Draft under review · Effective from [publication date]

Privacy Policy

How we process the personal data of people who visit styleadvisor.it or contact us, under EU Regulation 2016/679 (GDPR).

Controller

Lucrezia Grasso, self-employed professional, Italian VAT no. 10788610961, Via Mecenate, Milan, Italy. THE KIT — Style Advisor is the trading name of the business, not a company. Contact: lucreziagrassostylist@gmail.com.

Data we process

Email: name, address and the content of messages you send us.

Request Your Experience form: sends name, email, dates, guest count and optional shopping budget and interests to the site for delivery to Lucrezia through Lovable Emails. The app keeps no stored copy and does not write these details to its logs. Sending requires a verified sender; failures show an error, not a receipt confirmation.

Style Call: booking takes place in the Calendly calendar embedded on the Book page. The calendar is not loaded when the page opens, only after you explicitly click “View calendar”; from then on Calendly collects the details you enter (name, email, any answers).

Browsing: your browser stores your chosen language and page scroll position (local storage, no site cookies). The hosting provider processes technical data such as your IP address and records aggregated visit statistics.

Purposes and legal basis

Replying to requests and providing the service: pre-contractual steps and contract (Art. 6(1)(b)). Tax and accounting duties: legal obligation (Art. 6(1)(c)). Site security and operation: legitimate interest (Art. 6(1)(f)). No marketing or profiling.

Providing data is optional, but without it we cannot reply.

Recipients

Lovable Emails (request delivery): [TO CONFIRM: delivery providers, retention and transfer safeguards for the email service]. Google: [TO CONFIRM: free personal Gmail account (not Google Workspace, so no data processing agreement is in place); check the applicable terms and transfers with an adviser]; Calendly LLC (bookings), whose calendar also uses its own services such as Stripe, Google reCAPTCHA and OneTrust; Lovable and Cloudflare (site hosting and statistics) [TO CONFIRM: legal name of the hosting provider]. The technical providers listed above process data only to deliver their services. Lucrezia Grasso personally manages her clients’ data: she does not routinely share names, email addresses, bookings or consultation details with an accountant or collaborators. Communications to third parties required by law remain possible. Data is never sold or disclosed publicly.

Transfers outside the EEA

Calendly LLC (US) participates in the EU-US Data Privacy Framework. Google (free Gmail) and Cloudflare may process data in the US [TO CONFIRM: Data Privacy Framework participation or Standard Contractual Clauses to be checked][PROPOSAL TO APPROVE: during the check, consider whether an email domain with appropriate contractual terms is preferable to a free Gmail account].

Retention

[PROPOSAL TO APPROVE: Contact requests not converted: 12 months from last contact. Documentation of consultations and related exchanges with no tax obligation: 24 months from their conclusion, unless there is a documented need to protect rights. Calendly bookings not followed by a consultation: 12 months after the appointment. Accounting and tax records: 10 years where required by law.] Questionnaires, photos and data about personal characteristics are kept to a minimum and deleted when no longer needed; they are not automatically classed as special categories under the GDPR. These periods only hold if backed by an actual deletion procedure, not just this statement: [TO CONFIRM: Google and Calendly may have their own retention periods, to be checked]. The periods are an operational proposal to apply and verify, with no guarantee of legal compliance.

Your rights

You can request access, rectification, erasure, restriction, portability and object to processing (Arts. 15–22) by writing to lucreziagrassostylist@gmail.com. You can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or your local EU authority.

The site sets no profiling cookies of its own. The hosting provider may set a technical security cookie (Cloudflare). Fonts are served directly by the site, with no requests to Google Fonts. The Calendly calendar loads only after you click “View calendar”: from then on Calendly and its linked providers (for example Stripe, Google reCAPTCHA and OneTrust) may load services and set their own cookies, including security and anti-fraud ones. You can also book by opening the calendar in a new tab, directly on Calendly’s site. [TO CONFIRM: legal assessment of whether consent is needed for the calendar cookies]