Information on the processing of personal data of visitors to the inarea.com website, provided under articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Version of 12 October 2026.
1. Data controller
Inarea Identity Design S.r.l.
Viale Andrea Doria 7, 20124 Milan, Italy
Tax and VAT no. 08225291007
Tel. +39 02 86454515 · info@inarea.com
The company has not appointed a Data Protection Officer, because none of the cases in which article 37 GDPR makes this mandatory applies. For any privacy request write to info@inarea.com.
2. What data we process, why and on what legal basis
| What | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Browsing | IP address, date and time, requested page, browser type, outcome of the request (server logs). | To run the site, protect it from abuse and attacks, detect faults. Basis: legitimate interest of the controller (art. 6.1.f GDPR). | Up to 60 days, then the logs are deleted. |
| Contact form | First name, surname, email address and the text of the message. | To answer the person who writes. Basis: the data subject’s request and pre-contractual measures (art. 6.1.b GDPR). | The message reaches the mailbox imaginarea@inarea.com by email and stays there for as long as needed to reply and to manage any relationship that follows; if none follows, no longer than 24 months after the last contact. |
| Newsletter | Email address. | To send the Inarea newsletter to those who subscribe through the form at the bottom of the page. Basis: consent (art. 6.1.a GDPR), which can be withdrawn at any time with the unsubscribe link included in every message. | Until the subscription is cancelled. |
| Visit statistics | Site usage data collected by Google Analytics 4: pages viewed, duration, origin, device type, a random identifier in cookies. Google Analytics 4 does not record the full IP address. | To understand how the site is used, in aggregate form. Basis: consent (art. 6.1.a GDPR and art. 122 of Italian Legislative Decree 196/2003), requested by the banner. Without consent no measurement starts. | Up to 14 months (maximum Analytics retention period); the cookies last up to 2 years. |
| Consent register | Date and time, the choice made (for each purpose), version of the policies, language, shortened IP address (the last digits are removed: /24 for IPv4, /48 for IPv6) and a random identifier, also stored in the ci_consenso_id cookie. We do not record name, email or the browser used. | To be able to show, if asked, that the choice was made and when (art. 7.1 GDPR, accountability under art. 5.2). Basis: legal obligation and legitimate interest (art. 6.1.c and 6.1.f GDPR). | 24 months from the choice, then the row is deleted automatically. |
The data requested in the forms are those shown in the fields. If a mandatory item is missing we cannot reply. The site is not aimed at minors and does not carry out profiling or decisions based solely on automated processing (art. 22 GDPR).
3. Cookies
The site uses technical cookies to remember the language and the consent choice, and Google Analytics cookies only after consent. The full list, with durations, is in the Cookie Policy. The choice can be changed at any time from “Cookie preferences” at the bottom of every page.
4. Who receives the data
The data are processed by authorised Inarea staff and, on Inarea’s behalf, by suppliers appointed as processors (art. 28 GDPR) or, when they act independently, controllers in their own right:
- Hetzner Online GmbH (Germany): servers hosting the site. The data stay in the European Union.
- Cloudflare, Inc. (United States, with a presence in the European Union): delivery and protection network for the site; it sees the visitor’s IP address in order to deliver and protect the pages.
- Google Ireland Limited / Google LLC: Google Analytics 4, only after consent.
- Intuit Inc. (Mailchimp) (United States): sending of the newsletter, only for those who subscribe.
- Vimeo, SoundCloud, YouTube (Google): only for the videos and audio embedded in some pages, and only if you click “Load content”. Until that click no data goes to these providers.
- The provider of the company email service, which delivers the messages sent through the contact form.
The data are not disclosed or sold. When a page opens the site does not load fonts, maps, videos or other content from third-party services and does not use social network buttons or widgets (embedded videos and audio load only after a click, as explained above): links to social profiles are plain links, which take you away from the site only if you click them.
5. Transfers outside the European Economic Area
Cloudflare, Google and Intuit may process data in the United States. The transfer relies on the safeguards these suppliers apply to European customers: adherence to the EU-US Data Privacy Framework where available, or the Standard Contractual Clauses approved by the European Commission. A copy of the safeguards can be requested at info@inarea.com.
6. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a machine-readable format, to object to processing based on legitimate interest and to withdraw consent at any time, without affecting the processing already carried out (arts. 15-22 GDPR). To exercise them write to info@inarea.com: we reply within one month.
If you believe the processing breaches the law you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it).
To withdraw or change your cookie consent use “Cookie preferences” at the bottom of every page. To have your row in the consent register deleted, state in the request the identifier found in the ci_consenso_id cookie of your browser: without it we cannot link a row to a person, because we do not keep names.
7. Changes
This notice may change. The date at the top shows the version in force: substantial changes are flagged on this page.