Privacy policy.

Data controller

SUPERSTUDIO S.r.l., Via Portofino 2, 47838 Riccione (RN), Italy · VAT no. 04127680405 · info@superstudioitalia.com.

In Russia: ФИЛИАЛ ОБЩЕСТВА С ОГРАНИЧЕННОЙ ОТВЕТСТВЕННОСТЬЮ СУПЕРСТУДИО С. Р. Л., Г. МОСКВА (Moscow branch of SUPERSTUDIO S.r.l.; NZA 10220001517, INN 9909625768, KPP 774791001), 115114, Moscow, Derbenevskaya Embankment 11. The showroom at 5th Donskoy Proyezd, 17, Moscow, is where appointments take place.

Contacts

• For personal-data requests: privacy@superstudioitalia.com.
• Requests concerning processing under Russian law can be sent to the same address.

Data we collect

• «Submit your brand» form: company, website, contact person, email, phone, country, product categories, wholesale price range, markets served, export turnover (optional), message.
• «Book an appointment» form: store or company name, city and country, website or social profile, contact person, phone, email, brands of interest (including any other brand you name), season, appointment format and preferred date, message.
• When a form is sent: IP address and technical data about your browser and device, used by the site platform for security (section 4).
• Job applications: the data in the email and CV sent to hr@superstudioitalia.com (section 7).
• Browsing and statistics: see the Cookie Policy.

We do not request special categories of personal data: please do not include them in your message or CV.

Purposes and legal bases

• Replying to requests, assessing business proposals and arranging appointments:
  • if you write to us on behalf of a company (for example a brand, a store or a distributor): SUPERSTUDIO's legitimate interest in managing business contacts and negotiations with companies through their representatives (Art. 6(1)(f) GDPR). We use only the business contact details we need, and you can object at any time by writing to privacy@superstudioitalia.com;
  • if you write to us in a personal capacity, for example as a sole trader: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Assessing job applications: steps taken at the applicant's request before entering into a contract (Art. 6(1)(b) GDPR). For unsolicited CVs, consent is not required (Art. 111-bis of the Italian Personal Data Protection Code, Legislative Decree 196/2003).
• Site-usage statistics (Google Analytics 4, Yandex Metrica, Tilda platform statistics): consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from «Cookie preferences». These tools use browser identifiers.
• Site security and spam protection of the forms (anti-DDoS protection and, when a form is sent, Yandex SmartCaptcha): legitimate interest in protecting the site and the forms from attacks and automated submissions (Art. 6(1)(f) and Recital 49 GDPR).
• Keeping documents subject to statutory retention and proof of cookie consent: compliance with legal obligations (Art. 6(1)(c) and Art. 7(1) GDPR).
• We do not send marketing communications and do not take decisions based solely on automated processing.

Retention

• Form requests: kept in the restricted area of the platform that hosts the site (Tilda) for 30 days from submission, according to our account setting; when that period ends the platform deletes them from the restricted area. A copy is sent by email to the business mailboxes of the team handling them: in the mailboxes and other operational records, requests that lead nowhere are deleted within 15 months of closure (12 months after closure they enter the next quarterly review and are deleted after internal approval). Requests that lead to a business relationship are kept for the duration of that relationship; documents subject to retention obligations (for example accounting and tax records) are kept for the periods required by law (10 years for accounting records, invoices and business correspondence under Art. 2220 of the Italian Civil Code; for the Moscow branch, the periods set by Russian accounting law, at least 5 years). After deletion from the mailboxes, residual copies may remain for a limited time: in the mailbox trash for up to 30 days unless it is emptied earlier, and in the Google Workspace recovery function for a further period stated in the provider's documentation. The site platform provider may keep backup copies at its technical partners' facilities in Russia; we have no documented timings for such copies.
• CVs: only for as long as needed to assess and close the application, then deleted; we do not keep CVs for future openings.
• Google Analytics 4: detailed event-level data are kept for 2 months; user-level data linked to browser identifiers for 14 months, and this period restarts each time the same browser returns to the site. Aggregate reports are not subject to these periods. Cookie durations are stated separately in the Cookie Policy.
• Yandex Metrica: for as long as we use the service, plus the time needed for deletion, under Yandex's data processing agreement applicable to processing subject to the GDPR.
• Consent log (CookieYes): while we use the service, CookieYes keeps the records of the choices made for up to 5 years; we cannot change this period. When the service ends, CookieYes deletes the data within 60 days; backup copies may be kept for up to 1 year.

