This page asks you for nothing. But asking you for nothing is not the same as knowing nothing about you: the hosting records the address your browser connects from, and that is personal data. What follows is the whole of it, in the order in which it happens.
Who is responsible
Us, both of us
Haphys is jointly owned by Pietro Brusa and Thomas Brusa, who are joint controllers of everything described here. We are two private individuals: there is no company, and there is no data protection officer, because the law does not require one for what we do.
You can reach us at info@haphys.com. For anything concerning this notice, that address reaches both of us. Between us there is no division of roles: we are both responsible for everything set out here — for this notice, and for answering you — and you can exercise any of the rights below against either of us. A postal address is available on request.
Opening a page
What the hosting records
This notice covers every page we publish at haphys.com and on its subdomains, and our accounts on social platforms, described further down. The pages are served by Netlify. When you open any of them, Netlify receives the IP address your browser connects from, along with the ordinary technical details of the request — which page, at what time, which browser. This happens on every page, including this one, and it cannot be switched off: it is how a page arrives at your screen.
We do this on the basis of our legitimate interest in delivering the site and keeping it from being abused (Article 6(1)(f) GDPR). We see the last 24 hours of those records, and no more. Netlify's own panel shows us recent requests — where they came from, which page, at what time, with which browser — for one day; it is part of the hosting and cannot be switched off. We take no copy of it and make no other use of it. Netlify processes them as our processor under the data processing terms incorporated in its own terms of service, and it uses its own sub-processors; Netlify publishes the list, and we point you to it rather than copy it here, because a list copied here would stop being true the day Netlify changes a supplier. Netlify is a United States company, so those records reach a country outside the European Union. The transfer is covered by Netlify's certification to the EU-U.S. Data Privacy Framework, which you can check on the official list, with the standard contractual clauses in its data processing terms as a fallback.
Netlify told us in writing how long it keeps those records: 30 days in online storage, then in an archive for up to 13 more months, after which they are deleted. It also told us that, where its security systems check a request, it keeps a security record of it, for up to one year online and up to six years in an archive, and that for that purpose — protecting its services and preventing fraud and abuse — it acts not on our behalf but as a controller in its own right, under its own privacy statement.
We have added no analytics to this site. There are no cookies, no tracking pixels, no advertising, no profiling, no automated decisions about anyone, and no forms. Nothing on these pages makes a request to any other domain: the fonts, the images and the styles all come from the site you are reading.
Writing to us
We have two addresses: info@haphys.com for general enquiries, and studio@haphys.com for press enquiries, interviews and press materials. Mail for both is handled by Register S.p.A., which also operates the domain's DNS. If you write to either, Register processes your address and the content of your message as our processor, under the contract between us. We do this on the basis of our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR). We keep correspondence for as long as the matter it concerns is open, or for as long as we may need it to defend ourselves, and we use it for nothing else. Nobody is obliged to write to us, and we ask for nothing beyond what you choose to send.
We asked Register where that mail is kept, and they answered in writing. It is hosted in the Italian data centre of Retelit-X, the single sub-processor Register uses for the email service, and the backups are held in Retelit-X data centres in Italy as well. Nothing in the email service reaches anyone outside the European Economic Area. If Register plans to change that sub-processor it is bound to tell us in advance, and if the change affects anything said here, we will update this notice.
The blockchain
What is public is public for good
The work Haphys releases lives on Base, a public blockchain. Whoever holds a piece, and every transfer of it, is visible to anyone and permanently so. The same is true of contributions to the artists, which travel on Base or on Bitcoin: the sending address, the amount and the time of every transfer are public on that network. That is not something we publish and not something we can undo: it is how a blockchain works, and it is true whether or not you ever open this site.
We do not link that information to anything else, and we do not build any record of holders. The only record we keep is the one described next, of the contributions we receive. If we ever did more, that would be a new processing with a legal basis of its own, and it would be declared here before it began.
Contributing
The record of contributions
From 27 October 2026 to 20 March 2027 the artists can be supported with a contribution, as set out on the support page. For each contribution we receive we write down the date, the network, the token, the amount, its value in euros on that day, the identifier of the transfer and the address it came from. An address on a blockchain carries no name, but it is personal data all the same, because it can sometimes be traced back to a person. Nobody is obliged to contribute; whoever does sends from an address, because there is no way to make a transfer without one.
