Legal
Privacy Policy
Last updated:
This policy explains how the personal data of visitors to nulloriginstudios.com (the “Website”) are processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (“Italian Privacy Code”). It applies to this Website only and not to third-party websites reachable through links.
1. Data controller
The data controller is [Company name], operating under the Null Origin Studios brand, with registered office at [Registered address], VAT number [VAT number].
For any request concerning the processing of personal data, please write to [email address]@nulloriginstudios.com.
The Controller has not appointed a Data Protection Officer (DPO), as it is not required to do so under Article 37 GDPR.
2. Data we process
Browsing data
The IT systems and web server hosting the Website collect, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols. These include: IP address, date and time of the request, requested resource (URL), server response code, response size, referring page and information about the browser and operating system (user agent).
These data are not collected in order to be associated with identified individuals and are not used to profile users.
Data you provide voluntarily
If you choose to write to the email addresses shown on the Website, the Controller receives the sender's address and any other personal data included in the message, which are needed to reply.
Cookies
The Website does not use cookies or any other tracking tools. See the Cookie Policy for details.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering the Website and ensuring its proper operation and security (preventing abuse and cyber attacks) | Browsing data | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) |
| Replying to requests sent by email | Data provided voluntarily | Pre-contractual or contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR) or legitimate interest in replying (Art. 6(1)(f) GDPR) |
| Establishing, exercising or defending legal claims and complying with legal obligations or requests from authorities | Browsing data and data provided voluntarily | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest of the Controller (Art. 6(1)(f) GDPR) |
Browsing data are necessary to view the Website. Providing data by email is optional, but without them we cannot reply to your request.
4. How data are processed
Data are processed electronically by authorized and trained personnel, using appropriate technical and organizational measures to ensure their confidentiality, integrity and availability, including encrypted connections (HTTPS). No automated decision-making or profiling takes place.
5. Recipients
Data may be processed on the Controller's behalf by technical service providers (in particular the Website hosting provider, [hosting provider name], and the email service provider), appointed as data processors under Article 28 GDPR. Data may also be disclosed to public authorities where required by law. Data are not published or sold to third parties for commercial purposes.
6. Transfers outside the EU
Data are processed within the European Economic Area. Should a provider process them outside the EEA, the transfer will only take place to countries covered by a European Commission adequacy decision or on the basis of the Standard Contractual Clauses approved by the Commission (Articles 45 and 46 GDPR).
7. Retention
- Browsing data: kept in the server logs for no longer than [30] days, unless needed to investigate cyber crimes against the Website.
- Data provided by email: kept for as long as needed to handle the request and then for no longer than 24 months, unless the relationship continues or retention is required by law.
8. Your rights
You may exercise the rights provided by Articles 15-22 GDPR at any time:
- access to your personal data (Art. 15);
- rectification of inaccurate data or completion of incomplete data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- objection to processing based on legitimate interest (Art. 21).
Requests should be sent to the address given in section 1. The Controller will reply without undue delay and in any case within one month of receipt, extendable by two further months in the cases set out in Article 12 GDPR.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you habitually reside or work.
9. Links to third-party websites
The Website may contain plain links to the studio's profiles on third-party platforms. These are simple links: the Website does not embed content or buttons from those platforms and does not send them any data. Once you reach them, those platforms process data according to their own policies, for which the Controller is not responsible.
10. Children
The Website is not specifically aimed at children under 14 and the Controller does not knowingly collect their personal data. If a parent or guardian believes that a child has sent personal data, they may request its deletion by writing to the address given in section 1.
11. Changes to this policy
The Controller may update this policy, for example following changes in the law or the introduction of new Website features. The current version is always published on this page, with the date of the last update shown at the top.