Privacy Policy

Last updated · 30/10/2026

This notice covers iu2jmz.it and its Guestbook. It also explains links to station services, distinguishing them from the main website’s features.

1. Controller and contact details

The controller is Pierluigi Di Rollo — IU2JMZ, Olgiate Olona (VA), Italy. The controller directly manages the website and its technical administration. For privacy information, objections and requests: iu2jmz@iu2jmz.it.

2. Purposes and legal bases

Technical browsing data are used to deliver pages and maintain security; the language preference remembers your selection. Internal counting provides aggregate information about site usage. The Guestbook receives, moderates and publishes greetings voluntarily submitted, while the QSO log documents the station’s amateur-radio activity. Email messages are used to handle enquiries.

Where these operations involve personal data, the legal basis is the controller’s legitimate interests (GDPR Article 6(1)(f)): operating and protecting the website, measuring its use with data minimisation, communicating with those who contact the station and documenting amateur-radio activity. The balancing takes account of the non-advertising nature of the site, limited data, moderation and the right to object. Submitting a message is not blanket consent for additional uses.

The exemption from consent for technical or equivalent technologies is separate from the GDPR legal basis and is explained in the Cookie Policy. The main website does not use behavioural advertising or profiling tools.

3. Browsing, security and logs

The server receives IP addresses, request times, requested paths and technical browser metadata needed for communication. The counter and Guestbook backends do not keep their own request logs. The QSO and weather APIs may produce request and error logs; the infrastructure may retain system and security logs. An application not logging requests does not mean IP addresses are never processed.

Log retention depends on rotation mechanisms, storage limits and the need to examine errors or incidents; a single time-based expiry is not applied across all logs. They are not used to create advertising profiles. Data needed to handle abuse or a dispute may be retained as necessary to investigate and protect legal rights.

4. Language and visit counting

The iu2jmz.language localStorage key holds only the IT/EN choice, without a site-defined expiry. You can remove it in browser settings.

Following real interaction and a short dwell time, the counter may create a random 32-byte tab identifier (iu2jmz.visit.session). The server receives it and stores an HMAC with last activity to prevent duplicate counting, together with an aggregate total and global rate-limit counters. The counter database does not store IP addresses, user-agents, visited URLs or browsing paths. The user-agent is checked transiently to exclude automated clients. The proxy strips IP-forwarding headers for this API, but the front-end server still receives the IP for the connection.

Counting sessions expire after 30 minutes of inactivity. Cleanup runs during registration and every five minutes while the service is running; outages suspend cleanup. Browser storage lasts for the tab session, subject to browser restoration, and is not erased by the server timer. The aggregate total has no automatic expiry. This measures sessions, not unique individuals; identifiers are not matched with Guestbook or QSO data or sent to external analytics services. Without sessionStorage, the total remains readable but the visit is not recorded.

5. Public Guestbook and administration

Submission is optional. A name or callsign and message are required for submission; country is optional and no email address is requested. Submission time, moderation state and a content digest for duplicate prevention are stored. Not submitting does not prevent browsing. Messages are published only after approval: name/callsign, country, text and date become visible to everyone, including search engines and parties who may copy them. Do not include sensitive information, phone numbers, emails or other people’s private data.

For abuse prevention, the Guestbook derives a secret-key HMAC from the IP address and records submission/login attempt times. This is pseudonymisation, not anonymity or device fingerprinting. Attempts older than 24 hours are removed when the anti-abuse check next runs; they can remain longer without subsequent requests. The form token tied to this check stays only in JavaScript memory and is valid for up to one hour.

The administrator’s technical cookie lasts up to eight hours. The server stores the token hash, CSRF token and expiry; logout deletes the session, while expired rows are removed at a subsequent successful login.

Messages have no scheduled automatic deletion. Pending messages remain until the controller decides on them; approved messages remain as greetings and a record of station activity while relevant to that purpose. Their continued necessity must be considered during moderation and when handling requests: unnecessary content must be removed. You may request removal or object to publication by contacting the controller. Deletion from active data does not immediately remove copies already collected by others or held on recovery media.

6. Amateur-radio QSO log

The homepage and public /api/qso API show the latest ten contacts from the Log4OM/MariaDB log: UTC date/time, callsign, band, mode, frequency, RST reports and country. These originate from contacts recorded by the station. A callsign may identify an individual.

The log documents amateur-radio contacts; its public section displays recent activity. Moving out of the latest ten does not delete a contact from the log or prevent copies of public responses. The web component does not automatically delete log entries by age: retention is tied to documenting radio activity and reviewing the continued need for the data. Contact the controller with the relevant contact details to request rectification, object or seek removal from publication.

The DXCC page also uses an aggregate summary of the whole log: DXCC entity codes and names and contact counts per entity, without publishing additional callsigns, individual QSO dates or personal contact details. Cartography and the visualisation library are hosted on this website; opening this page does not request third-party maps, CDNs or analytics. The IT/EN preference uses the same technical key already described.

7. Email, recipients and recovery copies

The email link opens your email application. If you write, your address, message and attachments are processed to handle the enquiry and follow-up. Retention depends on completing the exchange and any documentary or legal-rights needs; no automatic mailbox deletion after a fixed number of days is claimed.

The controller directly manages the website and administrative access. Published Guestbook and log data are available to Internet users. Network-transport or message-delivery providers may process data needed to operate those services; data may be disclosed to authorities where required by law. Counter identifiers are not sent to analytics providers.

Removal from active systems and persistence in any technical recovery copies are different matters: the examined software does not specify a single deletion deadline across all copies. Immediate deletion from backups or media is not promised. For specific requests, the controller can explain the data and copies actually concerned.

8. Weather, external links and subdomains

The homepage calls its own /api/weather endpoint; the backend requests station IBUSTO21 data from api.weather.com, without forwarding visitor IP addresses or session identifiers. QRZ and Weather Underground are ordinary links, not embedded widgets.

WebSDR (sdr.iu2jmz.it), streaming and the antenna map (live.iu2jmz.it) are separate services: the homepage does not embed their players or maps. The Guestbook loads its logo from live.iu2jmz.it, disclosing the request’s technical data to that host. The live map uses unpkg.com, cdn.jsdelivr.net and tile.openstreetmap.org resources, which receive IP addresses and technical metadata when opened.

This notice does not automatically extend the main website’s cookie assessment to live/SDR services. Opening external services also engages their notices and terms. Their infrastructure may be outside the European Economic Area; no exclusively European location is claimed for all Internet communications or linked websites. Public content can be read worldwide, including outside the EEA.

9. Your rights

Subject to GDPR Articles 15–22, you may request access, rectification, erasure and restriction, object to processing based on legitimate interests and obtain portability where applicable. Objections are assessed under Article 21; no account is needed. For a Guestbook or QSO request, provide the relevant callsign, date and content without unnecessary identity documents; the controller may proportionately verify identity.

Write to iu2jmz@iu2jmz.it. A response is normally provided within one month, subject to justified extensions under GDPR Article 12. You may complain to the Italian Garante per la protezione dei dati personali or the competent authority and seek a judicial remedy. The main site does not perform profiling or automated decisions producing legal effects; automated anti-abuse checks may reject a submission.