Privacy Policy

How eddidesign.it processes personal data: what we collect, why, who we entrust it to, and how you can intervene.

Last updated: 11 October 2026

This notice explains what personal data we collect when you visit eddidesign.it or write to us, why we collect it, who we entrust it to, and what rights you can exercise. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and to Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

In short: without your consent, this website sets no cookies at all. The optional tools described below (Targeting and advertising) are activated only if you accept them from the preferences panel, and you can withdraw your choice at any time. The website sells data to no one and keeps no archive of Users. The other data it processes is the technical data needed to display the pages, plus whatever you choose to write to us in the contact form.

Summary

What we collect

Trackers
Usage Data
IP address
various types of Data as specified in the privacy policy of the service
first name
email address
type of service requested and budget range indicated
content of the message
address of the location, only if the User expressly requests an on-site service
address of the website to be analysed
Data communicated while using the service
device and browser identifiers
interactions with the website, such as pages visited and form submissions

Who we entrust the data to

Vercel Inc.
Sanity AS
Cloudflare, Inc.
SiteGround Spain S.L.
Upstash, Inc.
Vercel Inc.
Meta Platforms Ireland Ltd.

Why

Hosting and backend infrastructure
Contacting the User
SPAM protection
Managing preferences and website operation
Analytics
Remarketing and advertising campaign measurement

Data Controller

The Owner has not appointed a Data Protection Officer (DPO): none of the cases set out in Article 37 GDPR applies, as the Owner is not a public authority and its core activities consist neither of regular and systematic monitoring of data subjects on a large scale nor of processing special categories of data.

Edoardo BiondiTrading as EddidesignVia M. Sanmicheli 4, 25034 Orzinuovi (BS), ItaliaVAT no. and tax code: IT04412890982Email: info@eddidesign.itPhone: +39 333 8899224

Types of Data collected

Among the types of Personal Data that this Application collects, by itself or through third parties, there are:

Trackers
Usage Data
IP address
various types of Data as specified in the privacy policy of the service
first name
email address
type of service requested and budget range indicated
content of the message
address of the location, only if the User expressly requests an on-site service
address of the website to be analysed
Data communicated while using the service
device and browser identifiers
interactions with the website, such as pages visited and form submissions

Full details on each type of data collected are provided further below, in the section dedicated to each service, or shown through specific information notices displayed before the data is collected.

Personal Data may be freely provided by the User, by filling in a form, or collected automatically while using this Application, as is the case with the Usage Data recorded by the servers.

In the forms on this Application, mandatory fields are marked as such. Refusing to provide mandatory data makes it impossible to act on the request; refusing to provide optional data has no consequence whatsoever. Users who are unsure which data is mandatory are invited to contact the Owner.

Users are responsible for any third-party Personal Data they communicate through this Application, and warrant that they have the right to communicate it, releasing the Owner from any liability towards those third parties.

This Application does not request and does not knowingly process special categories of personal data within the meaning of Article 9 GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, sex life, genetic or biometric data). Users are asked not to enter any such data in the free-text fields of the forms.

Mode and place of processing the Data

Methods of processing

The Owner adopts technical and organisational security measures appropriate to prevent unauthorised access, disclosure, modification or destruction of Personal Data. These include: encrypted HTTPS connections on all pages, access to mailboxes and management panels protected by personal credentials and two-factor authentication, and limiting the data collected to what is actually necessary.

Processing is carried out using IT and telematic tools, with organisational methods strictly related to the stated purposes. Besides the Owner, the Data may be accessed by the Owner's collaborators authorised to process it and by the technical service providers listed in this document, appointed as Data Processors pursuant to Article 28 GDPR. An up-to-date list of Processors can be requested from the Owner at any time.

The Data is not disseminated, is not communicated to parties other than those indicated in this document, and is in no case transferred or sold to third parties for commercial purposes.

Place

The Data is processed at the Owner's operating office, in Italy, and at the data centres of the providers listed in the details section, where the place of processing is specified for each of them.

Some providers process the Data in countries outside the European Economic Area, in particular in the United States. These transfers take place on the basis of the safeguards set out in Chapter V of the GDPR: the standard contractual clauses approved by the European Commission with implementing decision (EU) 2021/914, supplemented where necessary by additional measures, and, for providers that have joined it, the adequacy decision concerning the EU-US Data Privacy Framework. Users have the right to obtain a copy of the safeguards adopted by writing to the Owner.

Retention period

Personal Data is processed and stored for as long as required by the purpose for which it was collected. The period envisaged for each processing operation is stated in the details section. When the retention period ends the Data is deleted: from that moment on, the rights of access, erasure, rectification and portability can no longer be exercised over it.

