PrivacyPolicy

Data controller

The controller of the personal data collected through this site is Hextern Digital Studio.

The services are provided by Diego Mezzo as a self-employed professional (libero professionista) trading under the Hextern Digital Studio brand. There is no company distinct from the controller as a natural person.

Controller

Mezzo Diego

VAT number

04161570124

Place of business

Gallarate (VA)

Email for privacy requests

info@hexternds.com

No Data Protection Officer has been appointed: the processing does not meet the conditions of Article 37 of the GDPR, the core activity being neither regular and systematic monitoring on a large scale nor large-scale processing of special categories of data.

Categories of data collected

We collect two kinds of data: what you give us deliberately by filling in a form or booking a call, and the technical data your browser necessarily transmits so that the page can be served.

We do not collect special categories of data (health, beliefs, trade-union membership) and never ask for them. We carry out no automated profiling and no automated decision-making producing legal effects on you.

Data you provide

The site has two forms. Neither collects hidden fields beyond the visible ones, apart from an anti-spam field that must stay empty and the campaign source described below.

Contact form

Name, email, company (optional), type of need, budget range, indicative timing, and the project description you write.

Network application

First and last name, email, location and time zone, specialism, skills, years of experience, links to a portfolio and professional profiles, availability, form of collaboration, indicative rate, and the free text you write.

Form data is transmitted to our application service and delivered to the studio by email. It is never sold, shared or used for purposes other than the one you submitted it for.

Technical and browsing data

Like any site reachable over the internet, the systems serving these pages record the data communication protocols transmit implicitly: IP address, browser and device type, operating system, date and time of the request, and the page requested.

This data serves to deliver the site, keep it secure and diagnose faults. It is not used to identify you and is not cross-referenced with anything else to build a profile.

Access and error logs are kept for 30 days; security and authentication logs for 90 days. After that they are deleted.

Campaign parameters and referral

If you arrive from an advertisement or a tracked link, the address may carry UTM parameters. We keep only the five standard ones (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the referring site, in the browser’s session storage, for the life of the tab.

They tell us which initiative produced an enquiry. They describe the campaign, not you: they contain no identifier, cannot be read by other sites, and are deleted when you close the tab. They travel once, with the form you deliberately submit.

Call booking (Cal.com)

The booking page shows a calendar provided by Cal.com, Inc., embedded within the page. When you book, the data you enter (name, email, any notes and the answers to the booking questions) is collected and processed by Cal.com as the scheduling provider, and made available to us so we can run the appointment. The calendar is also reachable directly at https://cal.com/hexternds/briefing-call.

Our site does not receive, read or forward the contents of a booking. In particular, no personal data entered into the calendar is sent to measurement or marketing tools: when a booking succeeds, the only thing recorded is that a booking happened.

Cal.com acts as a processor for the booking data. The cookies and storage the calendar sets on its own domain are listed, with the names and durations observed, in the Cookie Policy.

Usage measurement

If and only if you consent to the “Analytics” category, we use Google Analytics 4, possibly orchestrated through Google Tag Manager, to understand how many people visit the site, which pages they read and where they arrive from.

Before consent no measurement script is loaded and no request is sent to Google. We never transmit data that could identify you: the events we send carry only button identifiers, page paths, technical outcomes and campaign names.

Advertising measurement

If and only if you consent to the “Marketing” category, we use the pixel provided by Meta Platforms Ireland Ltd. to measure advertising results and attribute conversions correctly.

Before consent the pixel is not loaded. The pixel is delivered through Google Tag Manager: if you consent to the “Marketing” category alone, Google Tag Manager is therefore loaded as well, while Google Analytics 4 stays switched off. We do not enable advanced matching and never send Meta an email address, a telephone number or any other contact detail, in clear or hashed.

Limited to the collection of the event data and its transmission to Meta, the controller and Meta Platforms Ireland Limited act as joint controllers under Article 26 of the GDPR, under the arrangement Meta provides (the Controller Addendum). For processing that takes place after transmission, Meta acts as an independent controller. You can exercise your rights against both: against us at the contact details at the foot of this page, and against Meta under its own notice.

Purposes of processing

Answering enquiries

Reading your message, assessing it and replying, within the time stated on the contact page.

Managing bookings

Arranging, confirming and where necessary rescheduling the call.

Assessing applications

Reviewing profiles proposed to the Network and getting back in touch when a project calls for them.

Delivering and protecting the site

Keeping the service available, secure and working, and diagnosing faults.

Measuring usage

Understanding how the site is used in order to improve it. With your consent only.

