, establish relevant facts, or exercise, defend or protect legal rights.
Lawful basis
Legal obligation / legitimate interests
Article 6(1)(c) EU GDPR / UK GDPR where processing is required by law; Article 6(1)(f) where necessary for the establishment, exercise or defence of legitimate legal interests.
Legitimate interests
Where legitimate interests are relied upon, the relevant interests are assessed against the rights, freedoms and reasonable expectations of the individuals concerned. This basis is not intended to justify processing that would have a disproportionate impact on users or that should properly depend on consent.
Governing principle
A lawful basis is identified for the processing activity itself — not selected retrospectively merely because personal data happens to have been collected.
06
Communications
Communications and subscriptions.
Direct correspondence and newsletter subscriptions are separate processing activities. Contacting the author does not automatically place an individual on a mailing list.
Email communications
When an individual sends an email voluntarily, the sender’s address, message and any information included in the correspondence may be processed for the purpose of understanding and responding to that communication.
Correspondence may be retained for a reasonable period where necessary to maintain continuity, document an exchange or protect legitimate legal interests.
Legal basis
Steps taken at the individual’s request where Article 6(1)(b) applies; otherwise legitimate interests under Article 6(1)(f), where appropriate.
Newsletter and editorial updates
Where a newsletter is offered, subscription information is used only to manage the subscription and deliver the editorial communications requested by the subscriber.
Where applicable, subscription may require confirmation through a double opt-in process. Each communication provides a practical means to unsubscribe, and consent may be withdrawn at any time.
Legal basis
Consent under Article 6(1)(a) EU GDPR / UK GDPR, together with applicable electronic communications rules where relevant.
Separation of purposes
An email enquiry is not treated as permission to receive unrelated promotional or editorial communications.
07
Browser technologies
Cookies, analytics and embedded content.
The website may use cookies and comparable technologies to operate correctly, understand its use and, where relevant, make third-party content available. Technologies that are not strictly necessary are used only where permitted by applicable law and, where required, after the user has expressed a choice.
Necessary and optional technologies
Strictly necessary cookies or similar technologies may be used where required for the operation, security, stability or basic functionality of the website. Their use does not depend on consent where applicable law permits them to be placed without it.
Other technologies, including those used for measurement or third-party functionality, are activated only in accordance with the visitor’s preferences where prior consent is legally required.
Control
Visitors may manage non-essential cookie preferences through the consent mechanism made available on the website, where applicable.
Audience and usage measurement
The website may use audience-measurement tools to understand, in aggregate, how pages are accessed and used. Depending on the technology employed, this may involve information such as page views, approximate location, device or browser characteristics and interaction data.
Where an analytics technology requires access to or storage of information on a user’s device and does not qualify for an applicable exemption, it will not be activated before the required consent has been obtained.
Principle
Measurement is configured, where reasonably possible, to limit data collection to what is proportionate to the editorial and technical purposes of the website.
Embedded media and external services
Articles or pages may contain content supplied by third parties, such as video, audio, social-media material or other externally hosted resources. Loading such content may allow the relevant provider to receive technical information about the visitor.
Where applicable, third-party content capable of setting non-essential cookies or initiating comparable tracking is blocked until the visitor has provided the consent required for that service.
Third parties
Once external content is activated, the relevant provider may process personal data under its own privacy terms and responsibilities.
Your choice
Where consent is the basis for optional technologies, refusing or withdrawing it does not affect access to the essential content of this website. Preferences can be changed again through the available consent controls.
08
Data governance
Infrastructure, processors, transfers and retention.
Personal data is primarily managed in the context of activities carried out from Italy. Technical suppliers may nevertheless process limited information where this is necessary to provide hosting, security, communications, website functionality or other supporting services.
Processing carried out from Italy
The website is operated and its principal data-processing activities are managed from Italy. The processing of personal data is therefore organised primarily within the European Union and subject, where applicable, to the EU General Data Protection Regulation and Italian data-protection law.
The use of a .co.uk domain and the accessibility of the website from the United Kingdom do not, by themselves, determine the physical location in which personal data is processed.
Processors and technical suppliers
Selected third-party providers may process personal data where necessary to supply services such as hosting, infrastructure, cybersecurity, email delivery, website maintenance, analytics or other technical functions used by the website.