We use the amounts, their value in euros and the dates to declare the income in our tax returns, as Italian law requires (Article 6(1)(c) GDPR), and we keep the identifier and the sending address of each transfer so that we can show where each amount came from if the tax authorities ask (Article 6(1)(f) GDPR). The record is seen only by the two of us, and by the tax authorities if they ask for it. We keep it in an encrypted file on our own devices, not on any online service. We keep it until the tax authorities can no longer examine the return in which that income is declared — under Italian law, the end of the fifth year after the year the return is filed — and longer only if a dispute requires it. We do not try to find out who is behind an address, we do not write to anyone because they contributed, and we use the record for nothing else.
The support page has a Copy button: it writes an address to your clipboard when you press it, and never reads from it. It also links to BaseScan and to mempool.space, which show each address on its network. They are other sites, with notices of their own, and nothing is sent to them unless you follow the link.
What we hold
What we keep
There is a distinction worth keeping in mind, and we would rather draw it ourselves than have you assume it: processing happens, retention by us mostly does not. The hosting records requests and keeps them for the periods set out above, in its own systems. What its panel shows us of the last day we neither copy nor store: we hold no database of visitors, no mailing list and no archive of visits.
Of everything this notice describes, we keep two things, and only these: the correspondence you send us, by email or through our social accounts, and the record of contributions, each for the time set out above.
Your rights
What you can ask, and what we can answer
You have the right to ask for access to your personal data, and for its correction, erasure or restriction, and to object to processing based on legitimate interest. Write to info@haphys.com.
What such a request will yield depends on what it concerns.
If it is about what the hosting records when you open a page: a request carries no name, so we cannot tell which of those records are yours unless you give us the address you connected from and roughly when. With that, we can look at the last 24 hours in Netlify's panel ourselves; for older records we ask Netlify, which keeps them on our behalf, to search them, and we tell you what it finds. Whether Netlify can erase or set aside individual entries is for Netlify to say: we will ask, and pass on its answer. An objection will not stop requests from being recorded, because no page can be delivered or protected without that: this is a compelling legitimate ground that prevails (Article 21(1) GDPR).
If it is about an email you sent us: we have it and we can show it to you, and we can delete it unless we still need it for the matter it concerns or to defend ourselves. We will not rewrite what you wrote; if something in it about you is wrong, tell us and we will keep your correction with it.
If it is about a contribution: tell us the address or the transfer, and we can show you what we wrote down. We cannot change what the blockchain shows, and we cannot delete the entry while we still need it for our tax return and for any examination of it (Article 17(3)(b) and (e) GDPR). If we wrote something down wrong, we correct it.
Where the answer sits with Netlify or with Register, we ask them for it — that is what our contracts with them are for — and it is we who answer you, with whatever we have been able to obtain. For the security records that Netlify says it keeps as a controller in its own right, we will pass your request on to Netlify as well, and you can also write to Netlify directly, as its privacy statement explains.
If you think we have got this wrong, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority of the country where you live, where you work, or where you think the problem happened.
Changes
This notice has a date
This notice describes what happens today. When something changes — another service, another page, an answer we are still waiting for — we change the notice and change the date below. We do not keep a changelog on this page; if you need to know what it said on a given day, ask us.
In force since 27 October 2026.
Social media
Our accounts on other platforms
We are on Instagram and X as @haphys_project. These are the project's only accounts on social platforms. The site does not embed anything from them: nothing on these pages contacts these platforms unless you follow a link.
Each platform processes your data as a controller in its own right, under its own notice: Meta Platforms Ireland Limited for Instagram (privacy policy), X Internet Unlimited Company for X (privacy policy). That includes any transfer outside the European Union, and the exercise of your rights over what the platform does.
What reaches us is what you choose to show or send: your public profile, and your comments, mentions and messages. We read them and use them only to reply, on the basis of our legitimate interest in talking about the work with the people who write to us (Article 6(1)(f) GDPR). Messages stay on the platform; if one concerns a matter we need to follow up, we treat it like an email (see above). We do not copy, export or keep lists of followers, and we do not link a social account to an address on a blockchain.
The platforms also show us figures about our own posts, such as how many times a post was seen or liked. They arrive already counted, and we use them only to see how far the work travels. We use no other tool to follow what happens on social media.