Privacy Policy.

Data controller

The data controller is De Rose Nicoletta (Nicoletta De Rose), Italian VAT number IT18747131003, operating as NDR Studio — Venture Architecture. Business address: Via Giovanni Pacini, 00198 Roma (RM), Italy. For privacy enquiries, write to info@ndrstrategy.com.

Data we process

• Contact and professional details entered in the form: name, role, email, company and website.
• Information contained in your message or Opportunity Fit Brief, including the decision to prepare, available assets, scope and timing.
• Technical data required for the operation and security of the website, such as IP address, browser type, date and time of the request and server logs.
• Technical language and theme preferences stored in your browser. These are described in the Cookie Policy.

Purposes and legal bases

• To assess your enquiry, reply and, where relevant, take pre-contractual steps at your request: Article 6(1)(b) GDPR.
• To protect the security, integrity and correct operation of the website: the controller’s legitimate interest, Article 6(1)(f) GDPR.
• To comply with applicable legal obligations: Article 6(1)(c) GDPR.

Providing data and how it is handled

Fields marked as required are needed to assess and manage the enquiry. Without them, it will not be possible to reply through the form. Data is handled through digital tools with measures appropriate to the nature of the information received.

Providers and recipients

Data may be processed by technical providers required to operate the website and email service, acting as processors or independent controllers according to the service provided. The form may use Resend to deliver enquiries by email. The website also loads font resources from Google Fonts, so the browser may transmit technical connection data to Google.

Data is not sold and is not used for behavioural advertising or profiling.

Transfers outside the European Economic Area

Some technical providers may process data in countries outside the European Economic Area. Where this occurs, the transfer relies on safeguards available under the GDPR, such as adequacy decisions or standard contractual clauses, according to the relevant provider’s terms.

Retention

Enquiries and related correspondence are retained for the time required to assess and answer them, normally no longer than twelve months, unless an engagement begins or legal obligations require a different period. Technical logs are retained according to the hosting service’s security settings.

Your rights

You may request access, rectification, erasure, restriction, objection and, where applicable, data portability. You may also lodge a complaint with the Italian Data Protection Authority. To exercise your rights, write to info@ndrstrategy.com.

Automated decision-making

The website does not make decisions based solely on automated processing and does not profile visitors.