Privacy policy

Data controller

The data controller is Lovy Studio. Contact email: hello@lovystudio.com. VAT number: IT18576191003. Certified email (PEC): lovystudio@pec.it. Legal address, not open to the public: Via Angelo Messedaglia 56, 00191 Roma RM, Italia.

Data processed

The contact form collects name, email address, optional company, project description and confirmation that the privacy policy has been read. The message is sent through the website API and a transactional email service.

The hosting service and technical infrastructure may process technical logs, IP address, user agent, request date and time for security, diagnostics and website operation.

When configured, the contact form uses Cloudflare Turnstile to distinguish human requests from automated traffic and reduce spam and service abuse.

If the user gives analytics consent, the website may process browsing data and technical interactions such as visited pages, CTA events, outbound links, language, device and aggregated performance information. The contact form does not send message contents to analytics tools.

Purposes and legal bases

• Replying to contact requests and assessing a project: pre-contractual measures.
• Managing requested follow-up communications: pre-contractual measures or contract.
• Maintaining website security, integrity and operation: legitimate technical interest.
• Complying with applicable legal obligations: legal obligation.

Retention

Email requests are retained for the time needed to reply and manage the relationship, and afterwards according to any tax, contractual or defensive obligations. Technical logs are retained according to the hosting provider's retention periods.

Recipients

Data may be processed by technical providers needed for website operation, hosting, email, transactional email sending, form anti-abuse protection and security. In this version the form uses Resend to send email messages and may use Cloudflare Turnstile for anti-spam verification; requests are delivered to the controller's operational mailbox. Data is not sold to third parties.

When activated through consent, analytics data may be processed by Google Analytics 4, Google Tag Manager, Microsoft Clarity and Matomo Cloud according to their respective configurations and policies.

Transfers outside the EU

Some technical providers may process data outside the European Economic Area. Where applicable, processing must rely on appropriate safeguards under the GDPR, such as adequacy decisions, the Data Privacy Framework or standard contractual clauses.

User rights

Users may request access, rectification, erasure, restriction, objection and portability where provided by the GDPR by using the email shown in the Data controller section. Users may also lodge a complaint with the competent supervisory authority.