Cookie Policy

Everything this website stores on your device: what it is, what it does, how long it lasts and how to remove it.

Last updated: 11 October 2026

Introduction

This document describes the technologies that allow this Application to achieve the purposes described below. They are technologies that let the Owner store or read information on the User's device, for example by setting a cookie, or use its resources, for example by running a script, when the User interacts with this Application.

For simplicity, in this document all of these technologies are called Trackers, and the term Cookie is used only where it is necessary to refer specifically to that particular type of tool. The distinction is not merely formal: Article 122 of the Italian Privacy Code applies to any storing of information on the User's device, and therefore also to the browser's local and session storage, which in this document are listed together with cookies.

Some of the purposes for which Trackers are used require the User's consent. Where consent is given, it can be freely withdrawn at any time by following the instructions contained in this document.

This Application uses Trackers managed directly by the Owner, known as first-party Trackers, and may use Trackers that enable services provided by third parties, known as third-party Trackers. Unless otherwise stated, those third parties have access to their respective Trackers. Duration and expiry may vary depending on what the Owner or each provider has set; some expire at the end of the browsing session.

Data Controller

Edoardo BiondiTrading as EddidesignVia M. Sanmicheli 4, 25034 Orzinuovi (BS), ItaliaVAT no. and tax code: IT04412890982Email: info@eddidesign.itPhone: +39 333 8899224

How this Application uses Trackers

Necessary

These tools are strictly necessary for the website to work and to deliver the services the User explicitly requests. Without them the website cannot function properly, so they cannot be switched off and do not require consent.

Website preferences and operation

This Application stores some information directly on the User's device in order to remember their choices and make the pages work correctly: the preferences expressed in this panel and the state of the opening animation. They are managed by the Owner, are not transmitted to third parties, and do not allow the User to be identified or tracked across other websites.

Place of processing: Italy (the User's device)
Personal Data processed: Trackers
Legal basis: Article 122 of the Italian Privacy Code (Legislative Decree 196/2003) and Article 6(1)(f) GDPR: technical tools, exempt from consent because they are strictly necessary to provide the service requested by the User.
Retention period: See the duration indicated for each tool. The User can delete them at any time from their browser settings.
Trackers used: ed_consent, ed_lang_banner, ed_avviso_cookie, ed_preview

Vercel

Vercel is the hosting service on which this Application is published: it delivers the pages to the User's browser and runs the website's functions, such as sending the contact form. For technical and security reasons it records system logs that may contain the User's IP address, the page requested and the browser's characteristics.

Provider: Vercel Inc.
Place of processing: United States
Personal Data processed: Usage Data, IP address, various types of Data as specified in the privacy policy of the service
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in delivering the website and keeping it secure. Vercel acts as a Data Processor pursuant to Article 28 GDPR.
Retention period: Technical logs are retained by the provider for the period stated in its privacy policy, as a rule no longer than 30 days.
Privacy policy of the service: https://vercel.com/legal/privacy-policy
Trackers used: This service stores no information on the User's device.

Sanity

Sanity is the system the Owner uses to manage the website's content (texts, projects, images) and the network that delivers images to the User's browser. When a page displays a photograph, the browser requests it from Sanity's servers, which for technical reasons record the IP address and the characteristics of the request.

Provider: Sanity AS
Place of processing: Norway (European Economic Area) and United States
Personal Data processed: Usage Data, IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in publishing and distributing the website's content. Sanity acts as a Data Processor pursuant to Article 28 GDPR.
Retention period: Technical logs are retained by the provider for the period stated in its privacy policy.
Privacy policy of the service: https://www.sanity.io/legal/privacy
Trackers used: This service stores no information on the User's device.

Contact form

Users who fill in one of the forms on this Application send the Owner the data entered in the form's fields. The content is delivered by email to the Owner's mailbox: there is no archive, database or User profile on the website. The data is used solely to reply to the request and, if the relationship continues, to prepare a quote.

