Privacy Policy

Data Controller

The controller responsible for personal data processed through this website is:

Name

STUDIO COSMOS DI DANILO RANIOLO

Legal form

Sole proprietorship (ditta individuale)

Seat

Calabria, Italy

Registered office

Via Giuseppe Garibaldi 321, 89044 Locri (RC), Italy

VAT number (P.IVA)

17535551000

REA registration

RC-221085

Certified email (PEC)

danilo.raniolo@pec.it

Email

info@cosmosagency.it

Data Protection Officer

None appointed. For privacy requests, write to the email above.

In this policy “Studio Cosmos” means the controller, STUDIO COSMOS DI DANILO RANIOLO. Technical providers are listed under “Recipients and processors”; each provider’s role for each service is stated where verified or marked for confirmation.

Data collected

The site has no account. It asks for personal details only when you send a project enquiry; the feedback prompt asks for none and the newsletter is not live.

• Your cookie choice. Stored in your own browser (local storage) so the site can respect it; it is not sent to us. See the Cookie Policy.
• The feedback prompt’s record. Your browser remembers that you answered or dismissed the prompt, and when it was last shown, so it is not repeated; it holds no identifier and is not sent to us.
• Your theme choice. Only if you allow preference storage: the Light, Dark or System theme you pick, stored in your own browser (local storage); it is not sent to us.
• The form’s anti-bot check. When you open “Start a project”, the form loads Cloudflare Turnstile, a service by Cloudflare, Inc. that tells a person from an automated program, usually without asking you anything. To do so Cloudflare receives from your browser your IP address, the browser you use (user agent), some technical characteristics of the connection (TLS) and the site’s identifier; Cloudflare states it cannot directly identify a person from these. The outcome is a code the form sends to our server with the enquiry: the server has Cloudflare confirm it and does not keep it. The code lasts a few minutes and is used once. The widget sets no cookie and stores nothing in your browser (see the Cookie Policy).
• Technical request data. Any server that delivers a web page receives technical data about the request, such as your IP address and browser. The site runs on a virtual server at IONOS (see “Recipients and processors”). The site’s application writes neither IP addresses nor what you enter in its forms to its own logs: it records technical messages only, such as its start-up and errors. The web server that passes requests to the site (a reverse proxy) keeps no access log for this site. Only when a request is interrupted or a technical error occurs can the shared web infrastructure exceptionally generate system-level technical events containing data such as your IP address (see “Retention”).
• Project enquiries. If you use “Start a project”, the form sends what you enter: your name, your email address and your project brief, and, if you give them, your company or brand, your website, the service you are interested in, a budget and one attached file. Of an attachment the site records its name, type and size; the file itself is kept privately on the studio’s server under a generated name, never in a public location. Studio Cosmos reads enquiries in the site’s private admin area and replies to you by email.
• Email with the studio. If you write to info@cosmosagency.it with a request, and when the studio replies to a project enquiry, the messages pass through the studio’s mailbox, provided by IONOS (see “Recipients and processors”): your email address, your name if you give it, the text and any attachments.
• Newsletter. The newsletter is not live: the form behind the Newsletter button at the end of the homepage accepts no subscription, and your email address is neither sent nor kept (see “Newsletter”).
• Site feedback. If you answer the feedback prompt, the site keeps your rating, an optional note, the page you were on, the theme you used (light or dark), your device class (phone, tablet or desktop) and when it was sent. It asks for no name or email address, and it is stored whatever your cookie choice because you send it on purpose, so please leave personal details out of the note.
• Usage counts (analytics). Only if you allow analytics: the page counts a few actions (a visit, opening an application or a project, changing the project view or filter, opening a footer folder, reaching the end of the page, opening Start a project) and sends them to the server that runs this site, which adds them to daily totals. No IP address, browser details, identifier or time finer than the day is stored with them.
• Google Analytics 4 (analytics). Only if you allow analytics, and never in the site’s private area: the site loads Google Analytics 4, a Google service, which sets in your browser the cookies described in the Cookie Policy, with a random identifier. Google receives the address and title of the pages you visit (without parameters, except a campaign’s, such as utm_source), the page you came from and a few actions: a project enquiry the server accepted and a click on the studio’s email. With these actions the site sends no names, email addresses, phone numbers or anything you type in a form. Like any web service, Google also receives technical data about your browser and device and your IP address, from which it derives an approximate location; Google states that Google Analytics 4 does not log or store IP addresses. Google signals, ad personalisation, granular location and device data collection and user-provided data collection are off.
• Request limits. To limit repeated or automated sending, the IP address a request comes from is held in the server’s memory, and never written to disk: until ten minutes after its last request for the enquiry form, feedback and the newsletter form (even though it takes no subscription today), until one minute after for usage counts. It is then cleared within ten seconds, and in any case when the server restarts. To ignore an enquiry sent twice, a one-way hash of its email address and brief is held in the same memory for ten minutes, and cleared the same way.

