Privacy policy
About this Privacy Policy
1.1 Purpose and scope
This Privacy Policy explains how Paoletti Studio collects, uses, stores, shares, and otherwise processes personal data in connection with its website, project inquiries, quotations, professional services, communications, payments, and related business activities.
This Privacy Policy applies to personal data processed when you:
visit or interact with the Paoletti Studio website;
submit an inquiry or request a quotation;
communicate with Paoletti Studio;
enter into or perform a project or service agreement;
make or receive payments;
provide photographs, files, references, or other project materials; or
otherwise interact with Paoletti Studio in connection with its Services.
This Privacy Policy does not apply to third-party websites, platforms, or services that operate independently and are subject to their own privacy practices.
1.2 Data Controller
For the personal data processing activities described in this Privacy Policy, the Data Controller is:
Gabriele Paoletti operating under the name Paoletti Studio
Website: paolettistudio.com
Email: legal@paolettistudio.com
The Data Controller determines the purposes and means of processing personal data where it acts as Data Controller.
Where required by applicable law, additional legal and business identification details of the person or entity operating Paoletti Studio will be made available on the website.
1.3 Privacy contact
Questions, requests, or concerns regarding this Privacy Policy or the processing of personal data may be sent to:
Paoletti Studio
Privacy contact: legal@paolettistudio.com
Where Paoletti Studio is required to appoint a Data Protection Officer, the relevant contact details will be made available in this Privacy Policy or elsewhere on the website.
Personal data we collect
2.1 Information you provide directly
Paoletti Studio may collect personal data that you provide directly when you contact the Studio, request a quotation, submit a project inquiry, communicate about a project, or otherwise interact with the Services.
This may include:
your name and surname;
email address and other contact details;
company, organisation, or professional information;
information included in messages, project briefs, instructions, or requests; and
any other personal data that you choose to provide in connection with an inquiry or project.
2.2 Project files and materials
When you provide photographs, images, reference files, source files, or other project materials, those materials may contain personal data.
Depending on the project, this may include:
photographs or images containing identifiable individuals;
names or other identifying information contained in files or project documentation;
image metadata and technical information;
references, annotations, instructions, or other information associated with the project; and
other personal data contained in materials submitted for editing or related Services.
Paoletti Studio only processes such materials to the extent necessary for the relevant project or another lawful purpose described in this Privacy Policy.
2.3 Contract, communication and billing data
Paoletti Studio may process information generated in connection with the administration of a project or business relationship, including:
quotations, proposals, contracts, and project scope information;
correspondence and other communications;
project approvals and revision requests;
delivery and transaction records;
billing details;
tax or VAT information where applicable; and
invoices, receipts, and related accounting records.
2.4 Payment and transaction information
Where you make a payment, Paoletti Studio may receive information relating to the transaction, such as:
amount and currency;
payment status;
transaction identifiers;
date and time of payment; and
limited information provided by the relevant payment service provider.
Complete payment card details are generally processed directly by the relevant payment provider and are not received or stored by Paoletti Studio where the provider handles those details independently.
2.5 Website and technical data
When you visit or interact with the website, certain technical information may be collected automatically by the website or its service providers.
This may include:
IP address;
browser and device information;
operating system;
approximate location derived from technical information;
date and time of access;
pages or features accessed;
referral information;
advertising or campaign identifiers;
interactions with advertisements or website conversion events; and
technical logs and similar diagnostic information.
Where advertising, analytics, or measurement technologies are used, additional information about their purposes and operation is provided in Sections 8 and 11 and in the Cookie Policy.
2.6 Personal data received from third parties
Paoletti Studio may receive personal data about individuals who have not provided that information directly to the Studio.
This may occur, for example, where:
a Client submits photographs containing identifiable individuals;
a company or agency provides contact details for a representative or collaborator;
a Client provides materials created by or relating to another person; or
personal data is provided through an authorised representative or business contact.
Where applicable, such personal data will be processed in accordance with this Privacy Policy and applicable data protection law.
2.7 Special categories of personal data
Paoletti Studio does not normally request or intentionally collect special categories of personal data for the purpose of providing its Services.
However, photographs or other materials submitted by Clients may incidentally reveal information that falls within special categories of personal data under applicable law.
Clients should avoid providing sensitive personal data unless it is necessary for the relevant project and they have an appropriate legal basis for doing so.
