Skip to content
Giallo
IT

Legal

Privacy policy

Last updated: 17 September 2026

This notice explains how we process the personal data of users who visit giallostudio.it and interact with its forms, pursuant to EU Regulation 2016/679 (GDPR).

Data controller

The data controller is Refreesh Srl Benefit, VAT number 13516410969, based in Via Lazzaro Spallanzani 10, 20129 Milano (MI), which operates under the brand Giallo (giallostudio.it). For questions about the processing of your data, contact ciao@giallostudio.it.

Data we collect

  • Contact form data: name, email address, company and message content, provided voluntarily so that we can contact you.
  • Newsletter: email address and confirmation date, if you subscribe. Your subscription becomes valid only after you click the link we send by email.
  • Statistics (with consent only): pages visited, device, referral source and a browser identifier, collected through Google Analytics 4.
  • Marketing data (with consent only): Meta cookie identifiers (_fbp, _fbc) and Google Ads cookie identifiers (_gcl_au, _gcl_aw), your email address hashed using SHA-256, IP address, user agent and interaction events (such as form submissions), processed through Meta Pixel, Conversions API and the Google Ads tag to measure advertising campaigns on Facebook, Instagram and the Google Search network.

Purpose and legal basis

  • Responding to requests submitted through the form — legal basis: pre-contractual measures and legitimate interest (Articles 6.1.b and 6.1.f GDPR).
  • Sending the newsletter — legal basis: consent (Article 6.1.a GDPR), which you may withdraw at any time.
  • Protecting forms against automated submissions and abuse through submission limits — legal basis: the controller's legitimate interest in protecting the website, its inbox and third-party email addresses (Article 6.1.f GDPR, recital 49). IP addresses and email addresses entered in forms are used only in pseudonymised form, as codes calculated using a secret key, never in plain text.
  • Website usage statistics — legal basis: consent (Article 6.1.a GDPR).
  • Measuring advertising campaigns through Meta Pixel, Conversions API and Google Ads — legal basis: consent (Article 6.1.a GDPR), which you may withdraw at any time through the cookie banner.

Data retention

Contact details are retained for as long as necessary to handle your request and any resulting relationship. Newsletter data is retained until you unsubscribe. Pseudonymised codes used for form submission limits are automatically deleted within 3 days; fingerprints of newsletter confirmation links are deleted within 10 days. Google Analytics data remains in the property for the retention period configured in Google Analytics.

Sharing data with third parties and data processors

To provide the service, we use suppliers that act as data processors under Article 28 GDPR, each with its own data processing agreement (DPA):

  • Resend (Resend, Inc., USA) — sending transactional emails generated by the website's forms.
  • Netlify (Netlify, Inc., USA) — website hosting and delivery, and storage of pseudonymised codes for form submission limits (Netlify Blobs).
  • Google Analytics 4 (Google Ireland Limited, Ireland) — measuring website traffic, activated only with your analytics consent. It installs cookies containing a browser identifier (_ga, retained for 2 years): the data collected is personal data, rather than anonymous statistics. We have enabled IP anonymisation; advertising functions remain disabled unless you also give marketing consent. Google may transfer data to the United States (Standard Contractual Clauses / Data Privacy Framework).
  • Google Ads (Google Ireland Limited, Ireland) — measuring Search campaign conversions, activated only with your marketing consent. It installs the cookies _gcl_au and _gcl_aw (90 days). With enhanced conversions, your email address is converted to a SHA-256 hash in your browser when you submit the form and is transmitted only in that form. Google may transfer data to the United States (Standard Contractual Clauses / Data Privacy Framework).
  • Meta (Meta Platforms Ireland Ltd, Ireland) — Meta Pixel and Conversions API for measuring advertising campaigns, activated only with your marketing consent. Meta may act as a joint controller for its own purposes and transfer data to the United States (Standard Contractual Clauses / Data Privacy Framework).

Suppliers based in the United States process data using the safeguards provided by the GDPR (Standard Contractual Clauses and/or participation in the EU-US Data Privacy Framework). Data is neither sold nor shared with third parties for advertising purposes.

Your rights

You may exercise your rights under Articles 15-22 GDPR at any time: access, rectification, erasure, restriction, portability and objection, as well as withdrawal of consent. To do so, contact ciao@giallostudio.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).