Privacy and cookie policy

1. Controller and contact details

The controller is Matteo Romano, operating as MATTTRE Studio, based in Carnago (Varese), Italy. For privacy enquiries and to exercise your rights, contact matttrecreativestudio@protonmail.com.

2. Browsing, hosting and security

To deliver pages and protect against abuse, Vercel hosting receives technical request data: IP address, requested resource, timestamp, browser information, responses and errors. The legal basis is our legitimate interest in operating a reliable and secure website (Article 6(1)(f) GDPR).

Technical logs follow the hosting infrastructure and plan’s availability and deletion periods, limited to operational, security and any legal requirements. We do not use them for personalised advertising. Provider information: Vercel Privacy Notice.

3. Contact form, email and project enquiries

When you write to us, we process your name, email address, optional service selection and message. If you contact us by phone, we process the contact details and information you provide. We use these to respond and handle your enquiry: Article 6(1)(b) GDPR for requested pre-contractual steps; Article 6(1)(f) for other correspondence and its orderly management. Applicable legal obligations rely on Article 6(1)(c).

Providing information is voluntary, but name, email and message are required to use the form and receive a reply. Selecting a service is optional. Do not include health data, identity documents, passwords or unnecessary personal information about others. The form does not subscribe you to newsletters or commercial campaigns.

The website server forwards the message through Resend to the studio’s Proton Mail inbox. It is not sent to Umami. Your draft remains in page memory while you type or after an error; we do not save it in localStorage. Submission rate protection temporarily uses an IP hash in server memory with a ten-minute window; expired counters are cleared on the next request or when the instance ends.

Enquiries that do not become an engagement are removed from operational correspondence within twelve months of the last contact. If a professional relationship begins, necessary records follow applicable contractual, accounting and statutory periods. A dispute may require keeping relevant evidence for as long as needed to protect legal rights. Providers’ technical copies follow their deletion and backup cycles.

4. Optional Umami statistics

We load Umami Cloud, provided by Umami Software, Inc., only if you allow statistics. We use the free plan with the account’s EU data region; the plan retains analytics for six months. The purpose is to understand page visits and improve the website. The legal basis chosen for this integration is consent (Article 6(1)(a) GDPR). Refusing does not restrict browsing or contact options.

Our configuration sends only public pageviews, including a path without query parameters or fragments, title, referring origin without its path, language and screen size. The service also derives browser, system and device information and an approximate location from the IP address. Umami’s documentation states that the IP is not stored in the analytics dataset; it may be processed for geolocation and hashed session identifiers. These are not personal accounts and are not linked to form messages.

The tracker uses no analytics cookies. We do not enable personal identifiers, form data, custom events, session recordings, heatmaps or behavioural advertising. Pages outside the website’s public page inventory are excluded. We honour Do Not Track and Global Privacy Control by blocking the tracker.

You can allow, refuse or withdraw your choice using “Privacy preferences” in the footer. Withdrawal blocks subsequent collection and does not affect the lawfulness of earlier processing. The choice applies to this browser and is requested again after six months; clearing browser data requires a new choice.

Service details: metrics, plan retention, Umami privacy notice.

5. Cookies and browser storage

Our website code sets no advertising cookies. It uses the technical storage below to remember preferences and operate the interface; these values are not sent to Umami. You can remove them through browser settings, which also removes saved choices. Any hosting mechanisms used for security or delivery serve the purpose described in section 2.

6. Recipients and providers

Data is accessible to the controller and, where necessary, authorised people and providers delivering the relevant functions. We do not sell or publish it. It may be disclosed to advisers or authorities where required by law or to protect legal rights.

• Vercel: hosting, delivery and security; data processing addendum.
• Resend: delivery of form enquiries. The provider states thirty-day email and log retention on standard plans; security and retention, DPA.
• Proton AG / Proton Mail: receipt and management of correspondence; provider privacy notice.
• Umami Software, Inc.: consent-based analytics, EU region and six-month retention on the free plan; subprocessors.

You can request an up-to-date list of processors and information about the relevant agreements from the controller.

7. Processing outside the EEA

Umami’s EU selection concerns the analytics data region; it does not mean that all providers operate exclusively within the European Economic Area. Vercel, Resend, Umami and their subprocessors may involve organisations or infrastructure in other countries; Proton is based in Switzerland. Transfers subject to GDPR use the applicable Chapter V mechanism, including adequacy decisions or contractual safeguards such as the standard contractual clauses described in providers’ agreements. Contact the controller for information about the applicable safeguards and how to obtain a copy.

8. Your rights

Where the conditions in Articles 15–22 GDPR apply, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. You may withdraw analytics consent at any time. We do not make decisions with legal or similarly significant effects based solely on automated processing.

Write to matttrecreativestudio@protonmail.com. We normally respond within one month and inform you of any justified extension within the required period. We may request only what is needed to verify identity. Analytics data without an identity link may not be attributable to a particular person; we do not collect additional data solely to identify it.

You may complain to the Italian Data Protection Authority or the competent authority where you live, work or an alleged infringement occurred.

9. Links and updates

The portfolio may link to client websites and external services, whose own privacy notices apply when you visit them. We update this page when services, purposes or processing conditions change and request a fresh statistics choice where needed. The date above identifies the current version.