Purposes and legal bases for processing
3.1 Responding to inquiries and preparing quotations
Personal data may be processed to:
respond to inquiries;
assess project requirements and feasibility;
review submitted materials;
prepare quotations or proposals; and
communicate before a project is formally agreed.
The legal basis for this processing is taking steps at your request prior to entering into a contract and, where applicable, Paoletti Studio’s legitimate interest in responding to genuine business inquiries.
3.2 Providing and managing the Services
Personal data may be processed to:
perform the agreed photo editing or related Services;
manage project instructions and requirements;
communicate regarding the project;
process revisions and approvals;
prepare and deliver final files; and
administer the ongoing Client relationship.
Where you are personally a party to the relevant agreement, the legal basis is generally the performance of the contract.
Where the Client is a company, agency, or other organisation and the personal data relates to its representatives or personnel, the legal basis may instead be Paoletti Studio’s legitimate interest in administering and performing the relevant business relationship.
3.3 Payments, invoicing and accounting
Personal data may be processed to:
issue and administer invoices;
process and record payments;
maintain transaction records;
manage outstanding amounts; and
comply with applicable accounting, tax, and financial obligations.
The legal basis for this processing may include performance of the relevant contract and compliance with legal obligations to which Paoletti Studio is subject.
3.4 Business and Client communications
Paoletti Studio may process contact details and correspondence to manage ordinary communications relating to projects, Services, quotations, payments, support, or the ongoing business relationship.
Depending on the circumstances, the legal basis is performance of a contract, taking pre-contractual steps at your request, or Paoletti Studio’s legitimate interest in maintaining effective business communications.
3.5 Security, fraud prevention and protection of legal rights
Personal data may be processed where reasonably necessary to:
protect the website, accounts, systems, and communications;
detect or prevent fraud, misuse, or unauthorised activity;
investigate payment disputes or chargebacks;
maintain evidence of agreements, approvals, delivery, and communications; and
establish, exercise, or defend legal claims.
The legal basis for this processing is generally Paoletti Studio’s legitimate interest in protecting its business, Clients, systems, contractual rights, and legal interests, except where another legal basis applies.
3.6 Compliance with legal and regulatory obligations
Paoletti Studio may process or retain personal data where necessary to comply with applicable legal, regulatory, tax, accounting, or other mandatory obligations.
The legal basis for this processing is compliance with a legal obligation.
3.7 Website operation, analytics and improvement
Technical and usage data may be processed to operate, maintain, secure, troubleshoot, and improve the website and its performance.
Where such processing is strictly necessary for the operation or security of the website, the legal basis may be Paoletti Studio’s legitimate interest in maintaining a secure and functional online service.
Where analytics or similar technologies require consent under applicable law, the relevant processing will take place only after the required consent has been obtained.
3.8 Marketing, advertising and campaign measurement
Paoletti Studio may use advertising and measurement services, including Google Ads, to promote its Services, measure the effectiveness of advertising campaigns, understand whether website visits result in relevant actions or inquiries, and, where enabled, create or use advertising audiences.
These activities may involve the use of cookies, similar technologies, online identifiers, and information about interactions with the website or advertising campaigns.
Where required by applicable law, advertising, remarketing, personalised advertising, and related measurement activities will take place only after the necessary consent has been obtained.
Consent may be withdrawn or preferences changed at any time through the website’s cookie or privacy controls, without affecting the lawfulness of processing carried out before withdrawal.
3.9 Other compatible or legally permitted purposes
Paoletti Studio will not use personal data for a new purpose that is incompatible with the purpose for which it was originally collected unless there is an appropriate legal basis or the processing is otherwise permitted by applicable law.
Where required, appropriate information will be provided before personal data is used for a materially different purpose.
Our role when processing Client project data
4.1 Paoletti Studio as Data Controller
Paoletti Studio acts as Data Controller where it determines the purposes and means of processing personal data for its own business activities.
This generally includes personal data processed for purposes such as:
managing inquiries and quotations;
administering Client relationships;
issuing invoices and maintaining business records;
processing payments and transaction information;
operating and securing the website;
handling legal, accounting, or regulatory obligations; and
protecting Paoletti Studio’s legitimate business and legal interests.
In these situations, Paoletti Studio is responsible for determining how and why the relevant personal data is processed, subject to applicable data protection law.