Purposes of the Data collected

The User's Data is collected to allow the Owner to provide the Service, comply with legal obligations, respond to requests from the User or to measures issued by the authorities, protect its rights and legitimate interests, detect any fraudulent activity, as well as for the following purposes:

Hosting and backend infrastructure: Vercel, Sanity
Contacting the User: Contact form, Free website audit, SiteGround
SPAM protection: Upstash
Managing preferences and website operation: Website preferences and operation
Analytics: Traffic analytics (Vercel Web Analytics), Analytics and click map (Eddidesign's own tool), Contact request counter
Remarketing and advertising campaign measurement: Meta Pixel (Facebook and Instagram)

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes, using the services indicated below. For each service the data processed, the legal basis, the place of processing and the retention period are specified.

Hosting and backend infrastructure

This type of service hosts data and files that enable this Application to run and be distributed, as well as providing a ready-made infrastructure to run specific features of this Application. Some of these services run through geographically distributed servers, making it difficult to determine the exact location where the Personal Data is stored.

Vercel

Vercel is the hosting service on which this Application is published: it delivers the pages to the User's browser and runs the website's functions, such as sending the contact form. For technical and security reasons it records system logs that may contain the User's IP address, the page requested and the browser's characteristics.

Provider: Vercel Inc.
Place of processing: United States
Personal Data processed: Usage Data, IP address, various types of Data as specified in the privacy policy of the service
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in delivering the website and keeping it secure. Vercel acts as a Data Processor pursuant to Article 28 GDPR.
Retention period: Technical logs are retained by the provider for the period stated in its privacy policy, as a rule no longer than 30 days.
Privacy policy of the service: https://vercel.com/legal/privacy-policy
Trackers used: This service stores no information on the User's device.

Sanity

Sanity is the system the Owner uses to manage the website's content (texts, projects, images) and the network that delivers images to the User's browser. When a page displays a photograph, the browser requests it from Sanity's servers, which for technical reasons record the IP address and the characteristics of the request.

Provider: Sanity AS
Place of processing: Norway (European Economic Area) and United States
Personal Data processed: Usage Data, IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in publishing and distributing the website's content. Sanity acts as a Data Processor pursuant to Article 28 GDPR.
Retention period: Technical logs are retained by the provider for the period stated in its privacy policy.
Privacy policy of the service: https://www.sanity.io/legal/privacy
Trackers used: This service stores no information on the User's device.

Contacting the User

By filling in the contact form with their Data, the User consents to its use to reply to requests for information, for quotes, or of any other kind indicated by the form's heading.

Contact form

Users who fill in one of the forms on this Application send the Owner the data entered in the form's fields. The content is delivered by email to the Owner's mailbox: there is no archive, database or User profile on the website. The data is used solely to reply to the request and, if the relationship continues, to prepare a quote.

Place of processing: Italy
Personal Data processed: first name, email address, type of service requested and budget range indicated, content of the message, address of the location, only if the User expressly requests an on-site service
Legal basis: Article 6(1)(b) GDPR: processing is necessary in order to take steps at the User's request prior to entering into a contract. Providing the data is optional, but without a name and an email address it is not possible to reply.
Retention period: Messages are kept in the Owner's mailbox for as long as needed to handle the request and, where a commercial relationship follows, for the period required by civil and tax obligations. Requests that do not lead to a relationship are deleted within 24 months.
Trackers used: This service stores no information on the User's device.

Free website audit

Users who wish to may request a free technical audit of their own website by providing its address and their email address. The request is passed to a service run by the Owner on a separate domain (tools.eddidesign.it), which queues it, examines the website indicated and sends the report to the email address supplied by the User. The service records the sender's IP address in order to limit abuse and to avoid the same website being analysed several times within the same day. The audit covers pages that are already public and does not access restricted areas. The service is run by the Owner, but requests to tools.eddidesign.it pass through the network of Cloudflare, Inc., which provides the connection and protection infrastructure and therefore receives the IP address and browser characteristics of the person sending the request. Cloudflare acts as a Data Processor pursuant to Article 28 GDPR.

