1. Categories of data collected
NNZN Studios collects and processes only the personal data necessary for the purposes described below.
- Contact form: name, email address, project type, message content.
- NNZNot A Magazine newsletter: email address.
- Private client area: login credentials (email + encrypted password), any project documents.
- Technical data: IP address, browser type, device, pages visited (collected by Google Analytics only with analytics consent).
- Anti-bot protection (reCAPTCHA): to prevent automated form submissions, Google reCAPTCHA collects technical information about the device and interaction with the site.
- Local technical storage: theme, language and cookie choices, saved on your device and not transmitted to our servers.
2. Purposes and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Replying to contact / quote requests | Pre-contractual measures · Art. 6.1.b |
| Sending the NNZNot A Magazine newsletter | Explicit consent · Art. 6.1.a |
| Managing the private client area | Contract performance · Art. 6.1.b |
| Audience measurement (analytics) | Consent · Art. 6.1.a |
| Site security and anti-spam | Legitimate interest · Art. 6.1.f |
| Tax and administrative obligations | Legal obligation · Art. 6.1.c |
3. Retention period
- Contact requests: 24 months from first contact (unless a contractual relationship begins).
- Newsletter subscriptions: until the user explicitly unsubscribes.
- Client area: for the duration of the relationship + 10 years for tax obligations.
- Technical storage: session or up to 12 months.
- Analytics cookies: per the providers' specific terms (see section 5).
4. Data recipients
Personal data is processed only by authorised NNZN Studios staff and by the technical service providers listed below. Data is never transferred, sold or disclosed to third parties for commercial purposes.
5. Third-party services
NNZN Studios uses some external services to run the site. Each provider acts as a data processor under Art. 28 GDPR.
| Service | Purpose · Location |
|---|---|
| Hostinger | Website hosting · EU (European data center) |
| Formspree | Email delivery from contact and newsletter forms · USA with SCC |
| Supabase | Private client-area backend: authentication and document storage · EU/USA with SCC |
| Google Analytics | Aggregated traffic statistics (only with consent) · USA with SCC |
| Google reCAPTCHA | Form anti-spam protection · USA with SCC |
| Google Fonts | Web font delivery · USA with SCC |
| YouTube / Google | Video content playback · USA with SCC |
| Sanity | CMS for site content (does not process users' personal data) · EU/USA |
The complete, up-to-date list of providers is available on request at admin@nnznstudios.com.
6. Non-EU transfers
Some providers (Formspree, Google Analytics, Google reCAPTCHA, Google Fonts, YouTube, Supabase) are based or have infrastructure in the United States. Data transfers occur solely on the basis of Standard Contractual Clauses (SCC) approved by the European Commission, with supplementary measures ensuring a level of protection equivalent to that of the EU.
7. Data subject's rights
Under Articles 15-22 of the GDPR, you have the right to:
- Access your personal data.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict processing.
- Receive your data in a structured format (portability).
- Object to processing for marketing purposes.
- Withdraw consent at any time.
- Lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
To exercise your rights, write to admin@nnznstudios.com. NNZN Studios will reply within 30 days.
8. Security measures
We adopt technical and organisational measures appropriate to the risk:
- Data transmitted over encrypted HTTPS (TLS 1.2+).
- Strict Content Security Policy across the site.
- Anti-spam (honeypot + reCAPTCHA) on all forms.
- Passwords (client area) always encrypted, never in plain text.
- Data access limited to authorised staff.
- Periodic backups with encryption at rest.
9. Cookies
Cookie usage is described in detail in the Cookie Policy.
10. Changes to this policy
NNZN Studios reserves the right to update this policy. Significant changes will be communicated via a notice on the site and, where applicable, by email.
11. Contacts
For any questions about this privacy policy or the processing of personal data:
admin@nnznstudios.com · NNZN Studios, Gavirate (VA), Italy.
Document updated July 2026.