4.2 Paoletti Studio as Data Processor
In some projects, Paoletti Studio may process personal data solely on behalf of a Client and according to the Client’s documented instructions.
This may occur, for example, where a Client provides photographs or other project materials containing personal data and determines the purposes for which those materials are being processed.
Where Paoletti Studio acts as a Data Processor, it will process the relevant personal data only for the agreed purposes, in accordance with the Client’s documented instructions and applicable data protection law.
4.3 Data Processing Agreements
Where required by applicable law, Paoletti Studio and the relevant Client will enter into a separate Data Processing Agreement governing the processing of personal data carried out by Paoletti Studio on the Client’s behalf.
Such an agreement may address, as applicable:
the subject matter and duration of the processing;
the nature and purpose of the processing;
the types of personal data involved;
the categories of individuals concerned;
confidentiality obligations;
security requirements;
use of sub-processors;
assistance with data protection requests and obligations; and
deletion or return of personal data at the end of the relevant processing.
The Data Processing Agreement will apply in addition to this Privacy Policy and any applicable project agreement.
4.4 Client responsibilities for third-party personal data
Where a Client provides Paoletti Studio with personal data relating to other individuals, the Client is responsible for ensuring that it has an appropriate legal basis and any required authority to provide that data for the purposes of the project.
Where the Client acts as Data Controller and Paoletti Studio acts as Data Processor, the Client remains responsible for determining the lawful purposes of the processing and for providing Paoletti Studio with appropriate documented instructions.
Paoletti Studio may request information or documentation reasonably necessary to clarify the parties’ respective data protection roles before processing begins.
How we share personal data
5.1 Service and technology providers
Paoletti Studio may use third-party service providers to support the operation of the website and the delivery of its Services.
Depending on the services used, these providers may process personal data for purposes such as:
website hosting and infrastructure;
email and communications;
contact forms and workflow automation;
cloud storage and file transfer;
project administration;
security, backup, and technical support;
website analytics or similar functions where enabled; and
cookie consent management and recording of privacy preferences.
Such providers may process personal data only to the extent necessary for the relevant service and subject to the applicable contractual and data protection requirements.
Paoletti Studio uses CookieYes as its consent management platform to display cookie notices, manage user preferences, record consent choices, and help control the activation of optional cookies and tracking technologies.
Paoletti Studio may also use Google advertising and measurement services, including Google Ads, to measure advertising performance, track relevant website conversions, and, where enabled and permitted, support remarketing or personalised advertising. Google may process personal data in accordance with the applicable Google Ads data protection terms and its own privacy practices.
5.2 Payment and financial service providers
Personal data relating to payments and transactions may be shared with payment processors, banks, card networks, fraud-prevention services, and other financial institutions where necessary to process payments, manage refunds, prevent fraud, or resolve payment disputes.
Payment card information handled directly by a payment provider is processed in accordance with that provider’s own applicable privacy and security practices.
5.3 Collaborators and contractors
Where reasonably necessary for a project, Paoletti Studio may provide limited access to personal data or Client materials to employees, freelancers, contractors, or other professional collaborators assisting with the provision or administration of the Services.
Access will be limited to what is reasonably necessary for the relevant task, and appropriate confidentiality and data protection obligations will apply.
Where Paoletti Studio acts as a Data Processor, any use of sub-processors will also be subject to the requirements described in Section 4.
5.4 Professional advisers
Personal data may be disclosed where reasonably necessary to accountants, legal advisers, tax advisers, insurance providers, or other professional advisers assisting Paoletti Studio with legal, financial, regulatory, or business matters.
Such disclosures will be limited to the information reasonably necessary for the relevant professional purpose.
5.5 Public authorities and legal requirements
Paoletti Studio may disclose personal data where required or permitted by applicable law, including to courts, regulatory authorities, tax authorities, law-enforcement bodies, or other competent public authorities.
Personal data may also be disclosed where reasonably necessary to establish, exercise, or defend legal claims or protect the rights, property, or legitimate interests of Paoletti Studio or another person.
5.6 Business transfers and organisational changes
If Paoletti Studio undergoes a sale, merger, restructuring, transfer of business, succession, or similar organisational change, relevant personal data may be disclosed or transferred as part of that transaction where legally permitted.
