Privacy notice

Privacy Policy

Last updated: 5 November 2026 · Under EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

1. Data controller

The controller for personal data collected through the website 369lab.it is:

2. Categories of data collected

The 369lab.it website collects personal data only in the cases and for the purposes described below.

2.1 Data voluntarily provided through the contact form

• Name (required)
• Email address (required)
• Company or business name (optional)
• Phone number (optional)
• Project type and indicative budget (optional)
• Message text (required)

These data are entered voluntarily by the user when filling in the form at /contact to request a quote or information about a project.

2.2 Data provided to place an order (e-commerce)

When a user completes a purchase through a product page or /checkout, the following data are collected:

• Full name
• Email address
• Phone number
• Shipping address (street, city, ZIP/postal code, country)
• Order content (product, quantity, amount)
• Any notes added by the user

Payment card data are never collected or stored by the site: they are transmitted directly to the Stripe payment platform, which acts as an independent data controller for financial data (see § 6).

2.3 Technical browsing data

During normal browsing, the server hosting the site (Netlify) and the third-party services the browser connects to automatically log:

• Visitor's IP address
• Browser type and version
• Operating system
• Pages visited, date and time of the request, referring page

These data are processed only for technical purposes (service delivery, security, abuse prevention) and are not used to profile the user.

2.4 Data stored locally in the browser (localStorage)

The site uses only the browser's local storage (localStorage) — no third-party cookies — to save:

• 369lab_guest_id: anonymous identifier that links the cart and order of a non-registered visitor
• 369lab_cart_v1: cart contents
• 369lab_lang: user's selected language (IT/EN/SQ)
• 369lab_brand_published: brand/style cache for performance

These data stay inside the user's browser, are not sent to third parties and can be deleted at any time from the browser settings (history / site data).

3. Purposes and legal bases of processing

Purpose	Legal basis (GDPR)
Responding to requests sent through the contact form	Art. 6(1)(b) — pre-contractual measures at the data subject's request
Managing orders and shipping	Art. 6(1)(b) — performance of a contract
Invoicing and tax obligations	Art. 6(1)(c) — legal obligation
Site security, fraud and abuse prevention	Art. 6(1)(f) — legitimate interest of the controller
Technical local storage (cart, language)	Art. 6(1)(f) — legitimate interest / implicit consent in using the service

4. Nature of data provision

Providing the data marked as required in the forms (contact and checkout) is necessary for the Controller to follow up on the request or order. Without those data the service cannot be provided. Providing optional data is free and their absence has no consequence.

5. Data retention

• Contact form requests: kept for the time needed to handle the request and any follow-up on related projects; then deleted or anonymized when no longer necessary.
• Order, invoicing and payment data: kept for the time required by Italian tax law.
• Server technical logs: kept for the time technically necessary for security and infrastructure management, according to the hosting provider's policies.
• localStorage data: remain in the user's browser until manually deleted.

6. Recipients and transfers — third parties (processors)

Data collected by the site may be processed by the following providers, chosen because they offer adequate safeguards under GDPR. No commercial sale or transfer of personal data is ever performed.

• Netlify, Inc. — static site hosting on distributed cloud infrastructure. Receives technical browsing data (IP, user-agent). Any extra-EU transfers are covered by the European Commission's Standard Contractual Clauses.
• Supabase Inc. — database and authentication for the site backend. The project is hosted on cloud infrastructure; the specific hosting region is configured in the project panel. Receives and stores contact form requests, orders and the admin account profile.
• Stripe Payments Europe, Ltd. — payment card processing. EU seat in Ireland. Receives payment card data and transaction data directly from the user's browser. Stripe processes financial data as an independent controller according to its Privacy Policy.
• Google LLC (Google Fonts) — the site loads the Inter and Syne typefaces from Google's servers (fonts.googleapis.com, fonts.gstatic.com). When the font is loaded, the visitor's IP and user-agent are sent to Google. Google acts as an independent controller according to its Privacy Policy.

Data may also be shared with: the Controller's tax and accounting advisors for legal obligations; couriers/shipping companies for order delivery; public authorities upon lawful request.

7. Cookies and similar technologies

The 369lab.it site does not use profiling cookies or third-party analytics cookies. In particular, the following are NOT present:

• Google Analytics / GA4
• Google Tag Manager
• Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel
• Hotjar, Clarity, Mixpanel, Segment or similar tracking tools

The site uses only the browser's local storage (localStorage) for strictly technical purposes (cart, language, anonymous guest ID), as described in § 2.4. For this reason no cookie consent banner is shown: there are no non-essential cookies to authorize.

The third-party services listed in § 6 (Stripe, Supabase, Google Fonts) may in turn set their own technical cookies that are strictly necessary for the service they provide. Please refer to their privacy policies for details.

8. Internal tool for the studio's own TikTok account statistics

369 Lab uses, separately from the public 369lab.it website, an internal tool that lets the owner review aggregate statistics of the studio's own TikTok account (e.g. view counts, followers, performance of content published by the studio's account). This tool:

• connects only to the TikTok account owned by 369 Lab, through TikTok's official APIs, using the studio's credentials;
• does not collect, store or process any personal data of third parties, TikTok visitors, followers or other subjects;
• does not interact in any way with visitors of the 369lab.it website;
• does not publish, comment, or send messages.

The tool is used only internally to analyze the studio's own editorial activity on its own account.

9. Data subject rights (GDPR Articles 15–22)

The user has the right, at any time, to:

• request access to their personal data and to information about processing (Art. 15);
• request rectification of inaccurate data or completion of incomplete data (Art. 16);
• request erasure of data (right to be forgotten, Art. 17), within the limits allowed by law;
• request restriction of processing (Art. 18);
• receive their data in a structured, commonly used format (data portability, Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw any consent given, at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, simply write to info@369lab.it clearly stating the request. The Controller will reply within 30 days.

The user also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if they believe the processing breaches applicable law.

10. Security

The Controller adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction or disclosure: traffic encrypted via TLS/HTTPS, admin area access restricted by authentication, separation of payment data (handled only by Stripe and never stored on the site).

11. Minors

369 Lab's site and services are not aimed at children under 14. The Controller does not knowingly collect data from children of that age. If data are inadvertently collected, they will be promptly deleted upon notification.

12. Changes to this policy

The Controller may update this notice at any time, publishing the updated version on this page with the date of the last change. Users are encouraged to review it periodically.