Who we are
LIONOAK is an independent editorial platform exploring retail through strategy, customer experience, operating models and business economics.
Website: https://www.lionoak.xyz.
The data controller is Marco Dal Mas.
For privacy-related enquiries and requests concerning your personal data, contact postmaster@lionoak.xyz.
Last updated: 12 October 2026.
Website browsing
The website’s hosting and security systems process technical information needed to deliver and protect the website. Server logs may include your IP address, browser information, requested pages, referring page, and the date and time of access.
This information is used to maintain website functionality, diagnose technical problems and detect misuse. Technical identifiers are not necessarily anonymous.
Contact requests
IIf you contact us by email or through a contact form, we process the information you provide, such as your name, email address, subject and message, to handle your request.
Providing this information is voluntary. If you do not provide the information needed to understand and respond to your request, we may be unable to assist you. Contact details submitted for correspondence are not automatically added to a newsletter or marketing list.
Comments
Where comments are enabled, we collect the information submitted in the comment form, including your name, email address, comment and optional website address. WordPress also records your IP address and browser user-agent information for moderation and spam prevention.
If your comment is approved for publication, its text, display name and any displayed website link become publicly visible. Your email address is not displayed with the comment.
The website uses Gravatar, a service operated by Automattic, to display avatar images. A hash derived from an email address may be sent to Gravatar to retrieve the associated image. Hashing does not necessarily make personal data anonymous.
Loading avatar images also connects your browser to Gravatar’s servers, which may receive technical information such as your IP address and browser information. This can occur when you view a page displaying avatars, even if you do not leave a comment.
More information is available in Automattic’s Privacy Policy.
Cookies
If you submit a comment and select the option to remember your details, WordPress saves your name, email address and website address in cookies for future comments. These optional cookies normally last for one year.
The following cookies concern access to the WordPress administration area:
- A temporary cookie on the login page checks whether your browser accepts cookies and is removed when you close the browser.
- Login cookies normally last for two days, or two weeks if “Remember Me” is selected. Logging out removes the login cookies.
- Cookies storing administration display preferences normally last for one year.
- Editing or publishing an article can set a cookie containing the edited post ID, which normally expires after one day.
These are standard WordPress durations and are subject to the site’s actual configuration. You can delete or block cookies through your browser settings. Blocking necessary cookies can prevent some functions, including administrative access, from working. Any cookies or similar technologies requiring consent must be identified and managed through a consent mechanism before they are activated. Browser settings do not replace that mechanism.
Embedded content and external websites
Where a page includes embedded content, such as a video or an external player, your browser may connect directly to the provider’s servers. The provider may receive technical data and use cookies or other tracking technologies, including recognising you if you are logged into its service.
Processing by external providers is governed by their respective privacy policies. Any embedded services requiring consent must be configured to respect that requirement. External links, including links to LinkedIn, lead to websites governed by their own privacy policies.
Purposes and legal bases
We process personal data for the following purposes:
- Operating and protecting the website, including the technical optimisation of editorial images: our legitimate interest in providing a functional and secure editorial website, under Article 6(1)(f) GDPR.
- Responding to correspondence and contact requests: our legitimate interest in handling communications addressed to us, under Article 6(1)(f) GDPR.
- Managing comments submitted for publication, including moderation and spam prevention: our legitimate interest in administering these functions, under Article 6(1)(f) GDPR.
- Complying with applicable legal obligations, including handling data-protection requests: Article 6(1)(c) GDPR.
- Using optional technologies that require consent: your consent, under Article 6(1)(a) GDPR and applicable rules on cookies.
Who can access your data
Personal data may be accessed by authorised people managing the website and providers of hosting, email, image optimisation, technical maintenance and security services, where necessary for their respective tasks.
Imagify is provided by WP Media and processes the selected image files as described above. Providers processing data on our behalf must operate under the applicable data-processing arrangements. Gravatar processes information as described in the section above and in Automattic’s privacy policy.
Data may also be disclosed where necessary to comply with a legal obligation or protect legal rights. For authorised WordPress accounts, a password-reset request may include the requesting IP address in the reset email.
LIONOAK does not sell personal data or provide contact lists to third parties for advertising purposes.
International transfers
For the hosting services used by this website, Aruba has confirmed that data is not transferred outside the European Union or made accessible to third parties located outside the European Union.
Imagify has confirmed that the image processing described above takes place on servers located in the European Union, hosted by OVH and group.one.
Gravatar is a separate external service operated by Automattic. Automattic states that information may be processed outside the European Economic Area and describes safeguards, including European Commission-approved standard contractual arrangements, in its Privacy Policy. Further information about these safeguards can be requested from Automattic through the contact channels indicated in that policy.
Image optimisation
We use Imagify, a service provided by WP Media, to optimise selected editorial images and generate alternative image formats. These files may include photographs of identifiable people, such as author portraits.
Image optimisation involves sending the selected files to Imagify’s servers and receiving optimised versions. Imagify has confirmed that this processing takes place on servers located in the European Union, hosted by OVH and group.one. Copies of images sent through the WordPress plugin are stored on those servers for one hour and then deleted. Optimised images and backups of originals remain in the website’s hosting space.
Where uploaded images contain personal data, WP Media acts as a data processor on our behalf. Its data-processing terms are included in Section 23.1 of Imagify’s Terms of Service. Further information is available in Imagify’s Privacy Policy.
How long we retain your data
Contact correspondence is retained for the time needed to resolve the request and any related follow-up, then deleted unless an applicable legal obligation or the establishment, exercise or defence of legal claims requires further retention.
Published comments and associated metadata are retained while they remain part of the associated article, unless removed earlier following moderation or an applicable erasure request.
Authorised WordPress account data is retained for the period needed to administer the account and any applicable legal obligations. Account holders can edit the profile fields available to them or contact the controller to request correction or deletion.
According to Aruba, technical logs retained by the hosting provider are kept for periods not exceeding six months. This period concerns hosting logs and does not determine the retention of contact messages, comments or editorial images, which are described separately in this policy.
Your rights
Subject to the applicable legal conditions, you may request:
- access to your personal data;
- correction of inaccurate or incomplete data;
- erasure of your data;
- restriction of processing;
- portability of your data;
- objection to processing based on legitimate interests.
Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Send requests to postmaster@lionoak.xyz. We may request information reasonably necessary to verify your identity and will respond within the applicable GDPR time limits.
You may also lodge a complaint with the competent supervisory authority. In Italy, this is the Garante per la protezione dei dati personali.
Policy updates
This policy will be updated to reflect changes in the website’s actual processing activities or applicable requirements. The date of the latest revision is shown at the beginning of this document.