Privacy Policy.

1. Data controller

The Controller determines the purposes and means of processing carried out through the website and can be contacted at the address above for requests concerning the protection of personal data.

2. Categories of data processed

Browsing data and technical logs

During normal operation, the computer systems, browser and infrastructure that make the website available may process technical information such as IP address, request date and time, requested URL or resource, HTTP method and response code, user agent, device and browser information, and data concerning errors, security, availability and service performance.

This information is used to deliver the website, maintain stability and security, diagnose faults and prevent abuse or unlawful activity. Drag On Studio does not use it to profile users or for behavioural advertising.

Data provided voluntarily

Sending an email voluntarily, initiating contact through WhatsApp or interacting through the social channels linked from the website involves processing the data the user chooses to provide, such as name, contact details, message content, professional information and any further data included in the communication.

Please do not send special categories of personal data or information unnecessary for your request through ordinary contact channels.

Language preference

The selected language is stored locally in the browser so that the same preference can be offered on subsequent visits. This setting is not sent to the contact form and is not used for profiling.

Editable editorial previews

In editorial previews that allow local changes, text, settings, images and videos are saved in the browser to retain work between visits. This storage does not automatically send content to Drag On Studio or publish it on Instagram. Local data can be removed by clearing website data in the browser settings.

Contact form

The website provides an operational form for requesting a commercial proposal or contact. The form collects full name, company, email address, telephone number, requested service, indicative timing, message and acknowledgement/consent relating to the Privacy Policy.

The data entered is sent from https://drag-on-studio.it to a Node backend hosted on Render, which processes the request and forwards it through SMTP to info@dragonstudio.it. Data is processed exclusively to assess the request, contact the user and provide a response.

3. Purposes and legal bases

Depending on the context, data may be processed for the following purposes:

• Website delivery and security: technical operation, abuse prevention, error handling and infrastructure protection. Legal basis: the Controller’s legitimate interest in keeping the service secure, intact and available, while respecting data subjects’ rights.
• Handling enquiries and contacts: responding to communications sent voluntarily by email, WhatsApp, social channels or the contact form. Legal basis: taking pre-contractual steps at the data subject’s request or, for enquiries unrelated to a prospective contract, the legitimate interest in handling communications received.
• Legal compliance and protection of rights: where necessary, meeting regulatory obligations, responding to authorities or establishing, exercising or defending a legal claim. Legal basis: legal obligation and/or legitimate interest in protecting rights.

The website does not currently use data for newsletters, automated marketing, behavioural advertising or profiling.

4. Retention criteria

Data is retained only for as long as necessary to fulfil the purposes for which it is processed, taking into account the nature of the enquiry, website security and technical continuity, any legal obligations and the need to establish, exercise or defend legal claims.

Technical logs are retained according to criteria proportionate to security, diagnostic and infrastructure-management needs and are deleted or made no longer identifiable when those needs end, except where security incidents or legal obligations require otherwise. Voluntary communications are retained for the time needed to handle the enquiry and, if a professional or contractual relationship follows, according to the criteria and obligations applicable to that relationship.

5. Recipients and parties that may process data

Data may be processed by personnel or collaborators authorised by the Controller and, where necessary, by suppliers providing technical or professional services connected with website operation and communications management. Where the relevant conditions apply, these suppliers act as processors under Article 28 GDPR or as independent controllers for processing within their own remit.

Data may also be disclosed to public bodies, authorities or other recipients where required by law or necessary to protect the Controller’s rights.

6. Hosting on Render

The website and the Node backend used for the contact form are hosted on infrastructure provided by Render. Service delivery may involve processing technical and network data needed to receive and serve web requests, maintain infrastructure security, availability and operation, and manage technical logs. For the contact form, the backend receives browser-submitted data solely to validate it, handle the request and forward it through SMTP to info@dragonstudio.it.

Render and any subcontractors involved may operate in jurisdictions outside the European Economic Area. Any international transfers of personal data must comply with Chapter V GDPR and use a mechanism provided by the applicable legislation.

7. Google Maps embedded in the page

Google Maps loads only after an explicit choice, through the External content category or Load Google map. Simply scrolling does not activate it.

When loading the map, the browser connects to Google services and may send technical data such as IP address, device and request information. Google may also use its own cookies or other technologies under the terms and notices applicable to its services.

Drag On Studio does not use Google Maps for profiling or advertising.

8. Email, WhatsApp, Instagram and LinkedIn

The website contains links to external services, including email, WhatsApp, Instagram and LinkedIn. Merely loading website pages does not, through those links, automatically activate profiling functions on behalf of Drag On Studio.

When a user selects an external link, they leave the Drag On Studio domain or launch the associated application. From that point, data may be processed under the relevant provider’s rules. Drag On Studio does not determine the purposes and means of processing carried out independently by those platforms.

9. Possible transfers outside the EEA

Some technology providers or platforms accessible through the website may have offices, infrastructure or subcontractors outside the European Economic Area. Where processing involves transferring personal data to third countries, the transfer must rely on an adequacy decision or other safeguards under Chapter V GDPR, such as standard contractual clauses or other applicable mechanisms, with any necessary supplementary measures.

For external links activated voluntarily by the user, the respective providers supply further information on international transfers in their privacy notices.

10. Data subject rights

Where provided by the GDPR, data subjects may exercise rights of access, rectification, erasure, restriction of processing, portability and objection and, where processing is based on consent, withdraw consent without affecting the lawfulness of processing carried out before withdrawal.

The exercise of these rights may be subject to the conditions, limitations and exceptions in applicable legislation. Requests may be sent to info@dragonstudio.it. The Controller may request information reasonably necessary to verify the requester’s identity.

11. Complaint to a supervisory authority

A data subject who considers that their personal data is being processed in breach of the applicable rules may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or, where applicable, the competent supervisory authority under Articles 77 et seq. GDPR, without prejudice to other available administrative or judicial remedies.

12. No profiling or automated decisions

Internal statistics and Google Analytics 4 activate only after separate consent choices, to measure visits and essential actions. The legal basis is consent under Article 6(1)(a) GDPR, which can be withdrawn through Cookie preferences. Meta Pixel, Google Signals, behavioural advertising and automated decisions with legal or similarly significant effects are not active.

13. Cookies and similar technologies

For categories, providers, retention periods and withdrawal, see the Cookie Policy. Refusing or selecting X does not activate optional tools. Internal statistics use minimised events and daily pseudonyms with a 90-day retention window. GA4 is a separate processing activity by Google, subject to its terms and safeguards for international transfers. Withdrawal stops future transmissions without affecting the lawfulness of earlier processing.

14. Privacy Policy updates

This notice may be updated when website functionality, suppliers, processing methods or the applicable regulatory framework change. The version published on this page is the current version; its last update date appears at the beginning.

Any future introduction of analytics, advertising, newsletter tools or additional third-party services will involve a prior review of privacy requirements and, where necessary, an update to this notice and consent mechanisms before activation.