Privacy Policy

Last updated: September 10, 2026

1. Data Controllers

Personal data collected through this website is processed under joint controllership (Art. 26 GDPR) by:

Davide Padeletti
Freelance professional — VAT IT01602490110
La Spezia (SP), Italy

Manfredi Miraula
Freelance professional — VAT IT04274921206
Bologna (BO), Italy

both operating under the trade name “Data Artisans”.
Privacy contact email: privacy@dataartisanstudio.com

The Joint Controllers undertake to update this document in the event of a change in legal form.

Allocation of responsibilities between the Joint Controllers (Art. 26 GDPR). The Joint Controllers jointly determine the purposes and means of the processing described in this policy and are jointly responsible for it: no internal allocation limits your rights, which you may exercise against either of them (Art. 26.3 GDPR). For simplicity, a single point of contact is designated — privacy@dataartisanstudio.com — for any request: anything sent there is effective towards both of them, without needing to contact them separately.

2. Data collected and purposes

2.1 Contact form

Through the contact form on the “Contact” page, we collect the following personal data:

  • Full name — to identify you in our reply
  • Email address — to respond to your request
  • Message — the content of your enquiry

Purpose: to respond to your contact request or enquiry about our services.
Legal basis: performance of pre-contractual measures taken at the request of the data subject (Art. 6.1.b GDPR).

Providing the data marked as mandatory is necessary to submit the contact request. Failure to provide such data makes it impossible to respond to the request.

2.2 Product waitlist

Through the form on the “Metroquadro” page, we collect:

  • Email address — to contact you about taking part in the Metroquadro pilot

Purpose: to send you updates on the Metroquadro pilot and to collect product feedback.
Legal basis: consent of the data subject (Art. 6.1.a GDPR). Consent is collected through a mandatory tick box next to the form: without it, no signup is recorded. Alongside your email we store the date and time of consent and the exact wording you were shown, so that we can demonstrate it (Art. 7.1 GDPR) even if that text changes later. Consent may be withdrawn at any time by writing to privacy@dataartisanstudio.com.

Data is retained until the product launches or consent is withdrawn.

2.3 Navigation data

Legal basis: the Controller’s legitimate interest (Art. 6.1.f GDPR) in ensuring the operation, security and abuse protection of the service.

The servers hosting this website automatically collect certain technical data (IP address, browser type, pages visited, access time) solely for the purpose of operating and securing the service. These data are not associated with identified individuals and are retained only as long as strictly necessary.

To limit abuse of the website’s forms we also keep a per-IP request count: the address is never stored in clear text, only as a hash, and expired rows are deleted automatically every day.

2.4 Virtual assistant (chatbot)

The site provides a virtual assistant that answers questions about Data Artisans. Conversations are stored for statistical analysis and to improve the service.

  • Purpose and legal basis: the Controller’s legitimate interest (Art. 6.1.f GDPR) in understanding user requests and improving the service.
  • Data processed: the text of questions and answers. Before storage we apply automatic minimisation (removal of detected emails and phone numbers) and the IP address is stored only as a hash, never in clear text. No identifying data or special categories of data are requested: please do not enter personal data in the chat.
  • Retention: conversations are kept for a maximum of 12 months, after which they are deleted automatically.
  • The assistant uses Vertex AI (Google Cloud) to generate responses; see also “Data recipients”.

3. Cookies and Analytics

This website does not use profiling cookies or tracking for advertising or marketing purposes.

Strictly necessary technical cookies required for the website to function may be present (e.g. light/dark theme preference, banner acknowledgement).

To measure aggregated traffic we use Umami, a cookieless, privacy-by-design web analytics tool:

  • does not collect personally identifiable data
  • does not use analytics cookies
  • does not perform cross-site tracking
  • data is stored within the European Union
  • compliant with GDPR and the Italian Data Protection Authority (Garante) guidelines

No consent is required for the use of Umami as it does not process personal data under the GDPR.

4. Data recipients

Personal data collected through this website is processed by the following external data processors:

Microsoft Ireland Operations Limited — manages the cloud infrastructure on which the website is hosted (Microsoft Azure, EU region), processes messages submitted via the contact form through Microsoft Graph API, stores product waitlist data via Azure Table Storage, and retains virtual assistant conversations (§2.4) via Azure Cosmos DB. Data is processed within the European Union. For more information: microsoft.com/en-us/trust-center/privacy and microsoft.com/licensing/docs/view/DPA.

Google Cloud (Vertex AI) — provides the service used by the virtual assistant (§2.4) to generate responses. With each question we send the text of the question, the previous messages in the same conversation, and the extracts from our knowledge base needed to answer; processing takes place in the EU region (europe-west1, Belgium). Under the Google Cloud terms of service, data sent to Vertex AI is not used to train the provider’s models. For more information: cloud.google.com/terms/data-processing-addendum.

Umami Software, Inc. — provides the cookieless web analytics service Umami Cloud, used to produce aggregate statistics on website traffic. For this purpose, the Umami script sends some technical browsing data to the provider’s servers (e.g. IP address — not retained, used transiently for aggregate counting only — user-agent, page visited), processed in the EU region and not associated with identified individuals. For more information: umami.is/privacy.

Transfers outside the EU. The processing described above takes place on infrastructure located within the European Union. Some of the providers listed, however, belong to groups headquartered in the United States: should a transfer to third countries become necessary for technical support or service administration purposes, it takes place in compliance with Art. 44 ff. GDPR through appropriate safeguards, including the Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, the provider’s participation in the EU-U.S. Data Privacy Framework.

Data is not shared with third parties for marketing purposes, sold, or disclosed to other parties, except as required by law.

5. Retention

Data submitted via the contact form is retained for the time necessary to handle your request and, in any case, no longer than 24 months from the date of submission, unless different legal obligations or ongoing disputes apply.

6. Your rights

As a data subject, you have the right to:

  • Access (Art. 15 GDPR): obtain confirmation that your personal data is being processed and receive a copy
  • Rectification (Art. 16 GDPR): request correction of inaccurate or incomplete data
  • Erasure (Art. 17 GDPR): request deletion of your data (“right to be forgotten”)
  • Restriction of processing (Art. 18 GDPR): request restriction of processing in certain cases
  • Objection (Art. 21 GDPR): object to the processing of your personal data
  • Portability (Art. 20 GDPR): receive your data in a structured, commonly used and machine-readable format
  • Withdrawal of consent (Art. 7.3 GDPR): withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. This applies to processing based on consent, i.e. the product waitlist (§2.2)

To exercise your rights, write to: privacy@dataartisanstudio.com

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

7. Changes to this policy

The Joint Controllers reserve the right to update this policy in the event of regulatory, technical or organisational changes. The “Last updated” date at the top of this page indicates the version currently in force.