Any recipient of such data will remain subject to applicable data protection requirements.
5.7 No sale or unrelated disclosure of Client data
Paoletti Studio does not sell Client personal data or project materials to third parties.
Personal data and Client project materials will not be disclosed to third parties for unrelated resale, independent advertising, or model-training purposes unless the Client has expressly authorised such use or another lawful basis clearly permits it.
International data transfers
6.1 International processing
Paoletti Studio is based in the European Economic Area (“EEA”) and seeks to use service providers and processing locations within the EEA where reasonably appropriate.
However, some service providers used to operate the website, process payments, manage communications, automate workflows, or provide related technical services may process personal data outside the EEA or allow access to personal data from other countries.
Where personal data is transferred outside the EEA, Paoletti Studio will ensure that the transfer is made in accordance with applicable data protection law and is covered by an appropriate legal transfer mechanism where required.
6.2 Framer
Paoletti Studio uses Framer to build, publish, and operate the website.
Framer B.V. is established in the Netherlands. However, Framer may engage sub-processors that process personal data in countries outside the EEA.
Where an international transfer requires additional safeguards, Framer provides for recognised transfer mechanisms including an applicable adequacy decision, the EU-U.S. Data Privacy Framework where the recipient is certified under it, or the Standard Contractual Clauses approved by the European Commission.
6.3 Hostinger
Paoletti Studio uses Hostinger for services that may include domain, email, hosting, or related infrastructure.
Hostinger and its authorised sub-processors may process personal data in different jurisdictions.
Where Customer Data is transferred outside the EEA to a country that has not been recognised as providing an adequate level of data protection, Hostinger provides for the use of the Standard Contractual Clauses approved by the European Commission or another applicable lawful transfer mechanism.
6.4 Stripe
Paoletti Studio may use Stripe to process payments and related financial transactions.
Stripe operates internationally and personal data may be transferred to Stripe entities, affiliates, financial partners, and service providers located outside the EEA, including in the United States.
For transfers of EEA personal data to the United States, Stripe may rely on the EU-U.S. Data Privacy Framework where applicable. Stripe also incorporates the Standard Contractual Clauses and other recognised transfer mechanisms where required by applicable data protection law.
6.5 Make
Paoletti Studio may use Make to automate certain operational workflows, such as processing information submitted through website forms and supporting related communications.
Make is operated within the Celonis group and may process personal data using infrastructure or service providers located inside or outside the EEA.
Celonis entities participating in the EU-U.S. Data Privacy Framework may rely on that framework for eligible transfers to the United States. Where personal data is transferred to other recipients in countries without an applicable adequacy decision, appropriate safeguards such as the Standard Contractual Clauses may be used.
6.6 Google
Paoletti Studio uses Google Ads and may use related Google measurement technologies for advertising, campaign measurement, conversion tracking, and related purposes.
Google operates infrastructure and services internationally, and personal data processed through its advertising and measurement services may be transferred outside the EEA, including to the United States.
For eligible transfers of EEA personal data to the United States, Google may rely on the EU-U.S. Data Privacy Framework. Where applicable, Google may also rely on Standard Contractual Clauses or other recognised transfer mechanisms in accordance with applicable data protection law.
6.7 CookieYes
Paoletti Studio uses CookieYes as its consent management platform to display and manage cookie preferences, record consent choices, and help prevent optional tracking technologies from operating without the required consent.
CookieYes Limited is established in the United Kingdom and may process limited technical and consent-related information in connection with these functions.
Transfers to the United Kingdom are currently covered by an adequacy decision adopted by the European Commission.
6.8 Other service providers
Paoletti Studio may introduce, replace, or remove service providers as its business and technical infrastructure evolve.
Where another provider processes personal data outside the EEA, Paoletti Studio will assess the applicable transfer mechanism and, where required, ensure that the transfer is covered by an adequacy decision, Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, or another safeguard recognised under applicable data protection law.
6.8 Further information about transfer safeguards
You may contact Paoletti Studio at legal@paolettistudio.com to request further information about international transfers of your personal data and the safeguards applicable to those transfers.
Data retention
7.1 General retention principles
Paoletti Studio retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including the provision of Services, compliance with legal obligations, protection of legal rights, and resolution of disputes.
Retention periods may vary depending on the nature of the data, the purpose of the processing, applicable legal requirements, and whether the data is relevant to an ongoing contractual or legal matter.
