DRAFT — to be validated by a lawyer and an accountant before publication. Text in [brackets] is a placeholder.

Privacy policy

Last updated:

This policy explains how personal data collected through 9plus9.studio is processed, under Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”). Version 2026-09-28.

1. Data controller

9Plus9 S.r.l. is being incorporated. Until it is registered in the Italian Companies Register, the data controller is [NOME TITOLARE], domiciled at [INDIRIZZO], acting in their own name on behalf of the company being formed (Article 2331 of the Italian Civil Code).

Once the company is registered, the processing described here will continue with 9Plus9 S.r.l. as controller and we will update this page.

For any privacy request, write to privacy@9plus9.studio.

2. What data we process and why

a) Contact form

  • Data: name, email address and the text of your message.
  • Purpose: replying to your request.
  • Legal basis: steps taken at your request before a possible agreement (Art. 6(1)(b) GDPR) and our legitimate interest in answering the messages we receive (Art. 6(1)(f) GDPR).
  • Retention: up to [12 months] after our last exchange, unless the law requires longer.

b) Visit statistics

  • Data: technical browsing data (pages visited, referrer, device and browser type, loading performance) collected by Cloudflare Web Analytics in aggregate form, without cookies, without storing anything on your device and without fingerprinting.
  • Purpose: understanding in aggregate how the site is used, to improve it.
  • Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Retention: as set by Cloudflare: detailed data for 7 days, then aggregated only, for up to 6 months.

c) Security and technical logs

  • Data: IP address, user agent and request data, processed by Cloudflare to deliver the site, protect it from abuse (for example by limiting form submissions) and keep it secure.
  • Legal basis: legitimate interest in the security of the site and its services (Art. 6(1)(f) GDPR).
  • Retention: only as long as strictly necessary, as set by Cloudflare.

3. Do you have to provide your data?

No. Without your email and message we can’t reply to you.

4. Recipients and processors

Data is processed by the controller and, on its behalf, by providers acting as processors (Art. 28 GDPR):

  • Cloudflare, Inc. (USA): website hosting, content delivery, security, email forwarding and visit statistics.
  • [EMAIL MAILBOX PROVIDER, e.g. Google Ireland Ltd.]: the mailbox where we receive messages.

Data is never published or sold.

5. Transfers outside the European Union

Cloudflare, Inc. may process data in the United States. The transfer relies on Cloudflare’s certification under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, as a fallback, on the standard contractual clauses approved by the European Commission.

6. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Articles 15–22 GDPR), by writing to privacy@9plus9.studio.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), under Article 77 GDPR.

7. Automated decisions

We don’t carry out profiling or decisions based solely on automated processing.

8. Cookies

The site uses technical tools only: see the cookie policy for details.

9. Changes

We may update this policy; the version in force is always published on this page with its date.