Privacy Policy

Privacy notice under EU Regulation 2016/679 (GDPR)

1. Data controller

Teresita Piacentini — Atelier modArch
Via S. Nicola 7, 25082 Botticino (BS), Italy
VAT no. 03869230981 · REA BS-569998
Email: info@ateliermodarch.com
Phone: +39 329 763 3425

2. Categories of data collected

This website publishes the studio's contact details and provides a contact form on the Contact page. The categories of data processed are the following:

  • Contact form data: full name, email, company or brand (optional), description of the garment, type of work requested and how you found us. These are the details the user voluntarily types in order to receive a reply; they are kept for 24 months in the absence of a contractual relationship.
  • Optional project details: number of styles, stage of the work, fabric, place of production, file format required, date of the samples, base measurements, type of prototype. These fields are optional: they only help prepare a more precise reply, and leaving them empty does not prevent you from being contacted.
  • Attachments: sketches, technical specifications and measurement charts that the user chooses to upload from the contact form or from the assistant (up to 5 files of 10 MB; JPG, PNG, WEBP, HEIC, PDF). They are used to assess the feasibility of the work and to prepare a quotation. Uploading is optional.
  • Conversations with the site assistant: the text exchanged with the assistant is stored for 90 days, together with page, language and country, so that requests received through the chat are not lost and answers can be improved. The IP address is not stored: only a non-reversible derived code.
  • Contact data: the data you voluntarily choose to provide when you contact us by email, phone or WhatsApp — typically name, contact details, company/brand and the description of the project. The website only displays the studio's contact details: it is you who decide whether, how and what to communicate.
  • Technical navigation data: IP address, user agent, pages visited, timestamp, country of origin — handled by the Cloudflare CDN and necessary for the operation and security of the website (security logging and abuse mitigation).
  • Analytics data: aggregate, anonymous traffic statistics collected with a first-party system (davix-hits, on Cloudflare Workers). We record the page visited, the referring site, the type of contact clicked (email, phone, WhatsApp) and scroll depth. Google Analytics is not installed, no cookies are used, and no profiling or identification of individual visitors takes place.

3. Purposes and legal basis of processing

  • Responding to contact requests and managing pre-contractual relations — legal basis: performance of pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR).
  • Assessment of the project through optional fields and attachments — legal basis: steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR). Providing them is optional; without them the reply will be less precise.
  • Sending the conversation to the controller at the user's request — legal basis: steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR). Sending never happens automatically: it starts only if the user asks for it and leaves a name and email.
  • Retention of conversations with the assistant for 90 days — legal basis: the controller's legitimate interest in not losing requests received in chat and in checking that the service works (Art. 6(1)(f) GDPR). The user may object by writing to the controller.
  • Performance of any contractual relationship and fulfilment of the resulting tax and accounting obligations — legal basis: performance of a contract to which the data subject is a party (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
  • Technical security of the website and prevention of abuse — legal basis: legitimate interest of the controller (Art. 6(1)(f)).
  • Protection of the confidentiality of third-party projects — legal basis: contractual obligation (NDAs with clients) and legitimate interest in protecting professional secrecy.

4. Retention periods

  • Conversations with the site assistant: 90 days, then automatic deletion.
  • Contact data with no contractual follow-up: retained for 24 months from the last communication, unless earlier deletion is requested.
  • Data linked to a contract: retained for 10 years from the end of the relationship, in accordance with Italian tax and civil law (Art. 2220 of the Civil Code and Presidential Decree 633/72).
  • Cloudflare technical logs: retained in accordance with Cloudflare's policies (max. 30 days for standard logs).
  • Attachments uploaded from the site: 12 months from upload, then automatic deletion. Files needed for work that has actually started are kept by the controller under the contractual terms and the relevant NDA.
  • Links for downloading the attachments: the links sent to the controller are signed and expire after 30 days.

5. Recipients (processors and sub-processors)

Data may be disclosed to the following parties, acting as data processors under Art. 28 GDPR:

