Privacy Notice and Cookies
1. Who is responsible
The data controller is Matteo Parmeggiani, private individual, who offers design work under the name Buying Designer, Via Fratelli Cervi, 14, 40129 Bologna BO, Italy. Email: support@buyingdesigner.com. We have not appointed a data protection officer.
2. What we collect, by source
- Contact form: name, email, company, country, your message, what you need, budget, timing, links, order number. If you are an Italian business ordering offline, we also need your company name and tax details to write the ricevuta.
- Order page: name, email, company, country, the project note, and a record of your consents (time, a hashed form of your IP address, terms version, package, option). We don’t collect a VAT number.
- Payment and receipts: Stripe gives us the name, email, billing details and payment status. We don’t receive your card number.
- Withdrawal form: name, email, order reference, time of your declaration and any note you add.
- Server logs: IP address, browser type, page requested, time.
- Spam protection: a timestamp and a hidden field on forms.
3. Why, and our legal basis
- Replying to you and preparing a quote: steps at your request before a contract (art. 6(1)(b) GDPR).
- Running your order and delivering the work: contract (art. 6(1)(b)).
- Receipts, tax and accounting records: legal obligation (art. 6(1)(c)).
- Security, spam prevention and defending legal claims: legitimate interest (art. 6(1)(f)).
We don’t use your data for marketing and we don’t send newsletters.
4. Who else sees it
- Payments: Stripe Payments Europe, Ltd. processes your payment. For some of this, Stripe acts as an independent controller under its own policy.
- Hosting: the company that hosts this website.
- Email: our email provider.
- Tax advice: an accountant, if we need one, sees the records needed for tax.
We’ll tell you the hosting and email providers’ names on request.
Where a provider processes data outside the European Economic Area, we rely on safeguards such as Standard Contractual Clauses or the EU–US Data Privacy Framework. We don’t sell your data.
5. How long we keep it
| What | How long |
|---|---|
| Contact messages and unconverted quotes | 12 months after the last contact |
| Orders, receipts (ricevute) | 10 years |
| Consent and withdrawal records | 10 years, with the order |
| Server logs | 30 days |
| Spam-protection data | 7 days |
| Project files | During the project and for 24 months after |
6. Your rights
You can ask to see your data, correct it, delete it, restrict its use, receive a copy, or object to how we use it. Write to support@buyingdesigner.com and we’ll reply within one month. Some data we have to keep by law, such as payment receipts. If you think we’ve handled your data wrongly, you can complain to the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).
7. Cookies
We don’t use analytics or advertising cookies and we don’t load third-party scripts. Our fonts are served from our own server. Anything needed just to make a form work is technical and doesn’t need your consent, which is why we don’t show a cookie banner. On Stripe’s payment page, Stripe sets its own cookies under its own policy.
8. Security
We keep access to your data limited, use HTTPS, and keep card data on Stripe. No system is perfectly safe, and if we find a breach that affects you, we’ll tell you as the law requires.
9. Children
This site is for businesses and adults. It isn’t aimed at anyone under 14 and we don’t knowingly collect their data.
10. Automated decisions
We don’t make decisions about you by automated means or profiling.
11. Changes
If we change this notice, we’ll update the date and version at the top.