Privacy notice

01Who we are and how to reach us

The data controllers are Gabriele Menegatti, Leonardo di Luigi and Riccardo di Pierro, who work together as the «synnyn» collective («we» below). We decide together how and why data is processed, and any of us can handle your requests.

For any question about your data or to exercise your rights: synnyn.studio@gmail.com · +39 351 978 2481.

02What data we process

We only process the data we need to reply to you and to run the site securely:

• Quote form data: full name, email, phone number, business name and current website (optional), project type, rough budget, timeline and project description, plus the language you are using the site in.
• Data you give us directly: if you email or call us, the data contained in your message or shared during the call.
• Technical browsing data: IP address, user agent (browser and device type), requested pages, date and time, automatically recorded in the hosting provider's logs. When you submit the form, your IP address is also used to limit the number of submissions and stop spam: the counter lives only in the server's temporary memory, not in a database.

We do not ask for special categories of data (for example about health or political or religious opinions) or data about criminal convictions: please do not include them in your project description.

03Why we process it and on what legal basis

• Replying to your request and preparing a quote: the legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Protecting the site and preventing abuse and spam (technical logs, per-IP submission limit, anti-bot checks on the form): the legal basis is our legitimate interest in keeping the site and our contact channels secure (Art. 6(1)(f) GDPR). We use only the data strictly needed and keep it for a short time, so that this interest does not override your rights.
• Complying with legal obligations or requests from public authorities: the legal basis is a legal obligation (Art. 6(1)(c) GDPR).

We do not use your data for profiling, marketing or newsletters, and we do not take decisions based solely on automated processing.

04Do you have to give us your data?

No: filling in the form is entirely up to you. Your name, email and phone number are needed, though, because without them we cannot contact you or prepare a quote; fields marked as optional can be left empty.

The «I have read the privacy notice» box only confirms that you have seen this notice: it is not a request for consent, because the processing is based on your request for a quote.

05Who we share data with

On our side, only the three controllers access your data. To run the site and receive requests we rely on these providers:

• Vercel Inc. (United States): website hosting and technical logs. It acts as a processor (Art. 28 GDPR) under its data processing terms (Data Processing Addendum).
• Resend (Plus Five Five, Inc., United States): sending the email containing your request to our inbox. It acts as a processor (Art. 28 GDPR) under its data processing terms.
• Google (Google Ireland Limited and Google LLC): the inbox where we receive and keep requests is a Gmail account. Google does not process this data as our processor: it also processes it under its own terms of service and privacy policy, as an independent provider of the email service.

We do not sell, hand over or publish your data. We would disclose it to authorities only where the law requires it.

06Transfers outside the European Union

The providers listed above may process data in the United States. Transfers rely on the EU-US Data Privacy Framework adequacy decision, for providers certified under it, and/or on the Standard Contractual Clauses approved by the European Commission and adopted by the providers (Arts. 45 and 46 GDPR).

07How long we keep it

• Requests sent through the form and messages you send us: for as long as needed to handle them and in any case no longer than 24 months from our last contact, after which we delete them. If a request leads to a contract, we keep the necessary data for the periods required by law (for example tax rules).
• Technical logs: for the periods set by the hosting provider, usually from a few days to a few weeks.
• Copies and logs of sent emails at Resend: for the limited period set by Resend's service plan, after which Resend deletes them.
• Per-IP anti-spam counter: it counts submissions from the last 10 minutes and lives only in the server's temporary memory, which is cleared on every restart.

08Cookies and similar technologies

We use a single technical, first-party cookie: synnyn-lang, which remembers the language you chose (Italian or English) for 12 months.

Some pages also use your browser's storage (sessionStorage and localStorage) for technical purposes: for example, the portfolio demos save their state there, such as a cart or a test order. This data stays in your browser only, is never sent to us, and you can delete it at any time from your browser settings.

We do not use profiling, analytics or third-party cookies. That is why there is no cookie banner: technical cookies do not require consent (Art. 122 of the Italian Privacy Code and the Italian Data Protection Authority's cookie guidelines of 10 June 2021); this notice is enough.

09The portfolio projects

The pages under /portfolio/ are demos of websites we have built. The forms inside them (bookings, orders, sign-ups, contact) do not send data to us or anyone else: the demos save everything in your browser only.

The one exception is the consultancy company website marked as “Live” in the portfolio: it is not a demo but a real website of one of our clients, published on its own domain and reached through an external link. The forms on that website really send data to the company that runs it, which is the data controller under its own privacy policy, published on its website. We do not receive or process that data. Only use those forms if you are genuinely interested in that company's services.

Some demos embed third-party content, such as Google Maps, Google Fonts, libraries from public CDNs, images hosted by external services and OpenStreetMap address search (Nominatim and Photon). When this content is loaded or used, your browser connects directly to those services, which may receive your IP address and process it under their own privacy policies.

10Your rights

At any time you have the right to:

• access your data and get a copy of it (Art. 15 GDPR);
• have inaccurate or incomplete data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict the processing (Art. 18);
• receive the data you gave us in a structured, machine-readable format (portability, Art. 20);
• object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21).

We do not process data on the basis of consent, so there is no consent to withdraw: if you no longer want to be contacted, just tell us and we will delete your request. We do not take automated decisions about you (Art. 22).

To exercise your rights, write to synnyn.studio@gmail.com: we reply without undue delay and within one month at the latest. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

11Security

The site is only reachable over an encrypted connection (HTTPS) and uses strict security headers; the form has spam and abuse protections. Only the three of us access the requests we receive.

12Children

The site and our services are not aimed at children under 14: if you are not yet 14, please do not send us personal data.

13Changes to this notice

We may update this notice, for example if our providers or the site's features change. The date of the latest update is shown at the top of the page.