Privacy and cookie notice

1. Data controller

Moodesign Srls, P.za Cinque Giornate 26, 20020 Arese (MI), P.IVA 09128170967. Email: lucauslenghi@moodesign.eu. Phone: +39 380 174 13 09.

Data Protection Officer (DPO): not appointed, as it is not required for the processing we carry out.

2. What data we process

Browsing data: to run the site, the hosting service (Cloudflare Pages) automatically logs technical data such as IP address, date and time of the request, requested page and browser type. We do not use it to identify visitors.

Data sent through the contact form: first name (required), last name (optional), email address (required) and the message text (optional).

Data sent by email or phone: the data you give us when you write or call the contacts shown on the site.

3. Purposes and legal basis

Replying to your contact or quote requests: legal basis Art. 6(1)(b) GDPR (pre-contractual steps at your request). By sending the form you confirm you have read this notice.

Ensuring the site works and is secure: legal basis Art. 6(1)(f) GDPR (legitimate interest of the controller).

We do not use your data for newsletters, marketing or profiling.

4. Providing your data

Name and email are needed to reply to you; without them the request cannot be sent. The other fields are optional.

5. Recipients and processors

Cloudflare, Inc. (hosting and delivery of the site), which processes browsing data on our behalf under its standard Data Processing Addendum (DPA).

Sendinblue SAS (Brevo), France, which forwards contact form messages to our mailbox on our behalf, under its standard Data Processing Addendum (DPA); it keeps only technical sending logs for the period set out in the DPA.

Your data is not disclosed or sold. It may be shared with authorities only where required by law.

6. Transfers outside the EU

Cloudflare, Inc. (United States) may process browsing data outside the European Economic Area, on the basis of the EU-U.S. Data Privacy Framework or the standard contractual clauses of the European Commission included in its DPA. Brevo processes data mainly in the European Union; any transfers outside the EEA by its sub-processors rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, where applicable.

7. How long we keep data

Form messages and emails: for as long as needed to handle the request and any relationship that follows, and no longer than 24 months after the last contact, unless the law requires otherwise (e.g. tax obligations if a contract is signed).

Browsing data: for the technical period set by the hosting provider (Cloudflare): short-lived technical logs, used only for security and operation.

8. Your rights

You can ask at any time for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest (Arts. 15-22 GDPR), by writing to lucauslenghi@moodesign.eu.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

9. Cookies

This site uses no profiling cookies, no analytics tools and no third-party cookies. It stores no data in your browser (localStorage).

Fonts and images are hosted on the site itself: no data is sent to Google Fonts or other external services while browsing.

The contact form uses technical anti-spam checks (a hidden field and filling time) that use no cookies.

For this reason, under the Italian DPA's cookie guidelines (decision of 10 June 2021), no consent banner is required. If we add analytics or third-party content in the future, we will update this notice and ask for consent where needed.

The private /cockpit area, used only by the studio, is password-protected through browser authentication, without cookies; it does not concern site visitors.

10. Changes

We may update this notice. The current version is always published on this page, with the date of the last update.