Where a provider acts as a processor, it is required to process personal data on documented instructions and subject to appropriate contractual, organisational and security obligations. Some providers may instead act as independent controllers for specific activities determined by them.
Data outside the EEA or United Kingdom
Some technology providers may operate infrastructure, personnel or subprocessors in jurisdictions outside the European Economic Area or the United Kingdom. Where this results in an international transfer of personal data, the transfer must rely on a mechanism recognised by the data-protection law applicable to that transfer.
Depending on the circumstances, this may include an adequacy decision, appropriate contractual safeguards, recognised standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.
Data is not retained indefinitely
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, taking into account the nature of the information, the relevant processing activity and any legal, security or evidential requirements.
Retention periods may therefore differ. Technical logs may be kept for limited security or diagnostic periods; correspondence may be retained for continuity or legal purposes; and subscription information may be retained until the subscription is withdrawn, subject to any limited records required to document that withdrawal.
Jurisdiction
A website may be accessible globally while its processing operations remain centred in one jurisdiction. Where another data-protection regime applies to a particular user or processing activity, the protections required by that regime are respected in addition to the principal Italian and EU framework.
09
Individual rights
Your rights and how to exercise them.
Depending on the applicable law and the circumstances of the processing, individuals may exercise a range of rights concerning their personal data. Not every right applies in exactly the same way to every processing activity, but requests are assessed in accordance with the legal framework governing the data concerned.
Access
To obtain confirmation as to whether personal data is being processed and, where applicable, receive information about that processing and a copy of the relevant personal data.
Rectification
To request correction of inaccurate personal data and completion of information that is incomplete, where appropriate.
Erasure
To request deletion of personal data where the legal conditions for erasure are satisfied and no overriding ground requires continued processing.
Restriction
To request restriction of processing in circumstances recognised by applicable data protection law.
Portability
Where the legal requirements are met, to receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller.
Objection
To object, on grounds relating to the individual’s particular situation, to processing based on legitimate interests where the applicable legal conditions are satisfied.
Withdraw consent
Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Complaint
To lodge a complaint with the competent supervisory authority where an individual considers that personal data has been processed in breach of applicable data protection law.
Right to object
You may object to certain processing based on legitimate interests.
Where personal data is processed on the basis of legitimate interests, an individual may have the right to object for reasons relating to their particular situation. Processing will then be reconsidered in accordance with the applicable legal test, including whether compelling legitimate grounds justify its continuation.
Exercising your rights
Requests should identify the individual and the right being exercised sufficiently clearly to allow the request to be assessed. Additional information may be requested where reasonably necessary to verify identity and protect personal data from unauthorised disclosure. Requests are handled without undue delay and within the time limits required by applicable law. Rights are normally exercised free of charge, subject to any exceptions permitted by law for manifestly unfounded or excessive requests.
10
Final provisions
Additional information and contact.
The following provisions complete this Privacy Policy and explain how changes, external services and privacy-related enquiries are handled.
The website is not directed at children
paolocalvi.co.uk is an editorial and research website intended for a general audience and is not specifically designed for children. Personal data relating to children is not knowingly sought through the ordinary use of the website. Where age is legally relevant to consent or another processing activity, the requirements of the applicable law will be taken into account.
No significant automated decision-making
Personal data processed through the website is not used to make solely automated decisions that produce legal effects concerning an individual or similarly significantly affect that individual. Technical or statistical tools may be used to support website operation and measurement without creating such automated decisions.
Links to third-party services
The website may contain links to external websites, publications, platforms or services. Once a visitor leaves paolocalvi.co.uk, personal data may be processed by the operator of the external service under its own privacy arrangements. This Privacy Policy does not govern independent third-party websites.
Changes to this Privacy Policy
This Policy may be updated when the website, its processing activities, applicable legislation or relevant services change. The current version is published on this page and identifies its latest revision date. Where required by law, material changes will be communicated through an appropriate additional notice.
Privacy enquiries
Questions about your personal data?
Requests concerning this Privacy Policy, the processing of personal data or the exercise of applicable data-protection rights may be addressed directly to the Data Controller. Please provide enough information to identify the request, but do not send unnecessary sensitive information.
Data protection contact
privacy@paolocalvi.com