Place of processing: Italy
Personal Data processed: first name, email address, type of service requested and budget range indicated, content of the message, address of the location, only if the User expressly requests an on-site service
Legal basis: Article 6(1)(b) GDPR: processing is necessary in order to take steps at the User's request prior to entering into a contract. Providing the data is optional, but without a name and an email address it is not possible to reply.
Retention period: Messages are kept in the Owner's mailbox for as long as needed to handle the request and, where a commercial relationship follows, for the period required by civil and tax obligations. Requests that do not lead to a relationship are deleted within 24 months.
Trackers used: This service stores no information on the User's device.

Free website audit

Users who wish to may request a free technical audit of their own website by providing its address and their email address. The request is passed to a service run by the Owner on a separate domain (tools.eddidesign.it), which queues it, examines the website indicated and sends the report to the email address supplied by the User. The service records the sender's IP address in order to limit abuse and to avoid the same website being analysed several times within the same day. The audit covers pages that are already public and does not access restricted areas. The service is run by the Owner, but requests to tools.eddidesign.it pass through the network of Cloudflare, Inc., which provides the connection and protection infrastructure and therefore receives the IP address and browser characteristics of the person sending the request. Cloudflare acts as a Data Processor pursuant to Article 28 GDPR.

Provider: Cloudflare, Inc.
Place of processing: Italy (the Owner's service) and United States (Cloudflare, Inc. network)
Personal Data processed: email address, first name, IP address, Usage Data, address of the website to be analysed
Legal basis: Article 6(1)(b) GDPR: processing is necessary in order to take steps at the User's request prior to entering into a contract, the User having asked for the service of their own accord. Providing the data is optional, but without the website address and an email address it is not possible either to run the audit or to deliver its result. The recording of the IP address for anti-abuse purposes, and the transit through the Cloudflare network, also rely on Article 6(1)(f), the Owner's legitimate interest in protecting the service and keeping it reachable. The transfer to the United States takes place on the basis of the adequacy decision concerning the EU-US Data Privacy Framework, to which Cloudflare, Inc. adheres, and of the standard contractual clauses included in its data processing agreement.
Retention period: The request and the resulting report are kept by the service for as long as needed to complete the audit and to handle any follow-up questions, and in any case no longer than 24 months. The IP address is kept only for as long as the anti-abuse checks require. Cloudflare's technical logs are retained by the provider for the period stated in its privacy policy.
Privacy policy of the service: https://www.cloudflare.com/privacypolicy/
Trackers used: This service stores no information on the User's device.

SiteGround

SiteGround provides the email service associated with the eddidesign.it domain. Messages sent through the forms on this Application, and those exchanged directly with the Owner, pass through and are stored on this service, which acts as a Data Processor. The provider states that it may also transfer data outside the European Economic Area, on the basis of European Commission adequacy decisions or standard contractual clauses.

Provider: SiteGround Spain S.L.
Place of processing: Spain (European Union), with possible transfers to third countries
Personal Data processed: Data communicated while using the service, email address
Legal basis: Articles 6(1)(b) and 6(1)(f) GDPR: performance of pre-contractual measures and the Owner's legitimate interest in managing its own correspondence.
Retention period: As indicated for the contact form.
Privacy policy of the service: https://it.siteground.com/privacy.htm
Trackers used: This service stores no information on the User's device.

Upstash

To prevent automated unwanted messages, this Application counts how many requests come from the same IP address within one minute and blocks those in excess. The count is stored in a temporary store provided by Upstash and deletes itself when the minute expires: no profile is built and the IP address is not linked to any other data.

Provider: Upstash, Inc.
Place of processing: European Union and United States
Personal Data processed: IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in protecting the website from abuse and keeping the contact form working.
Retention period: 60 seconds, after which the data is automatically deleted.
Privacy policy of the service: https://upstash.com/trust/privacy.pdf
Trackers used: This service stores no information on the User's device.

Aggregate statistics

Tools that count how many people visit the website and how many contact requests arrive, in aggregate form. They write nothing to the User's device and retain no data that would make it possible to identify them or recognise them on a later visit: for this reason they do not require consent. They only serve the Owner to understand which pages work.