Provider: Cloudflare, Inc.
Place of processing: Italy (the Owner's service) and United States (Cloudflare, Inc. network)
Personal Data processed: email address, first name, IP address, Usage Data, address of the website to be analysed
Legal basis: Article 6(1)(b) GDPR: processing is necessary in order to take steps at the User's request prior to entering into a contract, the User having asked for the service of their own accord. Providing the data is optional, but without the website address and an email address it is not possible either to run the audit or to deliver its result. The recording of the IP address for anti-abuse purposes, and the transit through the Cloudflare network, also rely on Article 6(1)(f), the Owner's legitimate interest in protecting the service and keeping it reachable. The transfer to the United States takes place on the basis of the adequacy decision concerning the EU-US Data Privacy Framework, to which Cloudflare, Inc. adheres, and of the standard contractual clauses included in its data processing agreement.
Retention period: The request and the resulting report are kept by the service for as long as needed to complete the audit and to handle any follow-up questions, and in any case no longer than 24 months. The IP address is kept only for as long as the anti-abuse checks require. Cloudflare's technical logs are retained by the provider for the period stated in its privacy policy.
Privacy policy of the service: https://www.cloudflare.com/privacypolicy/
Trackers used: This service stores no information on the User's device.

SiteGround

SiteGround provides the email service associated with the eddidesign.it domain. Messages sent through the forms on this Application, and those exchanged directly with the Owner, pass through and are stored on this service, which acts as a Data Processor. The provider states that it may also transfer data outside the European Economic Area, on the basis of European Commission adequacy decisions or standard contractual clauses.

Provider: SiteGround Spain S.L.
Place of processing: Spain (European Union), with possible transfers to third countries
Personal Data processed: Data communicated while using the service, email address
Legal basis: Articles 6(1)(b) and 6(1)(f) GDPR: performance of pre-contractual measures and the Owner's legitimate interest in managing its own correspondence.
Retention period: As indicated for the contact form.
Privacy policy of the service: https://it.siteground.com/privacy.htm
Trackers used: This service stores no information on the User's device.

SPAM protection

This type of service analyses the traffic of this Application, potentially containing Users' Personal Data, in order to filter it from portions of traffic, messages and content that are recognised as SPAM.

Upstash

To prevent automated unwanted messages, this Application counts how many requests come from the same IP address within one minute and blocks those in excess. The count is stored in a temporary store provided by Upstash and deletes itself when the minute expires: no profile is built and the IP address is not linked to any other data.

Provider: Upstash, Inc.
Place of processing: European Union and United States
Personal Data processed: IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in protecting the website from abuse and keeping the contact form working.
Retention period: 60 seconds, after which the data is automatically deleted.
Privacy policy of the service: https://upstash.com/trust/privacy.pdf
Trackers used: This service stores no information on the User's device.

Managing preferences and website operation

This type of tool allows this Application to remember the User's choices while browsing, such as the privacy preferences expressed, and to ensure its features work correctly. They are managed directly by the Owner and do not transmit information to third parties.

Website preferences and operation

This Application stores some information directly on the User's device in order to remember their choices and make the pages work correctly: the preferences expressed in this panel and the state of the opening animation. They are managed by the Owner, are not transmitted to third parties, and do not allow the User to be identified or tracked across other websites.

Place of processing: Italy (the User's device)
Personal Data processed: Trackers
Legal basis: Article 122 of the Italian Privacy Code (Legislative Decree 196/2003) and Article 6(1)(f) GDPR: technical tools, exempt from consent because they are strictly necessary to provide the service requested by the User.
Retention period: See the duration indicated for each tool. The User can delete them at any time from their browser settings.
Trackers used: ed_consent, ed_lang_banner, ed_avviso_cookie, ed_preview

Analytics

The services contained in this section enable the Owner to monitor and analyse web traffic and can be used to keep track of User behaviour.

Traffic analytics (Vercel Web Analytics)

It counts how many pages are viewed and which websites visitors come from, in order to understand what works. It does NOT write cookies and stores nothing on the device. To avoid counting the same visit twice it uses a code derived from the request, which is not stored and is discarded within 24 hours: it therefore cannot be used to recognise the same person on a later visit or on another website. For this reason it does not require consent and does not appear among the panel's choices. It is the same provider that already hosts the website, so this processing does not add a new recipient.

Provider: Vercel Inc.
Place of processing: United States
Personal Data processed: Usage Data, IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in knowing how their own website performs in aggregate form. Article 122 of the Italian Privacy Code does not apply, because no information is stored on or read from the User's device.
Retention period: Aggregated data remains available for one month, after which it is deleted by the provider.
Privacy policy of the service: https://vercel.com/legal/privacy-policy
Trackers used: This service stores no information on the User's device.

Analytics and click map (Eddidesign's own tool)

Our own internal tool, hosted on tools.eddidesign.it, counts page views, which websites visitors come from and the type of device, and records where on the page people click and how far they scroll, in order to draw a click map and understand which parts of the website work. It does NOT write cookies and stores nothing on the device. The IP address is not kept: to avoid counting the same visit twice the server derives from it, together with the browser type, a code that changes every day and that cannot be linked to anyone the following day. For clicks only the position and the name of the button or link are recorded, never what is typed into fields. For this reason it does not require consent and does not appear among the panel's choices.

