Last updated: 21 August 2026
Who is responsible
Nowhere Borders is a documentary photography project by Nønløsô.
The data controller for this website is Nønløsô. You can reach the controller at nowhereborders@proton.me.
The short version
This site sets no cookies. It carries no advertising, no social media buttons and no embedded videos. It collects the minimum that a website cannot avoid collecting, and the one thing it asks you for — an email address — it asks only if you choose to subscribe to the newsletter. What follows is the exact list.
What happens when you open a page
Hosting and server logs. The site is hosted by Automattic Inc. (WordPress.com), a company based in the United States. Like every web server, theirs records for each request the IP address, the date and time, the page asked for, the page you arrived from, and the browser and operating system in use. These records serve to deliver the pages, to keep the site available and to defend it from abuse. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Typeface. Pages load the Courier Prime typeface from Automattic’s servers. Your IP address reaches Automattic in the process. It does not reach Google: the font is served by WordPress.com rather than by Google Fonts.
Performance measurement. A script provided by WordPress.com measures how quickly pages load, so that slow ones can be found and fixed. It records technical data about the connection, not about you. Legal basis: legitimate interest.
Visit statistics. The site uses Jetpack Stats, a service of Automattic, to count how many people read which project. It works without cookies: a small transparent image is requested from Automattic’s servers, carrying the address of the page and your IP address. The statistics I see are aggregate figures — how many visits a page received, from which country, from which referring site. They do not identify you and I cannot use them to follow you across other websites. Legal basis: legitimate interest in knowing whether the work is read.
Cookies
This site sets no cookies, neither its own nor anyone else’s. There is nothing to accept and nothing to refuse, which is why you are not being asked.
Two small things are stored by your browser, and neither travels anywhere.
The first is written only if you press the switch in the corner that turns the pages from light to dark: your choice is remembered so that the next page, and your next visit, open the way you left them. It is a single word, light or dark, kept on your own device. Clearing your browser’s storage removes it.
The second records whether your browser is able to display emoji characters, and disappears when you close the tab.
Neither contains personal data, neither is sent to anyone, and neither is used to recognise you.
If you write
The contact page publishes an email address. There is no form: writing means opening your own mail programme, and what you send arrives in a mailbox held with Proton AG in Switzerland — a country the European Commission recognises as offering an adequate level of protection.
Your message, your address and anything you choose to tell me are used to answer you and, if the exchange leads to work, to carry it out. Legal basis: your request and the steps taken before a possible contract, Art. 6(1)(b) GDPR.
The newsletter
The contact page carries a form with one field. If you put your address in it and tick the box, you will be sent an email when a new project goes up, when a photobook is printed, and when there is something worth saying about an exhibition or a show. Nothing else is sent, and nothing else is asked of you: no name, no country, no interests.
Nothing happens until you confirm. Submitting the form does not subscribe you — it asks WordPress.com to send you a message with a link, and only pressing that link makes you a subscriber. An address typed in by somebody else therefore never becomes a subscription, and that same confirmation is the record of your consent.
Legal basis: your consent, Art. 6(1)(a) GDPR. You may take it back whenever you like, without giving a reason and without it costing you anything: every email carries an unsubscribe link at its foot, and writing to nowhereborders@proton.me works just as well. Your address is then removed, and taking it back does not make the emails already sent unlawful.
The list is held and the emails are sent by Automattic Inc. (WordPress.com), which already hosts this site — so subscribing puts your address in the hands of nobody new. It is not sold, lent or handed to anyone else, and it is not used to write to you about anything other than this work.
Links that leave the site
The site links to Instagram and, from the Merch pages, to services that sell prints. Following one of those links takes you outside this site, and from that moment their own privacy policies apply, not this one. Nothing is sent to them while you stay here: the links are ordinary links, not embedded content.
Photographs of people
This is documentary and street photography. Many of the photographs are made in public places — demonstrations, marches, squares, streets — and show recognisable faces, published to report on facts of public interest.
Publication rests on the freedom to inform and on the treatment of personal data for journalistic purposes, recognised by Art. 85 GDPR and, in Italy, by Art. 97 of Law 633/1941 and by the rules of conduct for journalistic activity.
If you appear in a photograph on this site and would rather not, write to nowhereborders@proton.me. Say which photograph and where you are in it. Requests are read and answered, and where the reasons given outweigh the reasons for publishing, the photograph is taken down.
Data outside the European Union
Automattic Inc. is based in the United States, so hosting the site and counting its visits involve a transfer of data outside the European Union. Automattic declares that it carries out those transfers under the safeguards provided by the GDPR — standard contractual clauses approved by the European Commission and its adherence to the EU–US Data Privacy Framework. Their own policy, at automattic.com/privacy/, sets out the current arrangement.
Proton AG is in Switzerland, covered by an adequacy decision of the European Commission.
How long things are kept
Server logs: the period Automattic applies to hosting logs, in the order of weeks.
Visit statistics: kept in aggregate form, without any identification of individual readers.
Your address on the newsletter list: until you unsubscribe. There is no other end to it, and no periodic clear-out that would remove you without your asking.
Emails you send: as long as the exchange is useful, and afterwards only where a legal obligation requires it.
Your rights
You may ask to know what data concerning you is processed and to obtain a copy of it; to have it corrected or erased; to have its use restricted; to object to processing based on legitimate interest; and to receive it in a portable form. Write to nowhereborders@proton.me and you will have an answer within one month.
If you believe your data has been handled unlawfully you may lodge a complaint with the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live.
Changes to this page
If what the site does changes — a new service, a form, a different way of counting visits — this page changes with it, and the date at the top is updated. There is no archive of previous versions: the page in front of you is the one in force.