When personal data is no longer required, it will be deleted, anonymised, or otherwise securely disposed of where reasonably practicable.
7.2 Inquiries and quotations
Personal data relating to inquiries or quotations that do not result in a project may generally be retained for up to 12 months after the last relevant communication.
This period allows Paoletti Studio to respond to follow-up questions, maintain appropriate business records, and understand the history of a previous inquiry.
Data may be retained for a longer period where reasonably necessary to establish, exercise, or defend legal claims or where required by law.
7.3 Active projects and Client project files
Personal data and project materials required to provide the Services will normally be retained for the duration of the relevant project.
Unless a longer period is agreed or reasonably necessary for another lawful purpose, Client source files, working materials, and final Deliverables may be retained for up to 90 days after completion of the project to support revisions, delivery, quality control, and short-term recovery needs.
Paoletti Studio does not provide permanent archival storage of Client project files unless expressly agreed.
7.4 Contracts, communications and business records
Quotations, contracts, project approvals, material correspondence, transaction records, and other documentation relevant to the contractual relationship may be retained for as long as reasonably necessary to document the relationship and establish, exercise, or defend legal rights.
Where appropriate, such records may be retained for up to 10 years after the end of the relevant contractual relationship, subject to any different period required or permitted by applicable law.
7.5 Invoices, tax and accounting records
Invoices, accounting records, payment documentation, and other information that must be retained for tax, accounting, or regulatory purposes will be kept for the period required by applicable law.
Where Italian law applies, relevant accounting records and invoices are generally retained for 10 years, and may be retained for longer where required in connection with an unresolved tax assessment, proceeding, or other legal obligation.
7.6 Legal claims and disputes
Where personal data is relevant to an actual or reasonably anticipated legal claim, complaint, payment dispute, chargeback, investigation, or regulatory matter, Paoletti Studio may retain the relevant information for as long as reasonably necessary to resolve the matter and protect or exercise its legal rights.
Such information may be retained beyond the ordinary periods described above where required by applicable limitation periods, legal obligations, or ongoing proceedings.
7.7 Website and technical data
Technical logs, security records, and similar website data will be retained only for the period reasonably necessary for security, fraud prevention, troubleshooting, system administration, and related operational purposes.
Where such information is processed by third-party service providers, the applicable retention period may also depend on the provider’s systems and contractual settings.
Retention of data collected through cookies, analytics tools, or similar technologies is addressed separately in the applicable cookie and tracking information.
7.8 Consent and preference records
Where processing is based on consent, Paoletti Studio may retain records of the consent given, withdrawn, or modified for as long as reasonably necessary to demonstrate compliance with applicable data protection requirements.
This does not mean that personal data covered by a withdrawn consent will continue to be used for the original consent-based purpose after the withdrawal takes effect.
7.9 Backups and deletion
Personal data deleted from active systems may remain temporarily in backup or disaster-recovery systems until the relevant backup cycle is overwritten or securely deleted.
Backup copies will not normally be restored or used for ordinary business purposes once the corresponding data has been deleted from active systems, except where necessary for system recovery, security, or compliance with legal obligations.
Cookies and tracking technologies
8.1 Use of cookies and similar technologies
The Paoletti Studio website may use cookies and similar technologies to operate securely, remember user preferences, understand website usage, and, where enabled, support analytics or advertising activities.
These technologies may include cookies, local storage, pixels, or other technologies that store or access information on a user’s device.
The technologies used and the choices available to users depend on the configuration of the website at the time of the visit.
8.2 Strictly necessary technologies
Certain cookies or similar technologies may be necessary for the website to function correctly, securely, and efficiently.
These may be used for purposes such as:
maintaining essential website functionality;
remembering privacy or cookie preferences;
ensuring security and preventing misuse;
enabling forms or other features requested by the user; and
maintaining technical stability and performance.
Where these technologies are strictly necessary to provide the website or a service expressly requested by the user, they may be used without prior consent where permitted by applicable law.
8.3 Analytics
Paoletti Studio may use analytics technologies to understand how visitors interact with the website, evaluate website performance, and identify areas for improvement.
Where analytics technologies qualify as strictly necessary or are treated as equivalent to technical cookies under applicable law, they may be used without prior consent subject to the applicable requirements.
