ML Strategy Studio
Privacy notice
PERSONAL DATA PROCESSING NOTICE
Personal data processing notice pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
LAST UPDATED: 15 October 2026
PRIVACY CONTACT: info@mlstrategystudio.com
This Privacy Policy describes how ML Strategy Studio collects and processes the personal data of users who visit www.mlstrategystudio.com, complete the website's contact form or submit their details through contact forms used in advertising campaigns on Facebook and Instagram.
This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR").
1. Joint controllers
For data collected through ML Strategy Studio's website, contact form and advertising campaigns, the joint controllers are:
Piero Lorenzini - VAT number 04325211201
Dario Matassa - VAT number 04368791200
Shared contact point: info@mlstrategystudio.com | www.mlstrategystudio.com
The joint controllers jointly determine the purposes and essential means of processing data collected through ML Strategy Studio's activities. The essence of the joint controllership arrangement is available on request by writing to the address above. Data subjects may exercise their rights against either joint controller.
2. Personal data collected
Forms on Facebook and Instagram may collect:
full name;
email address and telephone number;
company, professional activity, role or sector;
service, requirement or area of interest indicated in the form;
information voluntarily entered in free-text fields;
technical information and data made available by the Meta platform in connection with completing and submitting the form.
Please do not enter special categories of personal data in free-text fields, such as information about health, religious beliefs, political opinions, trade union membership, sex life or sexual orientation.
Personal data may also be collected through the contact form on www.mlstrategystudio.com.
Providing data is optional but necessary for the joint controllers to respond to the enquiry.
Data submitted through this form is used exclusively to:
respond to users' enquiries;
contact users again;
prepare quotations or commercial proposals;
arrange telephone meetings or video calls;
establish any professional relationships.
2-bis. Browsing data, cookies and other tracking tools
During browsing, the systems that serve and protect the website may process technical data, such as the IP address, request date and time, requested resource and information sent by the browser. These data are used to make the website available, operate it and protect it against abuse. ML Strategy Studio does not use them to profile visitors or deliver personalised advertising.
The legal basis is the joint controllers’ legitimate interest in ensuring the website operates securely (Article 6(1)(f) GDPR). Any technical logs are retained for as long as necessary for these purposes, subject to requirements to investigate abuse or protect legal rights.
Neither the Italian nor the English version of the website integrates profiling cookies, Google Analytics, Meta Pixel or other visitor behaviour analytics tools. The language switch uses links between pages and does not save the preference in cookies or browser local storage. Images and fonts are hosted with the website; no third-party videos, maps or social widgets are embedded.
Any tools or cookies strictly necessary for the operation or security of the infrastructure serve technical purposes. These tools do not require prior consent; the current configuration therefore does not include a cookie consent banner. If tracking tools requiring consent are introduced, this notice will be updated and those tools will be activated only after the user has made a choice, with the option to refuse and withdraw consent.
The website contact form prepares an email draft in the email application selected by the visitor. The information entered is not transmitted by the website to an external form collection service. It is transmitted only if the visitor chooses to send the email through their own email application. The respective email providers process data necessary to deliver communications under their own privacy notices. Sending an enquiry does not automatically subscribe the visitor to promotional communications. External links, including LinkedIn and manufacturers’ websites, lead to services governed by their own privacy and cookie notices.
3. Purposes and legal bases for processing
Data is processed for the following purposes:
Purpose: Handling enquiries
Description: Contact the data subject, understand their requirements, provide information about services and arrange an introductory meeting if appropriate.
Legal basis: Taking steps at the data subject's request prior to entering into a contract (Article 6(1)(b) GDPR).
Purpose: Proposals and collaboration
Description: Prepare quotations, consulting proposals or preliminary documents and, where applicable, establish and manage the professional relationship.
Legal basis: Pre-contractual steps and, if the relationship is established, performance of a contract (Article 6(1)(b) GDPR).
Purpose: Organisation and protection of rights
Description: Organise contacts, avoid duplication, retain essential communication history, ensure security and protect rights where necessary. Legal basis: The joint controllers' legitimate interest in managing their business and protecting their rights (Article 6(1)(f) GDPR).