Purpose of processing

• To deliver the website and keep it secure and working.
• To remember your cookie choice, and your theme if you allow preference storage.
• To answer, by email, a project enquiry you send or a request you write to the studio.
• To read the feedback you choose to send, and improve the site with it.
• If you allow analytics, to learn from daily totals which parts of the site are used.
• If you allow analytics, to measure with Google Analytics 4 how the site is used: the pages visited, where visits come from and the actions described above.
• To protect the enquiry form, the feedback prompt, the newsletter form and the usage counts from repeated or automated sending.

Newsletter

The Studio Cosmos newsletter is not live: the form accepts no subscription and the site sends no email address to any email-marketing service. Before it goes live, this policy will be updated with the provider, the data processed, the legal basis and the retention periods.

Legal basis

Studio Cosmos processes personal data for the purposes above on the following bases (Art. 6 GDPR):

• Your consent (Art. 6(1)(a)), for what starts only once you have given it: usage counts and Google Analytics 4 (analytics) and remembering your theme, which you allow in the cookie settings. You can withdraw it at any time in “Cookie settings”.
• Steps taken at your request before a contract (Art. 6(1)(b)): answering a project enquiry you choose to send, with any attachment, and the requests you write to the studio by email.
• Studio Cosmos’s legitimate interest (Art. 6(1)(f)) in offering a working, secure site, protected from repeated or automated sending, and in improving it: delivering the site, with its technical data and request limits and the form’s anti-bot check (Cloudflare Turnstile), remembering your cookie choice and your answer to the feedback prompt, reading the feedback you send. You can object to this processing at any time by writing to info@cosmosagency.it.

Retention

Your cookie choice stays in your browser until you change it or clear your browser’s storage. Your theme choice stays there until you change it, withdraw preference storage (which deletes it) or clear your browser’s storage. The feedback prompt’s record stays there until you clear your browser’s storage.

Usage totals are kept by day and deleted after 180 days. IP addresses held for request limits stay only in the server’s memory and are cleared within ten seconds of their window ending: ten minutes after the last request, one for usage counts.

Google Analytics 4: its cookies stay in your browser for at most 13 months from your analytics consent, and are deleted if you withdraw it. In Google Analytics, event-level and user-level data is kept for 14 months, and the period does not restart with later visits; it is then deleted. Google says this setting does not limit standard aggregated reports.

Anti-bot check: our server does not keep the verification code. The technical data Cloudflare receives from your browser stays with Cloudflare, whose Turnstile notice does not say for how long it is kept.

Project enquiries and attachments: for commercial enquiries that do not become client relationships, the studio has selected a target of removing them from the website’s active systems within 90 days after the last relevant interaction. The admin can classify an enquiry, record that date, preview deletion and confirm removal of the record and its linked attachment. Review and removal are manual; there is no automatic deletion. Until the removal procedure is operating, the enquiry stays stored in the system. The current backup rotation keeps three monthly archives: a copy already archived may remain until that archive expires, and therefore beyond the 90-day target. The target applies to active systems and does not guarantee deletion from every backup within 90 days. Exceptions apply to data needed for client relationships, contracts, accounting duties, disputes or other legal requirements.