Where consent is required, analytics technologies will not be activated until the user has provided the necessary consent.
8.4 Advertising and profiling technologies
Paoletti Studio uses or may use advertising and measurement technologies provided by Google, including Google Ads, to measure advertising performance, understand whether advertisements result in relevant actions on the website, and, where enabled, support remarketing, audience creation, or personalised advertising.
These technologies may involve cookies, local storage, online identifiers, or similar tracking technologies.
Where required by applicable law, advertising and profiling technologies will not be activated before the user has provided the necessary consent.
Users may refuse or withdraw consent without losing access to the essential functionality of the website.
8.5 Cookie consent and preferences
Where consent is required, optional cookies and tracking technologies will be disabled by default until the user has made a choice.
Users will be able to accept or reject optional technologies and, where available, manage individual categories through the website’s cookie preference controls.
Consent may be withdrawn or preferences changed at any time through the cookie settings made available on the website.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
8.6 Third-party technologies
Some cookies and tracking technologies used on the website may be provided by third parties, including Google, in connection with advertising, measurement, analytics, or related services.
Where such technologies are used, the relevant third party may process information in accordance with its own privacy practices and applicable data protection law.
Paoletti Studio will provide information about the relevant categories of technologies, their purposes, providers, and applicable retention periods in the Cookie Policy or cookie preference interface where required.
8.7 Further information about cookies
Further information about the cookies and similar technologies currently used on the website, including their purpose, provider, category, and duration, will be made available through the Cookie Policy and, where applicable, the website’s cookie preference controls.
Your data protection rights
9.1 Right of access
You may request confirmation as to whether Paoletti Studio processes personal data relating to you and, where applicable, obtain access to that data and information about how it is processed.
You may also request a copy of the personal data undergoing processing, subject to applicable legal limitations and the rights and freedoms of others.
9.2 Right to rectification
You may request the correction of personal data that is inaccurate and the completion of personal data that is incomplete.
9.3 Right to erasure
You may request the deletion of personal data where the conditions provided by applicable data protection law are met.
The right to erasure does not apply where continued processing or retention is necessary for a lawful reason, including compliance with a legal obligation or the establishment, exercise, or defence of legal claims.
9.4 Right to restriction of processing
You may request that the processing of your personal data be restricted in certain circumstances, including where:
you contest the accuracy of the data;
you believe the processing is unlawful but do not want the data deleted;
Paoletti Studio no longer requires the data for its original purpose, but you need it for a legal claim; or
you have objected to processing and the relevant assessment is still pending.
9.5 Right to data portability
Where processing is based on your consent or on a contract with you and is carried out by automated means, you may have the right to receive personal data that you have provided to Paoletti Studio in a structured, commonly used, and machine-readable format.
Where technically feasible and legally applicable, you may also request that such data be transmitted directly to another controller.
9.6 Right to object
Where personal data is processed on the basis of legitimate interests, you may object to that processing at any time on grounds relating to your particular situation.
Paoletti Studio will stop the relevant processing unless there are compelling legitimate grounds to continue that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
Where personal data is processed for direct marketing purposes, you may object to that processing at any time without having to provide a particular reason.
9.7 Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.
9.8 Exercising your rights
Requests relating to your data protection rights may be submitted to:
Paoletti Studio
Email: legal@paolettistudio.com
Paoletti Studio may request additional information where reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.
Requests will normally be handled without undue delay and within one month of receipt. Where permitted by applicable law, this period may be extended by up to two additional months where necessary due to the complexity or number of requests. You will be informed of any applicable extension within the initial one-month period.
Requests are generally handled free of charge. Where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, Paoletti Studio may charge a reasonable fee based on administrative costs or refuse to act on the request where permitted by law.
Where Paoletti Studio processes personal data solely as a Data Processor on behalf of a Client, Paoletti Studio may refer the request to, or assist, the relevant Data Controller in accordance with applicable data protection requirements.
9.9 Right to lodge a complaint
If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
Where applicable, you may contact the Garante per la protezione dei dati personali, the Italian data protection authority.
Under the GDPR, you may also lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
Providing personal data
10.1 Data required to provide the Services
Certain personal data is necessary for Paoletti Studio to respond to requests, prepare a quotation, enter into a project agreement, or provide the requested Services.
