1. Who handles your data
The data controller is Simone Giorgiani Lugnan, a self-employed professional, with business address at Via Galvani 18, 34074 Monfalcone (GO), Italy, VAT no. 01395910324.
For any privacy question, write to simone@sgl.studio or to the certified email (PEC) [nome@pec.it]. I have not appointed a Data Protection Officer (DPO), as one is not required for my activity.
2. What data I process
- Browsing data: IP address, browser and device type, pages requested, date and time. These are collected automatically by the systems that run and protect the site.
- Data you give me: name, email, phone, company, messages and the content of your requests.
- WhatsApp chat: phone number, profile name and the messages you send me, which an AI assistant based on Anthropic’s Claude answers first.
- Order and invoice data: address, Italian tax code or VAT number, SDI recipient code or PEC, order details.
- Payment data: handled directly by the payment provider, Mollie B.V., based in the Netherlands (EU). I only receive the outcome, the amount and partial information on the method used (for example card type and last four digits), never the full number.
- Uploaded files: photos, videos, audio and text, which may contain people’s images and voices.
- Bookings: the date and time you choose and the details entered in the booking form; for the free call reserved for businesses, also company name, VAT number, phone and website.
- Newsletter: the email you sign up with, and the dates of sign-up and confirmation.
- Answers to the guided chat on the home page: they stay on your device and only reach me if you choose to attach them to a booking, a WhatsApp message or the contact form.
- Cookies and similar tools: see the cookie policy.
3. Why I process data, and on what basis
| Purpose | Legal basis | Data |
|---|---|---|
| Answering requests for information and quotes | Pre-contractual steps you asked for (Art. 6(1)(b) GDPR) | Contact details, message |
| Replying on WhatsApp, including through the AI assistant, and handing you over to me when you ask | Pre-contractual steps you asked for (Art. 6(1)(b)) | Number, profile name, messages |
| Booking and holding sessions on Google Meet, sending the invite and reminders | Performance of the contract (Art. 6(1)(b)) | Contact details, booking, project information, chat answers if you attach them |
| Reserving the free call for businesses by checking the VAT number on the European Commission’s VIES system | Legitimate interest in preventing misuse of free calls (Art. 6(1)(f)) | Company name, VAT number, website |
| Making and delivering videos and projects, handling revisions and support | Performance of the contract (Art. 6(1)(b)) | Contact details, order, files |
| Payments, electronic invoicing, accounting and tax obligations | Legal obligation (Art. 6(1)(c)) | Billing and payment data |
| Site security, preventing abuse and fraud, antivirus scanning of files | Legitimate interest in security (Art. 6(1)(f)) | Browsing data, uploaded files |
| Aggregate statistics on how the site is used, without cookies | Legitimate interest in improving the site (Art. 6(1)(f)) | Browsing data in aggregate form |
| Sending you the monthly newsletter, if you sign up. Your subscription only starts once you confirm it from the link in the email (double opt-in). The emails contain no pixels that record opens. | Consent (Art. 6(1)(a)), which you can withdraw at any time with one click. I may send clients emails about services similar to those they bought (Art. 130(4) Italian Privacy Code), and they can object at any time. | Email, sign-up and confirmation dates |
| Showing the video in my portfolio and on social media | Consent (Art. 6(1)(a)) | Final video and any images |
| Measuring advertising campaigns (Meta Pixel and Conversions API) | Consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code) | Online identifiers, events on the site |
| Establishing or defending my legal rights | Legitimate interest (Art. 6(1)(f)) | Data relevant to the case |
4. People who appear in your files
If you upload photos, videos or recordings showing other people, you confirm that you have their written consent, or that of both parents for minors, and you undertake to tell them about this processing, for example by having them sign the release form available in the order form, which refers to this policy. I use these files only to make the video you asked for.
- Individual clients: I process the files as controller, only to carry out the job.
- Business clients: if the files or projects contain personal data controlled by your company (employees, customers, models), I process them as a processor under Art. 28 GDPR, according to the agreement attached to the Terms.
I don’t use images to identify people and I don’t use your files to train artificial intelligence models. With AI tools I choose, wherever available, the settings that exclude training on uploaded content. The list of tools is on the How I use AI page.
