Privacy policy

1. Data controller

The data controller is Kuama S.r.l., with registered office at Via Germania, n. 7, 35010 Vigonza (PD), Italy. Privacy-related requests may be sent to the company at [email protected].

2. Data processed through the website

When browsing the website, technical data necessary for operation and security may be processed, including IP address, browser and device information, date and time of requests, and technical logs.

When a visitor uses the contact form, the data entered in the form is processed: full name, company or studio, email address, and message content.

3. Purposes and legal bases

• replying to requests sent through the contact form, based on pre-contractual measures or on the legitimate interest in managing incoming communications;
• ensuring the proper operation, security, and maintenance of the website, based on the controller's legitimate interest;
• preventing abuse, spam, and misuse of the contact form, based on the controller's legitimate interest.

4. Contact form and communications

Data submitted through the contact form is used only to manage the request and reply to the email address provided by the visitor. No newsletter or promotional communication is sent without a specific consent.

Technical emails connected with the request may be delivered through Mailjet, the email delivery provider used by the controller.

5. Anti-spam protection

The website uses Cloudflare Turnstile to verify that contact form submissions come from a real user and to prevent spam or abuse. Turnstile may process technical signals such as IP address, user-agent, browser information, and data necessary for the security check.

6. Recipients of personal data

Data may be processed by authorized Kuama S.r.l. personnel and by technical providers supporting website operation, anti-spam protection, and email delivery, including Cloudflare and Mailjet. Technical providers process data according to their applicable terms of service, data processing agreements, and privacy notices, acting, depending on the case, as processors or independent controllers.

7. Transfers outside the EEA

Some technical providers may process data outside the European Economic Area. In such cases, transfers take place in compliance with the safeguards required by the GDPR, including adequacy decisions, standard contractual clauses, or other applicable mechanisms.

8. Retention

Data submitted through the contact form is retained for the time necessary to manage the request and, in any case, no longer than 24 months from the last contact, unless further retention is required to protect the controller's rights. Technical logs are retained for periods compatible with security, maintenance, and abuse prevention purposes.

9. Data subject rights

Data subjects may exercise, where applicable, their rights of access, rectification, erasure, restriction, objection, and data portability. They may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.