Privacy notice
D&F S.R.L. — updated on 2026-09-08
1. Who processes your data
The data controller is D&F S.R.L., registered office at Via Croce Rossa 82, 59100 Prato (PO), VAT number IT02662140975. For any request concerning personal data you can write to def26srl@pec.it.
2. What data we collect
This website collects the minimum it needs in order to work and to reply to you.
- What you type into the contact form: your name, email address, phone number if you give one, subject and the text of your message.
- The technical data every server records when you open a page: IP address, date and time, page requested, type of browser. It is used for security and for diagnosing faults.
- The record of your cookie choice, kept in your browser and never sent to us.
In the contact form we do not keep your IP address itself: we keep a cryptographic fingerprint of it, used only to count submissions and to stop automated ones. That fingerprint cannot be traced back to you.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry | Art. 6(1)(b) GDPR — pre-contractual steps taken at your request |
| Keeping the site secure and preventing abuse | Art. 6(1)(f) GDPR — legitimate interest in a service that works |
| Tax and statutory obligations, if you become a customer | Art. 6(1)(c) GDPR — legal obligation |
4. How long we keep it
Messages received through the contact form stay in our mailbox for 730 days (about 2 years), then they are deleted — unless the contact led to a contract, in which case the statutory periods apply, normally ten years.
Technical server logs are kept only for as long as security strictly requires, and in any case for no more than twelve months.
5. Who else sees it
Your data is neither sold nor passed on. It is processed on our behalf, by processors appointed under Art. 28 GDPR, only by the technical providers the site cannot run without:
| Provider | What it does | Data outside the EU |
|---|---|---|
| Cloudflare, Inc. | Website hosting and content delivery network | Yes (standard contractual clauses) |
| Resend, Inc. | Sending the contact form emails | Yes (standard contractual clauses) |
Where data leaves the European Economic Area, the transfer is covered by the standard contractual clauses approved by the European Commission.
6. Your rights
You can ask at any time to know what data we hold (access), to have it corrected or erased, to restrict its use, to receive it in a readable file, or to object to the processing: Articles 15 to 22 GDPR. Just write to def26srl@pec.it; we reply within one month.
If you believe the processing breaks the law, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the supervisory authority of the country where you live.
7. Changes
This notice was last updated on 2026-09-08. If the way we handle data changes, we update it here — and where consent is required, we ask you again.