Place of processing: Italy (Oracle Cloud server in Milan), through the Cloudflare network
Personal Data processed: Usage Data, IP address
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in knowing how their own website performs in aggregate form. Article 122 of the Italian Privacy Code does not apply, because no information is stored on or read from the User's device.
Retention period: 13 months, after which the events are deleted automatically.
Trackers used: This service stores no information on the User's device.

Contact request counter

When a form is submitted, or when the WhatsApp button or the phone number is tapped, the website records a count. For each count only four pieces of information are kept: the moment, the type of action, the page it started from and the website the visitor came from. Nothing that identifies the person is kept: no name, no email address, no message text, no IP address, and no identifier that would allow two visits to be linked. The count only serves to know how many requests arrive and where from.

Place of processing: European Union
Personal Data processed: Usage Data
Legal basis: Article 6(1)(f) GDPR, the Owner's legitimate interest in measuring the effectiveness of their own website in aggregate form. As no data referable to a person is retained, the count does not make it possible to identify the User.
Retention period: The most recent 500 records, which at current volumes corresponds to more than one year. Older ones are automatically overwritten.
Trackers used: This service stores no information on the User's device.

Remarketing and advertising campaign measurement

This type of service lets the Owner know which visits and contact requests come from its advertising campaigns, and show adverts on the provider's platforms to people who have already visited this Application. It works through Trackers and is activated only with the User's consent.

Meta Pixel (Facebook and Instagram)

The Meta Pixel is a tool provided by Meta Platforms Ireland Ltd. that informs Meta of visits to this Application and of certain actions taken on it, such as submitting a contact form or tapping the WhatsApp button or the phone number. It allows the Owner to know how many requests come from its adverts on Facebook and Instagram and to show adverts to people who have already visited the website. It is loaded only after the User has given consent to the Targeting and advertising category: until then no Meta script is executed and no data is sent. The name, email address, phone number and message text are never passed to the pixel. For the collection and transmission of data through the pixel, the Owner and Meta are joint controllers (Article 26 GDPR), under the joint controller addendum provided by Meta; any further processing is carried out by Meta as an independent controller, in accordance with its own privacy policy.

Provider: Meta Platforms Ireland Ltd.
Place of processing: Ireland and United States (transfer based on the EU-US Data Privacy Framework)
Personal Data processed: Usage Data, Trackers, IP address, device and browser identifiers, interactions with the website, such as pages visited and form submissions
Legal basis: Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code: the User's consent, which can be withdrawn at any time from the preferences panel. The transfer to the United States takes place on the basis of the adequacy decision concerning the EU-US Data Privacy Framework, to which Meta Platforms, Inc. adheres.
Retention period: The Trackers last 90 days, as indicated below. The data received by Meta is retained for the period stated in its privacy policy.
Privacy policy of the service: https://www.facebook.com/privacy/policy/
Opt out: https://www.facebook.com/adpreferences/ad_settings
Trackers used: _fbp, fr

The rights of Users

Users may exercise certain rights regarding the Data processed by the Owner. In particular, within the limits set by law, Users have the right to:

withdraw their consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it (Article 7 GDPR).
object to the processing of their Data where it is carried out on a legal basis other than consent, on grounds relating to their particular situation (Article 21 GDPR).
access their Data, obtaining information on the processing and a copy of the Data processed (Article 15 GDPR).
verify their Data and request its rectification or completion if it is inaccurate or incomplete (Article 16 GDPR).
obtain the restriction of processing, in the cases provided for by law: in that case the Owner keeps the Data without using it for anything else (Article 18 GDPR).
obtain the erasure of their Data, where the conditions are met (Article 17 GDPR).
receive their Data in a structured, commonly used and machine-readable format, and request its transmission to another controller where technically feasible (Article 20 GDPR).
lodge a complaint with the supervisory authority or take legal action (Articles 77 and 79 GDPR).

Details on the right to object

Where Personal Data is processed in pursuit of a legitimate interest of the Owner, Users have the right to object to the processing on grounds relating to their particular situation. In that case the Owner stops the processing, unless it demonstrates compelling legitimate grounds that override the User's interests, or unless the processing is needed to establish, exercise or defend a legal claim.

The Owner does not process Data for direct marketing purposes and does not send newsletters or commercial communications to people who have not requested them. Should it do so in the future, Users will be able to object at any time, free of charge and without having to give reasons.