Site feedback: each record contains a rating, optional note, page, theme, device type and date. It is stored in the server’s private feedback.json file to help improve the site. An optional note may include information you choose to provide. The owner has selected a retention period of 30 days from collection for active storage. The authenticated admin provides collection-date review, legal holds, deletion preview and explicitly confirmed removal after expiry; review status does not restart the period. Legacy dates must be verified before deletion. Removal is manual, not automatic, and requires a verified independent suppression ledger; until the procedure is operating, the records stay stored in the system. The three monthly backups may retain older copies beyond 30 days until their archives expire; the target is not a guarantee of deletion from every recoverable copy within 30 days. Restored feedback must be reconciled against the separate deletion ledger before reopening the site; protected or ambiguous records stop reconciliation for review.

Emails exchanged with the studio: for enquiries that do not become a client relationship, the studio’s objective is to remove the messages from the mailbox within 90 days of the last relevant interaction, through a periodic manual review of received mail, sent mail and trash. There is no automatic deletion: copies may remain for the provider’s technical recovery period and, until they are removed, in an external mailbox that used to receive a copy of the messages (no longer). Exceptions apply to communications needed for client relationships, contracts, accounting duties, disputes or other legal requirements.

Studio Cosmos application logs: kept for a maximum of 30 days, then deleted automatically. The exceptional technical events of the shared web infrastructure (see “Technical request data”) are not covered by this period: they follow the technical retention of the server’s system logs, which is not limited to 30 days.

The periods given for enquiries, feedback and emails are objectives the studio applies to its active systems through manual reviews; backups follow the rotation described above.

Recipients and processors

The site loads a script from another company only if you allow analytics: Google Analytics 4, by Google (see “Data collected”). It embeds no third-party content. Usage counts, feedback and enquiries go to the server that runs this site; Google Analytics receives only what “Data collected” describes.

The providers and their contractual roles are listed below.

Hosting and email: IONOS SE, which provides the virtual server the site runs on and the mailbox (info@cosmosagency.it) through which the studio receives requests and replies. IONOS processes data on the controller’s behalf as a processor (Art. 28 GDPR) under its data processing agreement, part of the contractual terms of the IONOS services the studio uses: the server (VPS) and the mailbox (Mail Basic).

Anti-bot check: Cloudflare, Inc. (San Francisco, United States), which provides Cloudflare Turnstile. For the check it processes the data on the controller’s behalf as a processor, under its data processing agreement; according to its Turnstile notice it also uses the same technical data, as an independent controller, to improve its detection of automated programs — not to identify or profile people.

Analytics: Google Ireland Limited (Ireland) provides Google Analytics 4. For personal data processed on behalf of Studio Cosmos in providing the service, Google acts as a processor under the Google Ads Data Processing Terms, accepted on 8 October 2026. These terms also cover technical support and international transfers, with the safeguards set out in Appendix 3A.

International transfers

The IONOS server that runs the site is in a data center in Europe. For email, IONOS’s data processing agreement applies: processing takes place in a member state of the European Union or of the European Economic Area, unless a transfer to a third country is necessary to provide the service, in which case IONOS must ensure the legal requirements are met. For the anti-bot check, Cloudflare, Inc. is based in the United States: its data processing agreement provides for the European Commission’s standard contractual clauses, and Cloudflare states that it complies with the EU-U.S. Data Privacy Framework. If you allow analytics, Google may also process Google Analytics data outside the European Union. Transfers are governed by Google’s data processing terms, Appendix 3A: Google provides for transfer mechanisms recognised under applicable law and, in the cases specified by those terms, the European Commission’s standard contractual clauses.

Your rights

Where data-protection law such as the GDPR applies, you can ask the controller to:

• give you access to your personal data and a copy of it;
• correct data that is inaccurate or incomplete;
• erase your data, or restrict how it is used;
• transfer data you provided to another organisation (portability);
• stop processing based on legitimate interest (objection);
• withdraw a consent at any time, without affecting what happened before.

You may also complain to a supervisory authority: the Italian Garante per la protezione dei dati personali (garanteprivacy.it), or the supervisory authority of the EU country where you live or work, or where the alleged infringement took place.

Contact

For any question about this policy or your data, write to info@cosmosagency.it.

Updates to this policy

When this policy changes, the new version is published on this page with its date.