Privacy policy.
Last updated: November 2026
This notice describes how the personal data of visitors to this site and of those who write to us through the forms are processed, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
Spring S.r.l.s., Via Dalmazia 17/B, 25126 Brescia (BS), VAT no. IT04676920988.
For any privacy request: info@spring.srl.
2. What data we process
- “Book a fitting” form: full name, email, phone (optional), look of interest, message text.
- “The atelier's list” form: full name, email.
- Direct contact: the data you give us by email, phone or WhatsApp.
- Browsing data: IP address, browser type, pages requested, date and time. They are recorded by the hosting provider to run and protect the site.
- Analytics data, only with your consent: pages viewed and actions on the site, collected with Google Analytics 4 through cookies. See the cookie policy.
We do not ask for or process special categories of data. Please do not include any in your messages.
3. Why we process them and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to requests and arranging the fitting at the atelier | Pre-contractual steps at the data subject's request (Art. 6(1)(b) GDPR) |
| Sending invitations to the presentations to those on the atelier's list | Consent (Art. 6(1)(a)), which can be withdrawn at any time |
| Running the site and keeping it secure | Legitimate interest of the controller (Art. 6(1)(f)) |
| Visit statistics | Consent (Art. 6(1)(a)), given and withdrawn from the cookie banner |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Providing data is optional, but without a name and an email we cannot reply to your request.
4. How long we keep them
- Fitting requests and contacts: 24 months from the last contact.
- The atelier's list: until consent is withdrawn or deletion is requested.
- Browsing data: for the technical period set by the hosting provider.
- Analytics data: 14 months in Google Analytics.
- Data linked to a purchase at the atelier: for the periods required by tax and civil law.
5. Who receives the data
Data are processed by the atelier's authorised staff and by the following providers, appointed as processors (Art. 28 GDPR):
| Provider | Service | Location |
|---|---|---|
| Vercel Inc. | Site hosting and the function that receives the forms | United States |
| Resend (Plus Five Five, Inc.) | Sending the atelier the emails generated by the forms | United States |
| Google Ireland Limited | Google Tag Manager and Google Analytics 4, only with consent | Ireland, with possible access by Google LLC (United States) |
If you choose to write to us on WhatsApp, the service is provided by WhatsApp Ireland Limited, which processes data as an independent controller under its own privacy notice.
Data are neither sold nor disclosed to the public.
6. Transfers outside the European Union
Some providers are based in the United States. Transfers rely on the European Commission's adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) for certified providers and, in any case, on the standard contractual clauses approved by the Commission (Art. 46 GDPR).
7. Your rights
At any time you can ask for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing (Articles 15–22 GDPR). You can withdraw consent without affecting processing already carried out. Just write to info@spring.srl: we reply within one month.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
8. Automated decisions
We do not use data for automated decision-making or profiling.