GDPR COMPLIANCE & LEGAL TRANSPARENCY

Privacy & Cookie Policy

Last Updated: July 2026

This Privacy & Cookie Policy describes how Marco De Masi (“Data Controller”, “Studio”, “we”, “us”) collects, processes, and safeguards personal information collected through marcodemasi.com (“Website”).

Operating as a strategic industrial design consultancy partnering with manufacturing brands globally, we manage all client and visitor data under the highest standards of data security, in strict accordance with the EU General Data Protection Regulation (GDPR — Regulation EU 2016/679) and European privacy directives.

01. Data Controller

Data Controller: Marco De Masi (Marco De Masi Studio)
VAT Identification / P.IVA: IT 11456911004
Registered Studio Location: Rome, Italy (Serving worldwide manufacturing clients)
Direct Data Protection & Inquiries: hello@marcodemasi.com

02. Categories of Personal Data Collected

A. Voluntarily Provided Information

Project Inquiries (Forminator Form): Full name, professional corporate email, company name, project category, estimated budget range, and technical brief descriptions.
Strategy Session Bookings (Calendly): Full name, email, and scheduled discussion points.
Direct Email Correspondence: Sender address, contact metadata, and message contents sent to studio inboxes.

B. Automatically Collected Telemetry

Server Access Logs: Masked IP address, browser type, operating system, visit timestamp, referring domain, and loaded resource pages.
Cookies & Identifiers: Strictly necessary session tokens, statistical performance cookies (Google Analytics 4 with IP anonymization), and marketing cookies (HubSpot) subject to prior user consent.

03. Legal Grounds and Processing Purposes

1. Proposals & Contracts

Evaluating industrial design briefs, providing feasibility assessments, drafting proposals, and executing design agreements.

Legal Basis: Performance of pre-contractual measures or contract execution (Art. 6(1)(b) GDPR).

2. Aggregate Analytics

Measuring site performance, user navigation flow, and portfolio engagement using Google Analytics 4 (GA4) with masked IP addresses.

Legal Basis: Explicit opt-in user consent (Art. 6(1)(a) GDPR) via Cookiebot.

3. B2B Commercial Outreach

Monitoring engagement with industrial design case studies and B2B proposals via HubSpot to refine commercial relationships.

Legal Basis: Explicit opt-in user consent (Art. 6(1)(a) GDPR) via Cookiebot.

04. Data Retention Schedule

Personal data is retained only for the duration necessary to satisfy the specific purposes outlined above:

Client & Project Correspondence: Stored throughout active project negotiations. Executed design contracts, invoices, and accounting records are preserved for 10 years in compliance with Italian statutory tax and legal obligations.
Aggregated GA4 Telemetry: Automatically deleted after 14 months from the date of logging.
HubSpot Marketing Data: Retained until consent revocation, or up to 24 months following last confirmed commercial communication.

05. Data Processors and International Transfers

We do not trade, sell, or disclose personal information to external commercial entities. Technical data access is restricted to vetted Data Processors providing specialized infrastructure:

Hosting Infrastructure: SiteGround Spain S.L. (EU data centers).
Consultation Bookings: Calendly, LLC (EU-US Data Privacy Framework certified).
Analytics Services: Google LLC (Google Analytics 4, masked IP addresses).
CRM & Marketing Telemetry: HubSpot, Inc. (EU-US DPF / Standard Contractual Clauses).

For processors situated in third countries (e.g. United States), transfers operate under the EU-U.S. Data Privacy Framework (DPF) adequacy decision or European Commission-approved Standard Contractual Clauses (SCC) with technical safeguards.

06. Your Data Subject Rights (GDPR Articles 15–22)

Under the European GDPR, you are entitled to enforce the following rights at any time without fees:

Right of Access (Art. 15): Request verification and obtain copies of personal data processed.
Right to Rectification (Art. 16): Correct inaccurate or out-of-date records.
Right to Erasure (Art. 17): Request deletion of your records (“Right to be Forgotten”).
Right to Restriction of Processing (Art. 18): Restrict specific data processing operations.
Right to Data Portability (Art. 20): Receive your records in an interoperable structured format.
Right to Object & Revoke (Art. 21): Withdraw previously granted consent without penalty.

07. Detailed Cookie Policy

Cookies are small data files deposited on your browser to support site operation, evaluate page responsiveness, and monitor marketing effectiveness. Consent is governed via the Cookiebot banner:

Strictly Necessary Cookies: Core technical session maintenance and security. Always active; exempt from consent requirements under ePrivacy guidelines.
Statistical Performance Cookies: Google Analytics 4 (GA4) metrics regarding aggregate visitor traffic, session duration, and page interactions. Activated exclusively upon explicit consent.
Marketing & Lead Telemetry: HubSpot engagement markers for proposal and marketing measurement. Activated exclusively upon explicit consent.

Consent Revocation: You can modify or withdraw consent at any moment by clicking the Cookiebot shield icon in the lower-left corner of any page.

Browser Controls: Alternatively, manage cookie permissions directly in your browser:

Industrial Project Confidentiality & Non-Disclosure (NDA)

Every preliminary brief, CAD assembly model, technical manufacturing constraint, or strategic product specification submitted to Marco De Masi Studio is held under rigorous professional secrecy.

Before disclosing sensitive manufacturing data, tooling parameters, or patent-pending mechanisms, we routinely execute bilateral Non-Disclosure Agreements (NDA). Contact the studio directly to request an NDA execution: hello@marcodemasi.com.