Purpose: Promotional communications
Description: Send updates, content, initiatives and commercial proposals relating to ML Strategy Studio's services by email, telephone or other indicated channels, only with separate consent.
Legal basis: The data subject's consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing before withdrawal and does not prevent handling an enquiry already submitted or an ongoing contractual relationship.
4. Nature of data provision
Providing data marked as required is necessary to submit the form and allow the joint controllers to respond. Failure to provide it may make contacting the data subject impossible. Consent to promotional communications is optional; withholding it does not affect the ability to receive a response to the main enquiry. The same conditions apply to data entered in the contact form on www.mlstrategystudio.com
5. Processing methods and security
Processing is mainly carried out electronically and follows the principles of lawfulness, fairness, transparency, data minimisation and storage limitation. Appropriate organisational and technical measures are adopted to reduce the risks of loss, unauthorised access, disclosure or unlawful use. No decisions are made solely on automated processing that produce legal effects or similarly significantly affect the data subject.
6. Data recipients
To the extent necessary for the purposes described, data may be processed by or disclosed to:
Piero Lorenzini and Dario Matassa, as joint controllers;
collaborators and people authorised to process data;
providers of IT, hosting, email, cloud, CRM and management services;
suppliers and partners involved in delivering the requested activities, within the scope of their assignment;
administrative, tax, legal or technical advisers;
public authorities or other parties where disclosure is required by law or necessary to protect a right.
Parties processing data on behalf of the joint controllers are appointed as processors where required. Data is not publicly disseminated or sold to third parties.
The website form does not send personal data directly to ML Strategy Studio or an external online form service. If a visitor sends a message through their email application, the data are handled through the sender’s and recipient’s email services. Email service providers may process message content and technical data necessary to deliver the communication under their respective privacy notices.
7. Processing by Meta
Forms are provided through Facebook and Instagram, services managed by Meta. Meta processes data relating to the use of its platforms under its own terms and privacy policies. This notice covers processing by the joint controllers after the form is completed and submitted and, where applicable, operations related to campaign management. Meta's privacy policy is available directly on Facebook and Instagram and in their privacy centres.
8. Transfers outside the EEA
Some technology providers may process data outside the European Economic Area. In such cases, transfers comply with the GDPR based on an adequacy decision, standard contractual clauses approved by the European Commission or other safeguards provided by applicable law.
9. Retention periods
Data is retained according to the following criteria:
contact enquiries and pre-contractual stage: for the time needed to handle the enquiry and, as a guideline, no longer than 12 months after the last contact, unless a professional relationship begins or retention is needed to protect rights;
contractual relationship: for its duration and the subsequent periods required by administrative, tax and civil law;
promotional communications: until consent is withdrawn, with periodic checks of interest and, as a guideline, within 24 months of the last meaningful interaction;
disputes or protection of rights: for the time needed to manage the dispute and within applicable limitation periods.
The same periods apply to email enquiries received after use of the website. No enquiry archive is maintained by an external online form service. For deletion requests, contact the privacy email address in this notice.
10. Data subjects' rights
In the cases provided for by the GDPR, data subjects may request:
access to their personal data and information about processing;
rectification of inaccurate data or completion of incomplete data;
erasure of data;
restriction of processing;
data portability, where applicable;
objection to processing based on legitimate interests;
objection at any time to processing for direct marketing purposes;
withdrawal of consent, without affecting the lawfulness of prior processing.
To exercise your rights, write to info@mlstrategystudio.com.
The request will be handled within the time limits provided by law. Information necessary to verify the requester's identity may be required.
11. Complaint to the supervisory authority
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures on its website, without prejudice to the right to seek a judicial remedy.
12. Updates to this notice
This notice may be updated following changes in legislation, organisation or the tools used. The updated version will be published on ML Strategy Studio's website and will state the date of the latest update. This Privacy Policy is published at www.mlstrategystudio.com/privacy and is the reference notice for both the website and contact forms used in Facebook and Instagram advertising campaigns.