01 · WHO LOOKS AFTER THE JOURNEY
Data controller and contact details.
The data controller is VINCI & CO. SRL, a single-member company, which manages the Quadri su Commissione brand, VAT and Tax ID 02828360038, with its registered office at Viale Leonardo da Vinci 3, Galliate, Novara. For information on processing and to exercise your rights, you can write to info@quadrisucommissione.it.
This notice covers the “A window into you” questionnaire, the written report of your answers, related statistics and requests for a meeting with Alessandro. Communications you choose to send by email or other channels are also subject to the terms and privacy notices of the respective services.
02 · SEPARATE PURPOSES
The service and optional choices.
Collecting your story for an artistic conversation
At the beginning of the journey, you provide your name and the city or municipality where you live, without a precise address. We process these details, the answers you choose to provide and any practical details to prepare a report faithful to the questionnaire and manage your conversation with the studio. Before submitting, you confirm your name and add the required email address and mobile number; the additional message is optional. Your contact details allow Alessandro to contact you about your request. If you request a call, we process the request and any availability you choose to provide. This processing relates to the service and pre-contractual activities you request, under Article 6(1)(b) of the GDPR.
The artistic questions are optional: you can skip them, change them and stop the journey. Your name and city or municipality are required to confirm the journey; we do not ask for a street, house number or other precise address details. To submit a useful report, at least one artistic answer is required, together with your name, email address and mobile number. Without these details, submission cannot proceed; the message remains optional. We do not ask for health information, beliefs or other special-category data, or details identifying other people: please avoid including them in your stories.
Internal artistic statistics · optional consent
Only with your specific choice do we analyse structured options, colours and artistic preferences, questionnaire steps, completions and report submissions. The purpose is to understand the tastes expressed and improve the journey. The legal basis is your consent, Article 6(1)(a) of the GDPR.
The data is linked to a pseudonymous session identifier: it is not automatically anonymous. The dashboard and standard exports show aggregated data and limit the visibility of small samples. They do not include your name, city or municipality of residence, stories, reports, call availability or contact details. A free-text field can contribute only to the count of questions answered, without exposing its content.
Google Analytics 4 · separate consent
GA4 is loaded only if configured and if you allow it. It measures events such as starting, viewing questions, progress, completion, report submission and steps relating to call requests. The permitted parameters are journey codes and controlled categories: we do not send free-text answers, reports, names, cities or municipalities, email addresses, mobile numbers or personal identifiers. Advertising features are not enabled by this integration.
GA4 measurements and internal measurements are separate systems and may have different coverage and update times. Retention in Google’s systems depends on the property configuration and the terms applicable to the service. You can ask the data controller about the active configuration.
Resuming your draft · an independent choice
You can separately allow persistent resumption on this device. The technical cookie art_session identifies the journey and protects access to your answers; it does not contain your story. Without this choice, the cookie is a session cookie, while the server retains operational data for the periods described below. Anyone using the same browser could access the draft: use a personal device and delete it when you no longer need it.
You can refuse all optional purposes and continue to use the service. No marketing consent is collected: the questionnaire, report submission and call request do not authorise newsletters or promotional communications. Security and abuse-prevention measures involve limited, temporary technical checks, separate from commercial statistics.
03 · FROM ANSWERS TO CONVERSATION
The report reaches the studio.
The report organises the questions and answers you have chosen to share, the selected options, your name, city or municipality, any practical details and contact information. It is not interpreted to produce a psychological profile or automatically generate an artwork. Your answers are not sent to third-party artificial intelligence services. The conversation and artistic proposals remain Alessandro’s responsibility.
When you submit the report, the system records it in the studio’s private area and shows a reference with the date received. If email delivery is configured and the service accepts the message, the report is also sent to Alessandro through that service; the confirmation distinguishes acceptance of the email, a queued email and storage in the archive only. Acceptance by the service does not certify delivery to an inbox or that the email has been read. Receipt in the archive does not automatically mean an email has been delivered. You can download a text copy of the report.
A call is a subsequent, optional choice. If a booking-service link is available, you can choose to open it and follow that service’s terms. Otherwise, a request linked to the report is recorded: the studio reads your availability and message, and the appointment still needs to be agreed and confirmed. Submitting the questionnaire alone does not automatically book a time.
The site uses Sites and Cloudflare infrastructure for hosting and storage, the email service configured by the data controller for any report deliveries and, only if configured and authorised, Google for GA4. Administrative access is limited to people authorised by the data controller. Your name and city or municipality collected at the beginning, answers, contact details and report content are protected in the operational archive with application-level encryption; access to the journey is controlled.
Infrastructure, email or booking providers may also process data outside the European Economic Area under the terms and safeguards applicable to their respective services. To find out which email or booking provider is actually configured, and the relevant agreements, locations and safeguards, contact the data controller. You can consult the information provided by Cloudflare and Google. Processing exclusively within Europe is not promised.
04 · RETENTION AND CONTROL
How long the data is kept.
Access and administrative-operation logs are retained for up to 90 days; abuse-prevention counters have shorter technical retention periods. The service archive’s retention periods do not automatically determine those applicable to emails already delivered, providers’ systems, their security logs or any subsequent contractual documents.
Once the period expires, the journey is no longer accessible using its cookie. Internal archives are cleaned during requests to the service: deletion is not guaranteed at the exact second and, when there is no traffic, physical removal may happen later. The periods above describe the function’s operational rules, not a legally imposed period for every processing activity.
You can change your mind.
Within the journey, open “Your privacy choices” to change or withdraw each consent separately. Withdrawing consent for internal statistics deletes the related analytical data from the database; withdrawing consent for GA4 blocks new transmissions and attempts to remove analytics cookies accessible to this site. Withdrawal does not automatically delete data already received by Google’s systems or copies already exported by the company: you can ask the data controller to manage them.
The “Delete this journey” command requires confirmation and deletes answers, reports and linked call requests from the service. It cannot recall emails already delivered or copies already downloaded. To manage those copies too, when you no longer have access to the device or the cookie has expired, write to the data controller. Include the report reference, if available; avoid attaching identity documents unless requested for a proportionate verification.
05 · YOU REMAIN AT THE CENTRE
Your rights and requests.
Where provided for by the GDPR, you can request access, rectification, erasure, restriction and portability, and object to processing where applicable. You can withdraw consent without affecting the lawfulness of processing based on it before withdrawal. To exercise your rights, write to info@quadrisucommissione.it; the data controller may request only the information strictly necessary to verify your request.
You can lodge a complaint with the Italian Data Protection Authority. The applicable rights and principles are described in the text of the European General Data Protection Regulation.
This page describes how the journey works in the stated version. New services or purposes will require an updated notice and, where necessary, a new choice. Artistic decisions and your relationship with the studio remain entrusted to personal conversation with Alessandro Vinci.