  • Cloudflare, Inc. (San Francisco, USA · EU-US Data Privacy Framework) — Cloudflare Pages hosting, CDN, security and technical logs; Cloudflare D1 database holding the requests sent from the form and from the assistant; Cloudflare R2 storage with European Union jurisdiction holding the attachments. The storage is private: files have no public address and can be downloaded only through a signed, expiring link. privacy policy.
  • Google LLC (Google Maps embed on the contact page) — loading the map sends your IP address to Google. privacy policy. The map is loaded only on the /contatti/ page.
  • Meta Platforms Ireland Ltd. — if you choose to contact us through the WhatsApp link on the website, the conversation and related data are processed by WhatsApp/Meta under their terms. privacy policy.
  • Aruba S.p.A. — management of the controller's domain name and certified email (PEC).
  • Davix Studio (Davide Bettinetti, Brescia) — technical manager of the site and its infrastructure, appointed as data processor under Art. 28 GDPR. It runs the anonymous davix-hits statistics and, solely for technical support, holds the administration credentials with which it is technically possible to access requests and attachments. It is bound by confidentiality and does not use these data for its own purposes.
  • Cloudflare Workers AI — when Groq (below) is not available, the site assistant generates its replies with an artificial intelligence system (a language model) hosted by Cloudflare. The text written in the chat is sent to that system to produce the reply. Replies are generated automatically and may contain errors: what the controller states prevails. If the user asks to forward the exchange to Teresita, she receives the text of the conversation as it took place, with no summary or rewording produced by the system; for a very long exchange, the final part is sent. Do not enter confidential information or other people's personal data in the chat: for projects under NDA use email or phone. The conversation log is kept for 90 days; a conversation that the user asks to send to the controller becomes part of the request and is kept like the contact-form data.
  • Groq LLC (Mountain View, USA) — since 1 October 2026 the site assistant generates its replies with language models hosted by Groq; the Cloudflare system listed above remains as a backup when Groq is not available. The text written in the chat is sent to Groq only to produce the reply. Voice messages to the assistant are also transcribed into text by Groq: the audio is sent only for transcription. For the transfer outside the European Union, the safeguards described by Groq in its privacy policy apply.
  • Calendly LLC — if you book a call from the site, your name, email and time zone are processed by Calendly. privacy policy.
  • Resend, Inc. (San Francisco, USA) — delivers to the controller the notification email with name, email, company, request, message, the text of any conversation with the assistant and the signed links to the attachments. The files do not travel as email attachments. privacy policy.
  • Telegram FZ-LLC — the site's technical manager (Davix Studio) receives via Telegram an alert of a new request with its sequence number, type of work, page and country, without name, email or message. The same applies to conversations with the assistant: the alert shows only page, country and language, never the text. privacy policy.

Data is not disclosed to third parties for marketing purposes nor sold to third parties. The details of client projects are never shared with any other party, in line with NDA obligations.

6. Transfers outside the EU

Some providers (Cloudflare, Google, Resend) are based or have infrastructure in the United States. Transfers take place on the basis of adequate safeguards under Chapter V GDPR: the European Commission's standard contractual clauses (SCC) and/or adherence to the EU-US Data Privacy Framework. Groq LLC is also based in the United States: for its transfers, the safeguards described in its privacy policy, linked in the previous section, apply.

7. Data subject rights

Under Articles 15–22 GDPR, the data subject has the right to:

  • access their personal data (right of access);
  • request its rectification or completion (rectification);
  • request its erasure (right to be forgotten), subject to legal retention obligations;
  • request restriction of processing;
  • receive the data in a structured format (portability);
  • object to processing based on legitimate interest;
  • where processing is based on consent, withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, write to info@ateliermodarch.com with "GDPR" in the subject line. We respond within 30 days.

The data subject also has the right to lodge a complaint with the competent supervisory authority: the Italian Garante per la protezione dei dati personali — Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.

8. Cookies and tracking technologies

The website uses only the following cookies / technologies:

  • Cloudflare technical cookies (__cf_bm, cf_clearance) — purpose: security, bot mitigation, delivery optimisation. Strictly necessary, no consent required (Art. 122(1) Legislative Decree 196/2003).
  • No analytics or profiling cookies. No Google Analytics is installed, and no social tracking pixels are installed. The anonymous statistics rely on sessionStorage, which is cleared when the browser is closed.

The statistics described above are anonymous, aggregate and require no consent. The notice shown on arrival only signals the use of technical cookies; on dismissal it stores a cck entry in localStorage so it does not reappear. Google Maps is not loaded automatically: it starts only if you ask for it. Should the controller activate profiling or third-party cookies in the future, prior consent compliant with the Garante's Cookie Guidelines (10 June 2021) will be requested.

9. Confidentiality of client projects (NDA)

Atelier modArch works under a contractual NDA for every client. Project files (patterns, technical sheets, garment images) are never published on this site and are not disclosed to any party other than the client. Attachments sent through the form or the assistant are kept in private storage with European Union jurisdiction, with no public address, downloadable only by whoever holds the signed, expiring link, which is sent to the controller alone, and by the technical manager appointed as data processor. Even after the contractual relationship ends, the duty of confidentiality continues under the terms of each NDA.

10. Changes to this notice

This privacy notice may be updated to reflect regulatory or organisational changes. The date of the latest update is shown at the bottom. We recommend checking this page periodically.

Last updated: 1 October 2026