Privacy Policy
Last updated: 28 October 2026
This notice explains which personal data we process when you visit gstdigitalstudio.com or contact us, why we do it, how long we keep it and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Personal Data Protection Code).
1. Data controller
The data controller is La Tonda di Gastaldi Federico, an Italian sole proprietorship trading as GST Digital Studio, with registered address at Via Antonio Pacinotti 34, 15121 Alessandria (AL), Italy, VAT number IT02602600062.
For any question about your data or to exercise your rights, write to hello@gstdigitalstudio.com.
We have not appointed a Data Protection Officer (DPO), as our activities do not fall within the cases where one is required.
2. What data we process
a) Data you give us through the contact form. Name, email address, the service you are interested in, your business website (if provided), your advertising budget range (if provided), the content of your message and the language of the page you write from. Please do not include unnecessary data in your message, in particular special categories of data (for example health data).
b) Data you send us by email. Your email address and the data contained in your message and any attachments.
c) Technical browsing data. When you visit the website, the systems that serve it automatically receive some technical data: IP address, date and time of the request, page requested, browser type and operating system, referring website. This data is needed to show you the pages, protect them from attacks and diagnose problems.
d) Data used to protect the form from spam. When the contact form loads, the Cloudflare Turnstile service analyses some technical signals from your browser and device (for example IP address, browser characteristics, how you interact with the page) to tell people apart from automated programs. It does not build visitor profiles.
e) Aggregate visit statistics. We use Cloudflare Web Analytics to know how many visits the website receives, which pages are viewed, which websites and countries visitors come from and which devices they use. The service does not use cookies or other identifiers stored on your device and only shows us aggregate data: we cannot identify you.
3. Why we process data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your request, preparing a proposal and handling the contacts that precede a possible contract | a, b | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Managing the contractual relationship, if you become a client | a, b | Performance of a contract (Art. 6(1)(b) GDPR) |
| Complying with legal obligations, for example tax and accounting | a, b | Legal obligation (Art. 6(1)(c) GDPR) |
| Making the website available, keeping it secure and protecting the form from spam | c, d | Legitimate interest in offering a working and secure website (Art. 6(1)(f) GDPR) |
| Understanding how the website is used in order to improve it | e | Legitimate interest in knowing how the website is used, in aggregate form (Art. 6(1)(f) GDPR) |
| Establishing, exercising or defending legal claims | a, b, c | Legitimate interest (Art. 6(1)(f) GDPR) |
Where processing is based on legitimate interest, we have assessed that it does not override your rights and freedoms, because it concerns technical or aggregate data that is strictly necessary and processed in a limited way. You can object at any time (see section 9).
We do not use your data to send you newsletters or promotional communications without your consent, and we do not take decisions based solely on automated processing, including profiling.
4. Whether you must provide your data
The fields marked as required in the form are necessary for us to reply: without them we cannot handle your request. The other fields are optional. Technical browsing data and the data used for spam protection are necessary to use the website and the form.
5. How we process data
Data is processed electronically by Federico Gastaldi as controller, with technical and organisational measures appropriate to protect it from unauthorised access, loss or disclosure: encrypted connections (HTTPS), access to services protected by personal credentials, access keys stored separately from the website code. The contact form does not save requests in a website database: it forwards them by email to our business address.
6. Who we share data with
Data is not sold or disclosed to the public. To run the website and our email we use the following providers, which process data on our behalf as processors (Art. 28 GDPR) or, for some processing related to the security of their own services, as independent controllers:
- Cloudflare, Inc. (United States): website hosting, running the contact form, spam protection (Turnstile) and aggregate statistics (Web Analytics). Cloudflare privacy policy
- Brevo (Sendinblue SAS, France): delivering to our address the emails generated by the contact form. Brevo privacy policy
- Aruba S.p.A. (Italy): email service on which we receive and store emails.
- Adobe Inc. (United States): supplying the website typefaces (Adobe Fonts). To send you the fonts Adobe receives your device’s IP address; according to Adobe, it does not store it and does not use cookies for this service. Adobe Fonts privacy policy
Data may also be shared with professionals who assist us (for example our accountant, for tax obligations) and with authorities, where required by law.
7. Transfers outside the European Union
Some providers (Cloudflare and Adobe) are based in the United States and may process data outside the European Economic Area. In these cases transfers are based on the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for providers that have joined it, and in any case on the standard contractual clauses approved by the European Commission (Art. 46 GDPR). You can ask us for more information at the address in section 1.
8. How long we keep data
- Form requests and emails, if you do not become a client: up to 24 months from the last contact, so we can follow up on the conversation; then they are deleted.
- Client data: for the duration of the relationship and then for 10 years, to comply with the obligation to keep accounting records and tax documents (Art. 2220 of the Italian Civil Code).
- Technical browsing and security data: for the time strictly necessary, according to the policies of the providers listed in section 6.
- Statistics: in aggregate form only, without data that identifies you.
We may keep data for longer only where necessary to establish, exercise or defend legal claims.
9. Your rights
At any time you can ask us for:
- access to your data and a copy of it (Art. 15 GDPR);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you gave us, in a structured, machine-readable format (Art. 20).
You also have the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21).
To exercise your rights write to hello@gstdigitalstudio.com. We will reply without undue delay and in any case within one month of your request. We may ask you for information to verify your identity.
If you believe the processing of your data infringes the GDPR, you can lodge a complaint with the supervisory authority of the Member State where you live, work or where the alleged infringement took place. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
10. Cookies
The website only uses technical tools needed for it to work and does not use profiling cookies. Details are in the Cookie Policy.
11. Changes to this notice
We may update this notice, for example if the services we use or the law change. The version in force is always published on this page, with the date of the last update. This notice is also available in Italian and Spanish; in case of differences, the Italian version prevails.