Privacy policy

1. Controller and contact

The controller is Alessandra D’Amato, operating from Italy. For privacy questions or to exercise your rights, call the studio at the number below or use the contact page and state that your message is a privacy request. A data protection officer has not been appointed, as one is not required for this activity.

2. Data we process

When you submit an enquiry, we process the name, email address, message, and any work reference you choose to provide. Please do not send special-category or other sensitive personal data unless it is genuinely necessary.

Like most websites, the hosting infrastructure may process technical information needed to deliver and protect the site, such as IP address, browser and device information, requested pages, date and time, and security or error logs.

3. Why we use the data and the legal bases

We use enquiry data to answer your request, discuss a work, commission, delivery, or possible purchase, and keep the resulting correspondence. The legal basis is taking steps at your request before entering into a contract or performing a contract, where applicable (Article 6(1)(b) GDPR).

We use technical and security data to operate, secure, diagnose, and defend the website and our rights. The legal basis is our legitimate interest in a secure, functioning website and in preventing misuse (Article 6(1)(f) GDPR). Where the law requires retention or disclosure, the legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

Providing contact-form data is voluntary. If you do not provide the information needed to reply, we may be unable to respond to your enquiry.

4. Recipients and international transfers

Data is accessible only to the studio and service providers needed to host the website, maintain its technical operation, or deliver email. Enquiries are sent through the email-delivery provider configured for the website, if that service is enabled. Those providers act on our instructions where they process data for us.

A provider may process data outside the European Economic Area. Where that happens, transfers are made only under a lawful transfer mechanism, such as an adequacy decision or appropriate safeguards under Chapter V GDPR. Information about the current providers and safeguards can be requested through the contact details in this notice.

We may disclose data to public authorities, advisers, or third parties where required by law or reasonably necessary to establish, exercise, or defend legal claims.

5. Retention

Enquiries and related correspondence are normally kept for up to 24 months after the last meaningful contact, then deleted or anonymised. We may retain them longer where needed to manage an ongoing relationship, meet accounting or legal obligations, or establish, exercise, or defend legal claims. Technical logs are retained only for the period necessary for security and operation.

6. Cookies and similar technologies

This site currently uses one strictly necessary preference cookie: locale. It records your choice of Italian or English, is set for up to one year, and uses the SameSite=Lax attribute. It is not used to track you across websites.

This site does not currently use analytics, advertising, profiling cookies, social-media plug-ins, or newsletter tracking. If non-essential cookies or similar technologies are introduced, we will update this notice and ask for consent before they are placed, where consent is required.

7. Your rights and complaints

Subject to the conditions in the GDPR, you may request access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may also complain to your local supervisory authority. In Italy, this is the Garante per la protezione dei dati personali.

We do not make decisions about you solely through automated processing or profiling that produce legal or similarly significant effects.

8. Security, children, and changes

We use measures appropriate to the nature of the data and risk, including limiting access to people and providers who need it. No online transmission or storage system can be guaranteed completely secure.

The website is not directed at children and we do not knowingly collect personal data from children. We may update this notice when our practices or the law changes; the date at the top shows the latest version.