Traffic analytics (Vercel Web Analytics)

It counts how many pages are viewed and which websites visitors come from, in order to understand what works. It does NOT write cookies and stores nothing on the device. To avoid counting the same visit twice it uses a code derived from the request, which is not stored and is discarded within 24 hours: it therefore cannot be used to recognise the same person on a later visit or on another website. For this reason it does not require consent and does not appear among the panel's choices. It is the same provider that already hosts the website, so this processing does not add a new recipient.

Provider: Vercel Inc.
Place of processing: United States
Personal Data processed: Usage Data, IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in knowing how their own website performs in aggregate form. Article 122 of the Italian Privacy Code does not apply, because no information is stored on or read from the User's device.
Retention period: Aggregated data remains available for one month, after which it is deleted by the provider.
Privacy policy of the service: https://vercel.com/legal/privacy-policy
Trackers used: This service stores no information on the User's device.

Analytics and click map (Eddidesign's own tool)

Our own internal tool, hosted on tools.eddidesign.it, counts page views, which websites visitors come from and the type of device, and records where on the page people click and how far they scroll, in order to draw a click map and understand which parts of the website work. It does NOT write cookies and stores nothing on the device. The IP address is not kept: to avoid counting the same visit twice the server derives from it, together with the browser type, a code that changes every day and that cannot be linked to anyone the following day. For clicks only the position and the name of the button or link are recorded, never what is typed into fields. For this reason it does not require consent and does not appear among the panel's choices.

Place of processing: Italy (Oracle Cloud server in Milan), through the Cloudflare network
Personal Data processed: Usage Data, IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in knowing how their own website performs in aggregate form. Article 122 of the Italian Privacy Code does not apply, because no information is stored on or read from the User's device.
Retention period: 13 months, after which the events are deleted automatically.
Trackers used: This service stores no information on the User's device.

Contact request counter

When a form is submitted, or when the WhatsApp button or the phone number is tapped, the website records a count. For each count only four pieces of information are kept: the moment, the type of action, the page it started from and the website the visitor came from. Nothing that identifies the person is kept: no name, no email address, no message text, no IP address, and no identifier that would allow two visits to be linked. The count only serves to know how many requests arrive and where from.

Place of processing: European Union
Personal Data processed: Usage Data
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in measuring the effectiveness of their own website in aggregate form. As no data referable to a person is retained, the count does not make it possible to identify the User.
Retention period: The most recent 500 records, which at current volumes corresponds to more than one year. Older ones are automatically overwritten.
Trackers used: This service stores no information on the User's device.

Targeting and advertising

Tools that deliver advertising content tailored to the User's interests and measure its performance. Their use requires the User's consent.

Meta Pixel (Facebook and Instagram)

The Meta Pixel is a tool provided by Meta Platforms Ireland Ltd. that informs Meta of visits to this Application and of certain actions taken on it, such as submitting a contact form or tapping the WhatsApp button or the phone number. It allows the Owner to know how many requests come from its adverts on Facebook and Instagram and to show adverts to people who have already visited the website. It is loaded only after the User has given consent to the Targeting and advertising category: until then no Meta script is executed and no data is sent. The name, email address, phone number and message text are never passed to the pixel. For the collection and transmission of data through the pixel, the Owner and Meta are joint controllers (Article 26 GDPR), under the joint controller addendum provided by Meta; any further processing is carried out by Meta as an independent controller, in accordance with its own privacy policy.

Provider: Meta Platforms Ireland Ltd.
Place of processing: Ireland and United States (transfer based on the EU-US Data Privacy Framework)
Personal Data processed: Usage Data, Trackers, IP address, device and browser identifiers, interactions with the website, such as pages visited and form submissions
Legal basis: Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code: the User's consent, which can be withdrawn at any time from the preferences panel. The transfer to the United States takes place on the basis of the adequacy decision concerning the EU-US Data Privacy Framework, to which Meta Platforms, Inc. adheres.
Retention period: The Trackers last 90 days, as indicated below. The data received by Meta is retained for the period stated in its privacy policy.
Privacy policy of the service: https://www.facebook.com/privacy/policy/
Opt out: https://www.facebook.com/adpreferences/ad_settings
Trackers used: _fbp, fr

Complete list of Trackers

This table lists every piece of information this Application stores on the User's device, with the exact name under which it can be found in the browser settings.

