Privacy Policy

1. Data controller

The data controller is WhereTwo Studio, based in Italy.

For information or to exercise your rights: business@where2studio.com.

2. Technical browsing data

The IT systems and hosting service may automatically record technical data such as IP address, request date and time, requested page, response code, browser type, operating system and similar technical information.

This data is processed solely to deliver and protect the website, prevent abuse, diagnose technical issues and comply with legal obligations. The legal basis is the controller’s legitimate interest in website security and proper operation under Article 6(1)(f) GDPR.

Logs are kept only for as long as necessary for security purposes and in accordance with the terms applicable to the Aruba hosting service and legal obligations. WhereTwo Studio does not use them for advertising, profiling or behavioural analytics.

3. Email and telephone enquiries

When a user contacts WhereTwo Studio by email or telephone, the data voluntarily provided is processed, including name, contact details, message content and project information.

The purpose is to reply, arrange a call, prepare a quote, manage negotiations or perform a collaboration. The legal basis is taking pre-contractual steps at the user’s request or performing a contract under Article 6(1)(b) GDPR.

Enquiries that do not result in a collaboration are retained for no longer than 24 months after the last contact, unless needed to protect legal rights. If a contractual relationship is established, data is retained for the periods required by civil, tax and accounting law.

4. Providing personal data

Browsing the website does not require users to submit personal data. Providing information by email or telephone is optional, but necessary to receive a reply or proposal.

5. Recipients and service providers

Data may be processed by strictly necessary technical providers, particularly Aruba S.p.A. for hosting, security and infrastructure. It may also be shared with professional advisers or public authorities when necessary or required by law.

Personal data is not sold and is not used for automated decision-making or profiling.

6. External links

The website contains ordinary links to Instagram and Canva. These services are not embedded in the page and receive data only when the user opens the relevant link. Any subsequent processing is governed by each provider’s privacy notice.

7. Your rights

Users may request access, rectification, erasure, restriction, data portability and object to processing where provided by Articles 15-22 GDPR by writing to business@where2studio.com.

Users may also lodge a complaint with the Italian Data Protection Authority through garanteprivacy.it.

8. Updates

This notice may be updated if the website, the services used or applicable law changes. The current version is always published on this page.