Where information is identified as required, or is reasonably necessary for the relevant request or project, failure to provide it may prevent Paoletti Studio from responding to the inquiry, preparing an accurate quotation, entering into the agreement, or performing all or part of the requested Services.
10.2 Data required by law
Certain personal data may be required to comply with legal, tax, accounting, invoicing, or regulatory obligations.
Where the provision or collection of such information is legally required, Paoletti Studio may be unable to complete the relevant transaction or business relationship without it.
10.3 Optional information
Personal data that is not necessary for the relevant request, project, contractual relationship, or legal obligation is generally optional.
Where optional information is requested, you may choose not to provide it unless otherwise indicated.
Consent to optional analytics, advertising, or marketing activities is not a condition for obtaining Paoletti Studio’s Services unless the relevant processing is genuinely necessary for a specific service requested by you.
10.4 Consequences of not providing required data
If you do not provide personal data that is necessary for a particular purpose, Paoletti Studio may be unable to:
respond effectively to your request;
assess or quote the proposed project;
enter into or perform a project agreement;
process or verify a payment;
issue legally required billing documentation; or
comply with another obligation connected with the requested Services.
Paoletti Studio will not require personal data that is unnecessary for the relevant purpose solely as a condition of providing the Services.
Automated decision-making and profiling
11.1 Automated decision-making
Paoletti Studio does not currently use personal data to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Automated tools may be used to support ordinary technical or administrative activities, such as website operation, workflow automation, security, communications, or payment processing, but Paoletti Studio does not rely on such tools to make decisions of the type described above.
If this changes, Paoletti Studio will provide the information and safeguards required by applicable data protection law.
11.2 Profiling and advertising
Where analytics or advertising technologies are enabled, automated processing may be used to analyse or categorise website interactions for purposes such as measuring website or campaign performance, creating audience segments, understanding advertising effectiveness, or personalising advertising.
Where consent is required for such processing, these activities will take place only in accordance with the choices made through the applicable cookie or privacy controls.
Such profiling is not used by Paoletti Studio to make decisions that produce legal effects concerning you or similarly significantly affect you.
Your rights in relation to profiling, direct marketing, consent, and objections are described in Section 9.
Data security
12.1 Technical and organisational measures
Paoletti Studio implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access, or other unlawful processing.
The measures applied are selected having regard to the nature, scope, context, and purposes of the processing, the systems and service providers involved, and the risks presented by the processing.
Depending on the relevant systems and circumstances, these measures may include:
appropriate access controls and authentication measures;
secure methods for storing and transferring data;
encryption or other protective measures where appropriate;
backup and recovery measures;
software and system security updates;
measures designed to protect devices, accounts, and communications;
appropriate selection and management of service providers; and
organisational procedures designed to reduce unauthorised access, disclosure, loss, or misuse of personal data.
Security measures may be reviewed and updated where appropriate in light of changes to the processing, technology, or identified risks.
12.2 Access and confidentiality
Access to personal data is limited to Paoletti Studio and to persons or service providers who reasonably require access for the relevant purpose.
Where appropriate, persons handling personal data are subject to confidentiality obligations and are expected to process the information only within the scope of their authorised activities.
Where Paoletti Studio acts as a Data Processor, personal data will also be handled in accordance with the applicable Client instructions and Data Processing Agreement.
12.3 Security limitations
Paoletti Studio takes reasonable measures to protect personal data, but no method of transmission, electronic storage, or information system can be guaranteed to be completely secure.
Security measures are therefore intended to reduce risks to an appropriate level rather than to provide an absolute guarantee against every possible security incident.
Changes and contact
13.1 Changes to this Privacy Policy
Paoletti Studio may update this Privacy Policy from time to time to reflect changes to its Services, data processing activities, technology, service providers, or applicable legal requirements.
The current version of the Privacy Policy will be made available on the Paoletti Studio website and will indicate the date on which it was last updated.
Where a change materially affects how personal data is processed, Paoletti Studio will take appropriate steps to bring the change to the attention of affected individuals where required by applicable law.
Where appropriate, relevant information will be provided before the updated processing begins.
13.2 Effective date
Effective date: 05/09/2026
Last updated: 05/09/2026
13.3 Privacy contact
For questions regarding this Privacy Policy or the processing of personal data, please contact:
Paoletti Studio
legal@paolettistudio.com