Skip to content
FMB Design
IT

Privacy policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
Last updated: 7 August 2026.

Data controller

FMB Design di Francesca Buono
Varese (VA), Italy
Email: info@fmbdesign.it
Phone: +39 340 1838063

No Data Protection Officer has been appointed: none of the cases listed in Article 37 GDPR applies.

1. What we collect

1.1 Data you send us

The site has two forms. Neither asks for more than what is needed to reply to you.

  • Contact form (on the home page and the About page): name, email address and the text of your message.
  • Avatar Studio form: name, email address, optional notes on style, the delivery speed you pick and the photograph you upload. A photograph is personal data — it usually portrays you or someone you know — and we treat it as such.

If the photograph portrays someone other than you, making sure they agree is up to you: we only receive it because you send it.

1.2 Data collected automatically

  • Web server logs. Like any website, the server records IP address, date and time, requested page, outcome and browser type. They keep the site running and protect it from abuse; they are kept briefly and are not used to identify anyone.
  • Visit statistics. We use Liwan, a counter installed on a server of ours inside the European Union. It uses no cookies and leaves nothing on your device: it records the page viewed, the site you came from and any campaign parameters (utm_*). To tell same-day visits apart it computes a value derived from your IP address and browser through a hash function with a rotating element: it cannot be reversed, it changes every day, and it does not let us recognise you either today or tomorrow.
  • Where the request came from. When you land on the site we keep, in your browser's temporary storage (see the Cookie policy), the moment you arrived, the site you came from, and two true/false flags telling whether the click came from a Google Ads or a Meta advertisement. We do not keep the advertising click identifier (gclid, fbclid and the like), even though it is handed to us: we care whether a campaign brings in enquiries, not who you are. This information is attached to a request only if and when you choose to send one; otherwise it disappears when you close the tab.

1.3 What we do not do

  • No profiling, no automated decision-making.
  • No cookies, first- or third-party. No advertising pixels.
  • No selling or sharing of data with third parties for marketing purposes.
  • The site's typefaces are served from our own domain: your browser never contacts Google Fonts or any external content delivery network.

2. Why we process it, and on what legal basis

  • To answer your enquiry and, if it turns into a commission, to carry out the work — including producing the avatar from your photograph.
    Legal basis: pre-contractual and contractual measures taken at your request (Art. 6(1)(b) GDPR).
  • To protect the forms from automated submissions.
    Legal basis: legitimate interest in not receiving spam and keeping the service usable (Art. 6(1)(f)).
  • To understand where enquiries come from and whether advertising campaigns pay off, in aggregate form and without advertising identifiers.
    Legal basis: legitimate interest in measuring the effectiveness of one's own promotion (Art. 6(1)(f)). You may object at any time by writing to info@fmbdesign.it.
  • To comply with legal obligations, tax and accounting, once an enquiry becomes a commission.
    Legal basis: legal obligation (Art. 6(1)(c)).

Providing your data is optional, but without a name, an email address and — for Avatar Studio — a photograph there is no practical way to reply or to do the work.

3. How a request travels

Worth spelling out, because this is where data leaves the site.

  1. The form sends the data to the server hosting the site, inside the European Union, run by Marco Chiodo as a data processor (privacy policy). Nothing is stored here: the data passes through and that is all.
  2. The request is delivered by email to the FMB Design mailbox, through the domain's email provider.
  3. The same request is forwarded to a private Telegram channel, so that it arrives immediately: it is the channel Francesca works with every day.
  4. The photograph uploaded to Avatar Studio is never written to the server's disk: it stays in temporary memory for as long as it takes to attach it to the email and upload it to the Telegram channel, then the system deletes it by itself. From that moment on it exists as an attachment in the mailbox and in the Telegram channel.

4. Who we share data with

  • Infrastructure provider (hosting and form transmission): Marco Chiodo, with servers inside the European Union, appointed data processor under Article 28 GDPR.
  • Email provider for the fmbdesign.it domain, for delivering and storing email.
  • Telegram FZ-LLC, for delivering the notification to the private channel. Telegram is based in the United Arab Emirates, a country for which the European Commission has issued no adequacy decision: the transfer covers only the data contained in your request and is necessary in order to act on it at your request (Art. 49(1)(b) GDPR). If you would rather your request did not pass through Telegram, write to us directly at info@fmbdesign.it: email is a fully equivalent channel.
  • Advisers and professionals (accountant, lawyer where needed) once an enquiry becomes a commission, within the limits of legal obligations.

Data is never disseminated and is not shared with anyone else.

5. How long we keep it

  • Enquiries with no follow-up: the email and the Telegram message are kept for as long as it is useful to assess a later contact, and in any case no longer than 24 months.
  • Enquiries that become work: for the duration of the relationship and then for the statutory periods — ten years for tax and accounting records.
  • Avatar Studio photographs: kept for the duration of the work and for any revision period; at your request we delete them earlier, from both the mailbox and the Telegram channel.
  • Server logs: a few days, unless needed to document abuse.
  • Visit statistics: kept in aggregate form, with no data relating to you.
  • Landing data in the browser: until you close the tab.

6. Your rights

You may ask us at any time to give you access to your data, to correct it, to erase it, to restrict its processing, to receive it in a machine-readable format (portability) and to object to processing based on legitimate interest (Arts. 15-22 GDPR).

Write to info@fmbdesign.it: we reply within one month. If you believe the processing infringes the Regulation you may lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or with the supervisory authority of the country where you live.

7. Security

The site is reachable over HTTPS only. The forms are protected by an anti-bot check that asks you to solve no puzzles and involves no third-party service. Requests are validated on the server as well: size and actual type of the photograph, field lengths, validity of the email address.

8. Changes

If the way we handle data changes, we update this page and change the date at the top. Earlier versions are available on request.