Recipients

• Authorised SUPERSTUDIO staff: only two members of management can access the request archive on the site platform; the mailboxes receiving the requests are accessible only to the same two members of management, each for the mailboxes within their remit.
• Providers processing data on our behalf or, where stated, as independent controllers:
  • Tilda (Tilda Publishing JSC, Petrovskie Linii 2, Moscow, Russia), which processes the data collected through the site on our behalf under its data processing agreement: site hosting, forms, storage of requests and platform statistics. To protect the forms it uses DDoS-Guard anti-DDoS protection and the Yandex SmartCaptcha service, which analyses technical data about the device and browser, activity and digital fingerprint (token, browser features, referrer, time zone).
  • Google: Google Analytics 4, only with consent: Google Ireland Limited, Dublin, Ireland, which processes the data as a processor under Google's data processing terms. In our Google Analytics account, the options to share data with Google to improve Google products and services, to build modelling and business insights, and for business recommendations are turned off. Only the option that lets Google technical support access the account and data, where needed, to solve technical issues remains on. Google Workspace (business mailboxes): Google Cloud Italy S.r.l., Via Federico Confalonieri 4, 20124 Milan, Italy, which processes the data contained in the Google Workspace services as a processor under Google's Cloud Data Processing Addendum.
  • Yandex: Yandex Metrica, only with consent: Air Smart Advertising Solutions FZ-LLC, Dubai, United Arab Emirates, which, under the service terms applicable to processing subject to the GDPR, processes the data as a processor under Yandex's data processing agreement.
  • CookieYes Limited (United Kingdom): consent management and consent log.
• Requests received through the site are handled internally by SUPERSTUDIO for direct contact: we do not forward them to brands, agents or external collaborators.
• Disclosures required by law: the data may be disclosed to public authorities where a legal obligation requires it.

Job applications

If you would like to work with us, you can send your CV and a short introduction to hr@superstudioitalia.com. We use these data only to assess your application, for an open position or, if there is no open position, as an unsolicited application, and, if there is mutual interest, to contact you. We do not keep CVs for future openings and we do not share them with recruitment agencies or external HR consultants. When the application is closed, the data are deleted within the periods stated in section 5.

Transfers outside the European Union

• The authorised persons also access the data from Russia.
• Some providers process data outside the EU:
  • Tilda: the data collected through the site are stored in databases located in the Russian Federation;
  • Google Workspace: the data may be processed in the countries where Google or its subprocessors maintain facilities;
  • Google Analytics 4: the data may be processed in the countries where Google or its subprocessors maintain facilities, including the United States;
  • Yandex Metrica: the data are processed outside the EU by the contracting company in the United Arab Emirates, including through Yandex group companies and data centres;
  • CookieYes: the company is based in the United Kingdom; according to CookieYes, the consent log is stored in Ireland, with backups in Malta.
• Safeguards:
  • Google (Google Analytics 4 and Google Workspace): the European Commission's standard contractual clauses and, for transfers to Google LLC in the United States, certification under the EU-US Data Privacy Framework, under Google's data processing agreements;
  • Yandex Metrica: the European Commission's standard contractual clauses provided for in Yandex's data processing agreement applicable to processing subject to the GDPR;
  • CookieYes: the European Commission's adequacy decision for the United Kingdom;
  • Tilda: none of the safeguards listed above. Tilda's terms of service do not provide for the European Commission's standard contractual clauses, and there is no Commission adequacy decision for the Russian Federation.

Russian personal data law

The processing may also be subject to Russian Federal Law No. 152-FZ of 27 July 2006 «On Personal Data», in particular for the activities of the Moscow branch and, for certain provisions, for data of citizens of the Russian Federation. For requests concerning this processing, you can write to privacy@superstudioitalia.com.

Your rights

You can request access, rectification, erasure, restriction, objection and portability, and withdraw consent at any time, by writing to privacy@superstudioitalia.com. Withdrawal does not affect the lawfulness of earlier processing. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

Cookies and changes

The use of cookies and analytics tools is described in the Cookie Policy; you can change your choice from «Cookie preferences» at the bottom of every page. Any update will be published on this page with the date of the last change.

Cookie Policy →