Name	Type	Origin	Duration	Purpose
`ed_consent`	localStorage	First party	12 months (after which preferences are requested again)	Stores the privacy preferences the User expressed in this panel, together with the date of the choice. It is the tool that makes it possible NOT to load the trackers that were not consented to.
`ed_lang_banner`	localStorage	First party	persistent, until deleted	Remembers that the User has already dismissed the notice offering the English version of the website.
`ed_avviso_cookie`	localStorage	First party	persistent, until deleted	Remembers that the User has already read the notice declaring that only technical cookies are used, so it is not shown again on every visit. It is not a consent record: there is nothing to consent to.
`ed_preview`	Cookie	First party	7 days	Reserved for the Owner and their collaborators: it allows unpublished pages to be previewed. It is only set when accessing through a reserved link and never reaches the public.
`_fbp`	Cookie	First party	90 days	Distinguishes one browser from another in order to link visits and contact requests to the Meta adverts that generated them.
`fr`	Cookie	Third party	90 days	Set by Meta on the facebook.com domain, usually when the User has a Facebook or Instagram account: Meta uses it to deliver adverts and measure their performance.

How to manage preferences and give or withdraw consent

Where the use of a Tracker is based on consent, Users can give or withdraw it at any time from this Application's privacy preferences panel, reachable from the button below and from the link at the bottom of every page. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

For third-party Trackers, Users can also manage their preferences by visiting the provider's opt-out link, where available and indicated in this document, or by contacting the provider directly.

How to control or delete Trackers from your browser

Regardless of the preferences panel, Users can use their browser settings to see which cookies and which data have been stored on the device, to block them and to delete them. Browser settings, however, do not allow the per-category control offered by the panel: deleting everything also means losing the privacy preferences expressed, which will therefore be requested again.

Instructions for the most common browsers:

Consequences of refusing consent

Users are free to decide whether or not to allow the use of Trackers that require consent, and refusing does not in any way limit access to the content of this Application. Necessary Trackers, on the other hand, cannot be switched off from the panel because without them the pages do not work: they can still be blocked from the browser settings, accepting that some features will stop behaving as expected.

Definitions and legal references

Personal Data (or Data): Any information that, directly or indirectly, including in connection with any other information, makes a natural person identified or identifiable.
Usage Data: Information collected automatically through this Application, including from third-party services integrated into it: the IP addresses or domain names of the devices used by the User, the URI addresses of the pages requested, the time of the request, the method used to submit it to the server, the size of the response, the status code returned, the country of origin, the characteristics of the browser and operating system, the time spent on each page and the sequence of pages visited.
User: The individual using this Application who, unless otherwise specified, coincides with the Data Subject.
Data Subject: The natural person to whom the Personal Data refers.
Data Processor (or Processor): The natural or legal person, public authority or any other body that processes personal data on behalf of the Owner, as described in this notice.
Data Controller (or Owner): The natural or legal person that, alone or jointly with others, determines the purposes and means of the processing of personal data, including the security measures concerning the operation and use of this Application.
This Application: The hardware or software tool through which Users' Personal Data is collected and processed, in this case the website eddidesign.it.
Service: The service provided by this Application, as described on its pages.
Cookie: Small pieces of data stored within the User's browser. They are a particular type of Tracker.
Tracker: Any technology, for example cookies, browser local and session storage, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting, that makes it possible to track Users by collecting or storing information on their device.
European Union (or EU): Unless otherwise specified, any reference to the European Union in this document extends to all current member states of the European Union and of the European Economic Area.

Legal references

This notice is drafted on the basis of several legal instruments, including Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC as amended by Directive 2009/136/EC, Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and the Italian Data Protection Authority's Guidelines of 10 June 2021 on cookies and other tracking tools.

Unless otherwise stated, this notice concerns exclusively this Application.

Owner's contact details

Edoardo BiondiTrading as EddidesignVia M. Sanmicheli 4, 25034 Orzinuovi (BS), ItaliaVAT no. and tax code: IT04412890982Email: info@eddidesign.itPhone: +39 333 8899224