Privacy Policy
Last updated: 29 October 2026
This notice explains how personal data are processed when you visit www.andreacresci.com or contact Andrea Cresci through this website, in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller and contact details
Andrea Cresci — Wayout Studios S.a.s di Andrea Cresci.
Registered office: Via del Chiesino, 1, Florence, Italy.
Studio: Via Fra’ Domenico Buonvicini, 48, 50132 Florence, Italy.
VAT number: IT05850320481.
Email for enquiries and privacy requests: info@andreacresci.com.
Telephone: +39 055 500 2200.
2. Data we process and why
Contact enquiries. The contact form collects your first name, last name, email address, optional website and message, together with acknowledgement of this notice. These data are used to answer enquiries, prepare quotations and take steps at your request before entering into a contract (Article 6(1)(b) GDPR). For general correspondence unrelated to a prospective contract, processing is based on the legitimate interest in responding to communications (Article 6(1)(f)). An automatic email confirms receipt of your enquiry.
Website operation and security. Technical information such as IP address, request time, requested resources, browser information and server error records may be processed to deliver the website, investigate faults and prevent abuse, on the basis of the legitimate interest in operating and protecting the service (Article 6(1)(f)).
Optional analytics and external fonts. Google Analytics 4 measures visits and interactions only when the relevant consent is enabled. External Google Fonts are subject to a separate preference. The legal basis for these optional services is your consent (Article 6(1)(a)). See the Cookie Policy for details and controls.
Legal obligations and claims. Where an enquiry leads to a professional engagement, relevant records may also be processed to perform the contract, meet accounting or other legal obligations, and establish or defend legal claims (Articles 6(1)(b), 6(1)(c) and 6(1)(f), as applicable).
3. Contact form protection: Google reCAPTCHA
The contact form uses Google reCAPTCHA to distinguish genuine submissions from automated abuse. The service can process IP address, browser and device information, interactions and cookies in connection with its security assessment. This processing supports the legitimate interest in protecting the form against spam and misuse. Google services are provided in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Please read Google’s Privacy Policy and Terms of Service. You can also contact us directly by email.
4. Providing your data
Fields marked as required are needed to handle a form submission; without them the form cannot be sent. Providing an optional website is voluntary. Please do not include sensitive personal data or information about third parties that is unnecessary for your enquiry. Acknowledging this notice is separate from optional cookie consent and does not subscribe you to marketing communications.
5. Who receives the data
Data may be accessed by authorised personnel and by service providers responsible for hosting, email delivery, website maintenance and security, within the limits of their roles. The website uses Aruba hosting services. Google receives information in connection with the Google services described above. Providers act as processors or independent controllers according to the service and applicable terms. Data may also be disclosed to competent authorities where required by law. Contact enquiries are not published on the website.
6. International transfers
Google services may involve processing outside the European Economic Area. Where a transfer occurs, the applicable mechanism must be an adequacy decision, including the EU–US Data Privacy Framework for participating certified organisations where applicable, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Information about Google’s transfer mechanisms is available at Google’s data transfer frameworks. You may contact the controller for information about safeguards relevant to your data.
7. Retention
Enquiries and correspondence are retained for the time needed to handle the request and related follow-up; longer retention applies only where necessary for an ongoing professional relationship, legal obligations or the protection of legal claims. Technical records are retained only for operational and security needs. Consent records are retained for the time necessary to demonstrate and manage the choices made. Optional cookie lifetimes are described in the Cookie Policy; third-party retention is also governed by the provider’s applicable settings and policies.
8. Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction and portability of your personal data, and object to processing based on legitimate interests. You may withdraw optional consent at any time through Privacy Preferences; withdrawal does not affect the lawfulness of processing before withdrawal. Send other requests to info@andreacresci.com. You may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or another competent supervisory authority.
9. External links and updates
Links to Instagram, LinkedIn, Facebook and partner websites take you to independent services governed by their own privacy notices. A plain link does not itself load an embedded social feed. This notice may be updated when website features or processing activities change.