5. How long I keep data
| Data | Period |
|---|---|
| Contact requests that go no further | [12] months from the last contact |
| WhatsApp chats | [12] months from the last message, unless needed for an order or contract |
| Files uploaded for a video | Deleted 30 days after final delivery. Requests not confirmed or cancelled: deleted within [7] days. |
| Final video | Downloadable for 30 days from delivery, then deleted, unless you agreed to the portfolio use |
| Orders, contracts, invoices | 10 years, as required by Italian civil and tax law (Art. 2220 of the Civil Code) |
| Technical and security logs | Up to [30] days, unless needed to investigate an incident |
| Newsletter | Until you unsubscribe. Unconfirmed sign-ups are deleted after [30] days. |
| Consent records | For as long as needed to prove they were collected correctly |
| Backups | Overwritten on rotation within [30] days |
6. Who I share data with
Data is processed by me and, on my behalf, by providers acting as processors under an agreement pursuant to Art. 28 GDPR:
- site hosting and infrastructure: Cloudflare, Inc. (United States); storage of files, orders and bookings: Cloudflare, in data centres in the European Union;
- mailbox: Google Workspace; video calls: Google Meet. Both are services of Google, a US company: some data may be processed in the United States (see point 7); sending automatic emails: [transactional email provider];
- newsletter: Brevo (Sendinblue SAS, France), with double opt-in and no open tracking;
- bookings: the site’s own booking system, with data in the same storage in the European Union;
- WhatsApp chat: WhatsApp Ireland Ltd. (Meta group), which handles the exchange of messages under the WhatsApp Business terms [role to be confirmed in the contract with Meta]; AI assistant: Claude by Anthropic, PBC (United States), used directly through Anthropic’s API: messages are processed in the United States and Anthropic does not use data sent through the API to train its models;
- electronic invoicing: [invoicing software];
- AI tools for generating and editing video, images and audio: listed in How I use AI;
- accounting advice: [accountant’s firm].
Some parties process data as independent controllers: Mollie B.V. (the Netherlands, in the European Union), which handles payments, including to prevent fraud and meet legal obligations; the payment services you choose on Mollie (for example PayPal, Satispay or Klarna), under their own terms; the Italian Revenue Agency through the Exchange System (SdI) for electronic invoices; Meta, only if you consent to marketing cookies; public authorities, when the law requires it. I don’t sell your data to anyone.
7. Transfers outside the European Union
Some providers are US companies and may process data in the United States: Anthropic (the AI assistant on WhatsApp, through its API), Google (email with Google Workspace and video calls with Google Meet), Cloudflare (site infrastructure) and Meta (WhatsApp and, only if you consent to marketing cookies, the Meta Pixel). In these cases the transfer relies on the EU-US Data Privacy Framework, for certified providers, and on the standard contractual clauses approved by the European Commission, with supplementary measures where needed. Storage of files, orders and bookings, which I run myself, stays in the European Union; Mollie, which handles payments, is based in the European Union. You can ask me for a copy of the safeguards in place.
8. How I protect data
Encrypted connections (HTTPS), files stored encrypted in private storage, checks on the real file type and antivirus scanning of every uploaded file, access to systems only with two-factor authentication, personal and expiring preview and download links, backups and automatic deletion according to the periods above. In the event of a data breach I follow the procedure under Articles 33 and 34 GDPR, including notifying the Italian Data Protection Authority within 72 hours where required.
9. Your rights
You can ask me at any time to access your data, correct it, erase it, restrict its processing or receive it in a portable format, and you can object to processing based on legitimate interest and to marketing (Articles 15–22 GDPR). You can withdraw any consent whenever you like, without affecting processing already carried out.
Write to simone@sgl.studio: I reply within one month. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
10. Other information
Required and optional data
Fields marked with an asterisk are needed to reply to you or perform the contract: without them, I can’t provide the service. Leaving optional fields empty has no consequences.
Minors
The services are aimed at adults. I don’t knowingly collect data from people under 18, except images provided by those with parental responsibility to make a video.
Automated decisions
I don’t take decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR).
Changes
I update this policy when the services or the rules change. The date at the top shows the version in force.