Your data, treated with the same care as your project.

What data we collect

We only ask for information that helps us run the studio and deliver our services. Depending on how you interact with Virtese, we may process:

• Identity and contact info (name, email, company, phone) supplied through forms or email.
• Project details you share in a quote request or onboarding document.
• Technical data such as IP address, device/browser information and pages visited (anonymised analytics).
• Billing details required to issue invoices in compliance with Italian/EU law.

Why we use your data

Each processing activity has a clear, limited purpose:

• Replying to enquiries and preparing quotes.
• Delivering contracted services and support.
• Sending operational updates strictly related to ongoing work (no newsletters unless you explicitly subscribe).
• Improving security, performance and experience across virtese.com.
• Fulfilling legal obligations such as accounting and taxation.

Legal grounds & retention

We rely on consent when you submit a form, on contractual necessity when we work together, and on legitimate interest for basic analytics and security logs.

Data is stored for the shortest amount of time needed: contact requests for up to 12 months, client files for the duration of the collaboration plus the legal retention period (usually 10 years for accounting).

Sharing & processors

We do not sell your information. We may share it with trusted processors strictly necessary to run Virtese, such as hosting providers (Vercel), email services (Aruba), analytics tools or project management software. Each vendor is vetted, GDPR-compliant and bound by a data processing agreement.

Cookies & tracking

Virtese.com uses first-party cookies that keep the site secure and optional analytics cookies that help us understand aggregate usage.

You can control cookies directly in your browser settings and opt-out from analytics using the consent banner where available.

Security

Access to data is restricted to core team members, protected by authentication, encryption-at-rest (where provided by the vendor) and backups. We continuously review permissions and remove access when it is no longer needed.