Measuring campaigns

Checking the result of advertising activity. With your consent only.

Legal bases

Art. 6(1)(b) - pre-contractual steps

Commercial enquiries, call bookings and applications relating to a concrete collaboration: all carried out at your request, ahead of any relationship.

Art. 6(1)(c) - legal obligation

Where keeping or disclosing a piece of data is required by a legal obligation the controller is subject to.

Art. 6(1)(f) - legitimate interest

Security, abuse prevention and protection of the infrastructure: the controller’s legitimate interest in the security and integrity of its own systems, balanced against your rights.

Art. 6(1)(a) - consent

Measurement and marketing cookies and technologies, blocked in advance: nothing is loaded before consent. Freely given, specific, and withdrawable at any time.

How data is processed

Processing is carried out with electronic means, under organisational and technical measures proportionate to the risk. Access is limited to the people who need it for the purposes above.

We apply data minimisation: we collect only what the stated purpose requires, and the forms ask for the minimum needed to give you a useful answer.

Retention

Data is kept for as long as the purpose it was collected for requires, and afterwards for any period imposed by law.

Contact form enquiries

12 months from the last interaction.

Network applications

12 months from the application or its last update.

Booking records

12 months from the appointment.

Access and error logs

30 days.

Security and authentication logs

90 days.

Cookie preference

Six months from the choice, after which the consent request is shown again.

Campaign parameters

For the life of the browser tab only.

The application service that receives the forms stores nothing: it validates the content, forwards it once by email and discards it. Enquiry data therefore lives in the controller’s mailbox and booking data in the calendar service, and the periods above are applied in those systems.

Recipients and processors

Data is not disseminated. It may be processed on our behalf and on our instructions by the suppliers providing the technical services the site and the enquiries depend on.

Suppliers acting as processors handle the data only on our instructions and under an agreement pursuant to Article 28 of the GDPR. Meta is instead a joint controller for the collection and transmission of advertising event data alone, as explained in the section above.

Transfers outside the EU

The supplier table states each supplier’s country of establishment. For suppliers established in the European Economic Area, no transfer to a third country occurs as a result of their relationship with the controller.

For suppliers established outside the European Economic Area, a transfer is permitted only under one of the safeguards in Chapter V of the GDPR: an adequacy decision, or the standard contractual clauses adopted by the European Commission. Each supplier states in its own contractual documentation which instrument it relies on; the controller verifies the applicable instrument when the agreement is signed, and does not assert one here on the supplier’s behalf.

Security

The site is served exclusively over an encrypted connection. Forms are validated both in the browser and on the server, submissions are bounded in size and frequency, and no credential or application secret is present in the code the browser runs.

The contact and application forms are additionally protected by Cloudflare Turnstile, a bot-verification check that prevents automated and bulk submissions. It is a technical security measure, not a measurement or marketing tool: it stays active on every visit and is not subject to the consent you give in the cookie banner.

No measure can guarantee absolute security. Should a personal data breach occur that presents a high risk to your rights, you would be informed as required by Articles 33 and 34 of the GDPR.

Your rights

As a data subject you may exercise the rights in Articles 15-22 of the GDPR at any time.

• Access: know what data we process and obtain a copy.
• Rectification: correct inaccurate data or complete incomplete data.
• Erasure: have data deleted, in the cases provided for.
• Restriction: ask for processing to be suspended, in the cases provided for.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: without affecting processing already carried out.

To exercise them, write to info@hexternds.com. You also have the right to lodge a complaint with the Italian supervisory authority (www.garanteprivacy.it) or with the authority of the country where you live.

Withdrawing consent

Consent to measurement and marketing can be withdrawn at any time, in the same number of clicks it took to give. Withdrawal takes effect immediately for subsequent events and does not affect the lawfulness of processing carried out before it.

On withdrawal we delete the measurement and marketing cookies written on our own domain. Data already collected by the providers on their own systems must be requested from them directly, under their own notices.

Cookies

The complete list of storage technologies used, with name, provider, purpose and duration, is in the Cookie Policy, which forms an integral part of this notice.

Links to external services

The site links to sites and profiles run by third parties. Once you follow such a link, the processing of your data is governed by that site’s own notice, over which we have no control and for which we are not responsible.

Updates to this notice

This notice may be updated to reflect changes to the site, to the suppliers or to the law. The date of the last update is shown at the top of the page.

When a change materially affects the processing that depends on consent, the consent request is shown again: an earlier choice does not automatically extend to new or different processing.

Contact

For any question about this notice or about the processing of your data, write to info@hexternds.com.