PRIVACY POLICY

Giulio Design Studio

Last updated: 24 September 2026

  1. Who we are

The data controller for personal data collected through www.giuliodesignstudio.com is:

Giulio Camposano — Giulio Design Studio Address: Via Renco 50, 28923 Verbania (VB), Italy VAT number: IT02722550031 Email: giulio@giuliodesignstudio.com

We are established in Italy. This notice is issued under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended. No Data Protection Officer has been appointed, as the conditions under Article 37 GDPR do not apply.

  1. What we collect and why 2.1 Online shop purchases

Data collected: first and last name, email address, shipping address, billing address, phone number, order details, payment data (handled by our payment provider, see §4), and VAT number / electronic invoicing code for business customers.

Purpose: to fulfil the sales contract, ship your order, issue and retain tax documents, and handle returns, warranties and order-related communication.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for order handling and shipping; legal obligation (Art. 6(1)(c) GDPR) for invoicing and accounting records.

Retention: order records and tax documents are retained for 10 years from the date of issue, as required by Italian law. Phone numbers, collected for delivery purposes, are retained for 24 months after delivery.

2.2 Newsletter

Data collected: email address, and optionally your name.

Purpose: to send you updates on new collections, piece availability, shop openings and events.

Legal basis: your consent (Art. 6(1)(a) GDPR), given freely, specifically and on an informed basis through the sign-up form.

Retention: until you withdraw consent. Every email contains an unsubscribe link; after unsubscribing, your address is kept on a suppression list only to ensure we do not contact you again.

2.3 Contact form

Data collected: name, email address, message content, and any data you choose to include.

Purpose: to respond to your enquiry.

Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

Retention: 24 months from the last exchange, unless the communication gives rise to a contractual relationship.

2.4 Customer account

Data collected: email, password (encrypted), order history, saved addresses.

Purpose: to enable account management and order lookup.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Retention: until you delete your account, or after 24 months of inactivity.

2.5 Browsing data

The site automatically collects IP address, browser and device type, operating system, pages visited and access times, to ensure the site functions and remains secure.

Legal basis: legitimate interest in the security and proper functioning of the site (Art. 6(1)(f) GDPR).

  1. Cookies

The site uses technical cookies and, subject to your consent, analytics cookies. For details of the types, purposes, durations and how to manage consent, please see our Cookie Policy.

Consent to non-technical cookies is collected through the banner on the site and can be changed or withdrawn at any time via the cookie settings.

  1. Who we share data with

Your data is shared only with providers of services necessary to operate the studio, appointed as data processors under Art. 28 GDPR where required.

Website and e-commerce platform Squarespace Ireland Ltd. (Ireland) — website hosting, shop management, member area and email marketing tools. The platform relies on Squarespace, Inc. (USA); such transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Payments

Stripe Payments Europe Ltd. (Ireland) PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)

Full payment card data is not transmitted to or stored by the controller: it is handled directly by the payment provider as an independent controller. Methods such as Apple Pay / Google Pay are processed through the above gateways.

Shipping and logistics

Sendcloud B.V. (Netherlands) — shipping management platform Poste Italiane S.p.A. and SDA Express Courier S.p.A. (Italy), FedEx, BRT S.p.A. (Italy), United Parcel Service (UPS) and other carriers depending on destination

We share with them only the data needed for delivery (name, address, phone, email) and, for non-EU shipments, the data required for the customs declaration.

Invoicing and tax compliance TeamSystem S.p.A. — Fatture in Cloud platform, for issuing and retaining invoices. Invoicing data is also transmitted to the Italian Revenue Agency via the Exchange System (SdI), as a legal obligation.

Accounting and tax advice Our appointed accountant, acting as a data processor.

Email communications Google Ireland Ltd. — email service used for correspondence.

Analytics

Squarespace Analytics — the platform's native statistics

Your data is never sold, rented or shared with third parties for their own marketing purposes.

  1. Transfers outside the European Union

Some providers listed in §4 use servers outside the European Economic Area. In those cases the transfer is based on: a European Commission adequacy decision (Art. 45 GDPR) where available; certification under the EU-U.S. Data Privacy Framework (e.g. Squarespace, Google); or the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

In addition, when you place an order to a non-EU country, the data required for the customs declaration (name, address, description and value of the goods) is transmitted to the customs authorities of the destination country as a legal obligation of the importing country.

  1. Your rights

Under Arts. 15-22 GDPR you have the right to: access your data and obtain a copy; have inaccurate data corrected or incomplete data completed; have your data erased ("right to be forgotten"), within the limits of tax retention obligations; restrict processing; receive your data in a structured format and transmit it to another controller (portability); object to processing based on legitimate interest; and withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, email giulio@giuliodesignstudio.com. We will respond within one month of receipt, extendable by two months in particularly complex cases.

Note on erasure: data contained in invoices and accounting documents cannot be erased before the statutory 10-year retention period expires, even if consent is withdrawn or the account is deleted.

  1. Complaint to a supervisory authority

If you believe the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it). If you are in another EU member state — or in the UK — you may contact your local supervisory authority (in the UK, the Information Commissioner's Office, www.ico.org.uk).

  1. Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including HTTPS encryption of communications, access to platforms via personal credentials and two-factor authentication, and restricting access to authorised persons only.

  1. Minors

The site is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

  1. Changes

This notice may be updated. The current version is always published at this address, with the date of the latest update.

Giulio Design Studio — Giulio Camposano — VAT IT02722550031