Start your project

Legal

Privacy Policy

Last updated: 27 July 2026

This notice describes how Pinworth S.r.l., the controller of the nwdesigns.it website, collects, uses and protects visitors' personal data, pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018.

1. Data controller

The data controller is Pinworth S.r.l., registered office at Via San Lucio 14, 00165 Rome (RM), Italy — VAT and tax code 15095411003, REA RM-1567605, certified email pinworth@pec.it. The nwdesigns.it website and the nwdesigns brand belong to Pinworth S.r.l.

Data protection contact: Nilushana Wijegunaratne — nilu@nwdesigns.it. You can use this address for any request concerning the processing of your data.

2. Personal data processed

We only process the data required for the purposes described in this notice:

  • Data you provide voluntarily through the contact forms and the “Start a project” questionnaire: first name, last name, email, phone (optional), company or project name, industry, indicative budget and preferred contact method
  • Data you provide by completing the Brand Effective Analysis: your answers to the 100 self-assessment questions on your company's marketing and brand maturity, together with the contact details needed to send you the outcome (first name, last name, email, optional phone, company name). This is information about your business organisation, not special categories of personal data
  • Browsing data collected automatically by our systems (IP address, technical server logs): necessary to deliver the service and keep the site secure
  • Aggregate statistical data collected through measurement cookies (Google Analytics 4), exclusively with your prior consent — see the Cookie Policy
  • Data collected through profiling cookies (Meta Pixel) to measure advertising campaigns and show ads to people who have already visited the site, exclusively with your prior consent: pseudonymous browser identifiers, pages visited and form submissions. We do not send your contact details to Meta — see the Cookie Policy
  • We do not request and do not knowingly process special categories of data (art. 9 GDPR) or data relating to minors

3. Purposes and legal bases of processing

Data are processed for the following purposes, each resting on a specific legal basis:

  • Replying to requests sent through the forms and managing pre-contractual contacts — art. 6.1.b GDPR (pre-contractual measures at the data subject's request)
  • Producing the Brand Effective Analysis: calculating the score, drawing up the analysis document and discussing the outcome with you — art. 6.1.b GDPR (pre-contractual measures taken at your request, the analysis being the service you asked for)
  • Sending marketing communications (only if you ticked the relevant optional consent) — art. 6.1.a GDPR (consent, withdrawable at any time)
  • Aggregate statistics on site usage through measurement cookies — art. 6.1.a GDPR (consent given through the cookie banner)
  • Advertising campaign measurement and retargeting through profiling cookies (Meta Pixel) — art. 6.1.a GDPR (consent given through the cookie banner, withdrawable at any time from the “Cookie preferences” button)
  • Compliance with legal obligations — art. 6.1.c GDPR
  • Site security and abuse prevention (e.g. anti-spam filters) — art. 6.1.f GDPR (legitimate interest)

We do not sell, transfer or disclose your personal data to third parties for their own commercial purposes.

4. Brand Effective Analysis

The Brand Effective Analysis is a self-assessment questionnaire of 100 closed questions (Yes / Don't know / No) across ten thematic areas. The answers you enter are processed as follows:

  • Each answer is automatically assigned a score; scores are added up per thematic area and into an overall total. The processing is automated, but it produces no legal effect and does not similarly significantly affect you: the result is an analysis document we discuss together, not a decision taken about you
  • To prepare that discussion we may have the score profile processed by an artificial intelligence service (OpenAI), which drafts an interpretation for our staff's internal use. Only the scores and the questionnaire's question texts are sent, in anonymous form: first name, last name, company, email, phone and our staff's internal notes are never transmitted and cannot be inferred in any way from what we send
  • The resulting draft is neither automatic nor final: it is always re-read, corrected and validated by a member of our team before being used in the conversation with you. Here too, therefore, no decision is taken about you by automated means
  • The completed questionnaire, the scores, any interpretation draft and your contact details are stored in our staff-only internal management system, together with the associated contact request
  • Scores may be used in aggregate, anonymous form together with those of other companies to produce internal statistics on brand maturity levels by sector. In that form the data can no longer be traced back to you or your company

The legal basis of the analysis is art. 6.1.b GDPR: the processing is necessary to deliver the service you requested. The box you tick before submitting the questionnaire acknowledges this notice and is not a consent: the processing is not based on consent and therefore cannot be withdrawn as such. The rights described below — including erasure and objection — of course remain available. Consent to marketing communications is a separate matter, optional and always withdrawable (art. 6.1.a GDPR).