How to exercise these rights

To exercise their rights Users may write to the Owner's contact details indicated in this document. The request is free of charge and the Owner replies as soon as possible, and in any case within one month, extendable by two further months in particularly complex cases, informing the User accordingly. In order to reply, the Owner may ask for information needed to identify the person making the request.

Any rectification, erasure or restriction is communicated by the Owner to each recipient to whom the Data has been disclosed, unless this proves impossible or involves disproportionate effort.

Complaint to the supervisory authority

Users who believe that the processing of their Data infringes the GDPR may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, or by certified email to protocollo@pec.gpdp.it. Instructions are published at www.garanteprivacy.it. The possibility of bringing the matter before a court remains unaffected.

Further information about processing

Legal action

The User's Personal Data may be used by the Owner in court or in the stages leading up to it, to defend against misuse of this Application or of the related Services. Users acknowledge that the Owner may be required to disclose the Data by order of a public authority.

System logs and maintenance

For operating and maintenance purposes, this Application and the third-party services it uses may collect system logs, that is, files that record interactions and may contain Personal Data such as the IP address. These logs are used only to diagnose faults and to detect abuse; they are not used to profile Users.

Reviews shown on the website

This Application shows some reviews published by users on the Owner's Google profile. The public name, rating, text and profile picture are already public on Google and are fetched by the Owner's server, not by the visitor's browser: when opening these pages the User's browser does not contact Google's servers. The legal basis is the Owner's legitimate interest in presenting its own business (Article 6(1)(f) GDPR). Anyone who has written a review may at any time ask for it to be removed from the website by writing to the Owner's contact details, as well as edit or delete it directly on Google.

Links to external websites

This Application contains links to third-party websites, for example the Owner's social profiles, its Google profile or WhatsApp. The link opens only if the User clicks it: until then no data is transmitted to those sites. Once opened, those sites process data according to their own privacy notices, over which the Owner has no control.

Minors

This Application is aimed at professionals and businesses and is not intended for children under 14, from whom it does not knowingly request Personal Data. Should the Owner become aware of having collected a minor's data without the consent of the holder of parental responsibility, it would delete that data.

No automated decision-making

The Owner does not carry out automated decision-making, including profiling, producing legal effects concerning Users or similarly significantly affecting them, within the meaning of Article 22 GDPR.

Specific information notices

In addition to the information contained in this notice, this Application may provide Users with additional, contextual information notices concerning specific services or the collection of particular Personal Data, shown at the moment the data is requested.

Changes to this privacy notice

The Owner reserves the right to change this notice at any time, giving notice on this page and, where technically possible, informing Users through the contact details it holds. Users are invited to check this page regularly, referring to the date of last modification shown at the bottom. Where the changes concern processing based on consent, the Owner collects the User's consent again.

Information not contained in this notice

Further information about the processing of Personal Data can be requested from the Owner at any time, using the contact details given above.

Definitions and legal references

Personal Data (or Data): Any information that, directly or indirectly, including in connection with any other information, makes a natural person identified or identifiable.
Usage Data: Information collected automatically through this Application, including from third-party services integrated into it: the IP addresses or domain names of the devices used by the User, the URI addresses of the pages requested, the time of the request, the method used to submit it to the server, the size of the response, the status code returned, the country of origin, the characteristics of the browser and operating system, the time spent on each page and the sequence of pages visited.
User: The individual using this Application who, unless otherwise specified, coincides with the Data Subject.
Data Subject: The natural person to whom the Personal Data refers.
Data Processor (or Processor): The natural or legal person, public authority or any other body that processes personal data on behalf of the Owner, as described in this notice.
Data Controller (or Owner): The natural or legal person that, alone or jointly with others, determines the purposes and means of the processing of personal data, including the security measures concerning the operation and use of this Application.
This Application: The hardware or software tool through which Users' Personal Data is collected and processed, in this case the website eddidesign.it.
Service: The service provided by this Application, as described on its pages.
Cookie: Small pieces of data stored within the User's browser. They are a particular type of Tracker.
Tracker: Any technology, for example cookies, browser local and session storage, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting, that makes it possible to track Users by collecting or storing information on their device.
European Union (or EU): Unless otherwise specified, any reference to the European Union in this document extends to all current member states of the European Union and of the European Economic Area.

Legal references

This notice is drafted on the basis of several legal instruments, including Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC as amended by Directive 2009/136/EC, Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and the Italian Data Protection Authority's Guidelines of 10 June 2021 on cookies and other tracking tools.

Unless otherwise stated, this notice concerns exclusively this Application.

Owner's contact details