Legal
Privacy Policy
Last updated · 1 August 2026
This notice explains how Stache Studio processes the personal data of people who visit www.stachestudio.eu, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It is written to be read, not endured: if anything is unclear, write to us at mail@stachestudio.eu.
//01 Who processes your data
The data controller is Stache Studio — [ragione sociale], VAT no. [P. IVA], [indirizzo della sede], Florence (Italy).
For anything concerning personal data, the contact point is mail@stachestudio.eu. We have not appointed a Data Protection Officer: the conditions set out in Article 37 GDPR do not apply to us.
//02 What we collect
The site is static and requires no account. The personal data that reaches us is limited, and this is the full list.
- What you send through the contact form — your name, email address and the text of your message. Those are the only fields. Along with the message we also receive the page it was sent from and the IP address of the request, which help us understand the context and spot automated submissions.
- Usage data — collected by Google Analytics 4 only if you consent: pages viewed, time on page, device and browser type, language, referral source and an approximate location (country and city). Google does not show us your IP address and does not store it in the reports.
- Server technical data — Cloudflare, which hosts the site, logs incoming requests (IP address, date and time, page, user agent) in order to deliver the service, defend it from attacks and diagnose faults.
- Local storage in your browser — two entries kept on your device and never sent to us: the language you picked and your cookie decision. Both are described in the Cookie Policy.
We do not collect special categories of data (Article 9 GDPR), and we carry out no profiling or automated decision-making.
//03 Why we process it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to enquiries sent through the contact form | Name, email, message | Art. 6(1)(b) — steps taken at your request before entering a contract |
| Understanding how the site is used, and improving it | Usage data | Art. 6(1)(a) — your consent, which you can withdraw at any time |
| Keeping the site online, secure and free of spam | Technical logs, IP address | Art. 6(1)(f) — our legitimate interest in the security of the service |
//04 Who else sees the data
We do not sell data and we do not pass it to third parties for their own purposes. We rely on three providers, which process it on our behalf as processors:
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery network, attack protection | United States, with EU network |
| Resend | Delivers contact form messages to our inbox | United States |
| Google Ireland Limited | Google Analytics 4, usage statistics | Ireland, with transfers to the United States |
Data may also be disclosed to public authorities where the law requires it.
//05 Transfers outside the European Union
Some providers are based in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on certification under the EU-U.S. Data Privacy Framework, together with the supplementary measures set out in the respective agreements.
//06 How long we keep it
- Contact form messages — 24 months from the last exchange, then deleted. If the enquiry turns into a project, retention follows our contractual and tax obligations.
- Usage data — according to the data retention setting in Google Analytics 4, and in any case no longer than 14 months. Analytics cookies last 13 months.
- Technical logs — for the period set by Cloudflare's policies: a short window, tied to security and diagnostics.
- Your cookie choice — 180 days, after which the banner reappears and we ask again.
//07 Your rights
The GDPR gives you rights you can exercise at any time, free of charge:
- Access — find out what data we hold about you and get a copy.
- Rectification — correct data that is wrong or incomplete.
- Erasure — have it deleted, where we have no grounds to keep it.
- Restriction — freeze its use while a dispute is verified.
- Portability — receive it in a machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdrawal of consent — withdraw your consent to analytics at any time, from the Cookie preferences link at the bottom of every page. Withdrawal does not affect what happened before it.
An email to mail@stachestudio.eu is enough: we reply within one month. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority or bring the matter before a court.
//08 Providing your data
Filling in the contact form is entirely up to you, but name, email and message are needed for us to reply: without them the request cannot be sent. Consent to analytics is optional, and declining it does not limit your use of the site in any way.
//09 Children
This site is aimed at professionals and companies and is not intended for children under 14. We do not knowingly collect their data; if it happens, write to us and we will delete it.
//10 Changes
If we change tools or purposes we will update this page and the date below. Substantial changes will be brought back to you through the cookie banner. Last updated: 1 August 2026.