5. Recipients and processors

Data are processed by authorised Pinworth S.r.l. personnel and by suppliers acting as processors under art. 28 GDPR:

  • Vercel Inc. — website hosting and serverless infrastructure
  • Elastic Email Inc. — delivery of transactional email (request notifications and confirmation emails)
  • Google Ireland Ltd. — Google Analytics 4 (statistics, only with prior consent) and Google Workspace (company mailboxes)
  • Meta Platforms Ireland Ltd. — Meta Pixel (advertising campaign measurement and retargeting, only with prior consent). For the collection and transmission of data through the pixel, Meta acts as joint controller under art. 26 GDPR; for subsequent processing it acts as an independent controller under its own privacy policy
  • Adobe Inc. — Adobe Fonts, for delivering the site's typefaces
  • Cloudways Ltd. (DigitalOcean group) — hosting of the internal management system where requests and Brand Effective Analyses are recorded, and of its backup copies
  • OpenAI — drafting the Brand Effective Analysis interpretation. We list it for transparency: since it receives only anonymous scores and question texts, and no data that could identify you or your company, it does not process personal data on our behalf
  • Requests sent through the forms and completed questionnaires are recorded in an internal management system reserved to our staff. A summary of each submission is also delivered by email to the team's company mailboxes

6. Transfers outside the EU

Some suppliers are based, or host servers, in the United States. Transfers take place on the basis of appropriate safeguards under Chapter V of the GDPR: the EU-U.S. Data Privacy Framework adequacy decision for certified suppliers and/or Standard Contractual Clauses (SCCs) approved by the European Commission.

In particular, data collected through the Meta Pixel — active only with your prior consent — are transmitted to Meta Platforms Ireland Ltd. and may be transferred to the United States to Meta Platforms, Inc., a company certified under the EU-U.S. Data Privacy Framework. Withdrawing consent to marketing cookies stops the transmission immediately.

7. Data retention

Contact request data are kept for as long as needed to handle the request and in any case no longer than 24 months from the last contact, unless a contractual relationship is established. Data processed for marketing are kept until consent is withdrawn. Statistical data are kept for the periods stated in the Cookie Policy. Once those periods expire, data are erased or anonymised.

Brand Effective Analyses follow the same term: 24 months from the last contact, unless a contractual relationship is established, in which case they are kept for the duration of the relationship and for the subsequent statutory periods. On expiry, or at your request for erasure, the contact details, the individual answers and any interpretation draft are deleted; only the scores may survive in anonymous, aggregate form, with no reference to you or your company and no longer traceable to a single submission. If you would rather the anonymous score were not kept either, simply say so in your request.

A draft of the answers you are entering is saved on your device, in the browser's local storage, so you do not lose your work if you close the page. It is not transmitted to us until you submit the questionnaire and is deleted automatically after 30 days — see the Cookie Policy.

8. Your rights

Under arts. 15-22 GDPR you may exercise the following rights at any time by writing to nilu@nwdesigns.it:

  • Access to your personal data (art. 15)
  • Rectification of inaccurate data and erasure (arts. 16-17)
  • Restriction of processing and objection (arts. 18 and 21)
  • Data portability (art. 20)
  • Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand (art. 7)
  • Complaint to the Italian Data Protection Authority — www.garanteprivacy.it (art. 77)

9. How we handle an erasure request

An erasure request sent to nilu@nwdesigns.it is handled without undue delay and in any case within one month (art. 12.3 GDPR). For the erasure to be effective we act on every copy of the data, not just the primary one:

  • The Brand Effective Analysis recorded in the internal management system, with its answers and scores
  • Any interpretation draft produced with the support of artificial intelligence, stored in the same record. Nothing remains to be erased at the artificial intelligence provider: what was sent contained no identifying data, so it is neither linkable to you nor held by them on our behalf
  • The linked contact request, recorded in the same system
  • The submission summary emails delivered to the team's company mailboxes
  • The backup copies of the management system held by the hosting provider, which are overwritten according to the scheduled rotation cycle: until then the data stay frozen in the backup and are no longer used for any purpose
  • Any draft saved in your browser's local storage, which you can remove yourself at any time by clearing the site data
  • Any residual archives from migrations of previous systems, which are destroyed once the migration is complete

We confirm the erasure to you in writing, stating which copies were deleted and, for backups, by when they will be overwritten.

10. Cookies

For detailed information on the cookies and tracking tools used by the site, including how to change your preferences, see the Cookie Policy linked in the footer of every page. The choice made through the banner can be changed at any time with the “Cookie preferences” button.

11. Changes to this notice

This notice may be updated to reflect changes in the law or in the services used. The version in force is always published on this page with its last-updated date.

For any question about this document you can write to info@nwdesigns.it.