Privacy Policy
Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
ARTIMATIK | BUILDING & MARINE
Last updated: 21 October 2026
1. Introduction and scope
Artimatik considers the protection of personal data, confidentiality of information and security of communications essential elements of the relationship of trust established with clients, collaborators and professional contacts.
This Privacy Policy describes how Artimatik collects, uses, stores and protects personal data processed through its website, www.artimatik.com, its associated digital services and its private client portal.
Personal data is processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, or GDPR), Italian Legislative Decree No. 196/2003, as amended, and other applicable data protection legislation.
This Policy applies to processing activities for which Artimatik acts as the Data Controller. Specific professional engagements or services may be subject to supplementary privacy notices.
2. Data Controller
The Data Controller is:
Artimatik di Edoardo Lovaglio
Italian VAT No.: IT02495160463
Registered location: 55049 Viareggio (LU), Italy
Website: https://www.artimatik.com
Email: info@artimatik.com
For any enquiry relating to personal data protection or the exercise of GDPR rights, data subjects may contact the Data Controller using the email address provided above.
3. Categories of personal data processed
3.1 Data voluntarily provided
Artimatik may collect the following information through contact forms, electronic communications and other professional channels:
- First and last name;
- Email address;
- Telephone number;
- Company or organisation, where applicable;
- Subject and content of enquiries;
- Additional information voluntarily provided.
3.2 Client portal data
The following information may be processed for account creation and management:
- User identification details;
- Email address associated with the account;
- Technical account identifiers;
- Authentication-related information;
- Invitation and account activation details;
- User-to-project associations;
- Access permissions and authorisation levels;
- Technical information relating to the use of the service.
3.3 Project documentation
The private client portal may contain documents and information relating to professional engagements, including:
- Architectural drawings and technical documentation;
- Floor plans and project documentation;
- Photographs of buildings, vessels and interior spaces;
- Renderings and three-dimensional visualisations;
- Technical and administrative documentation;
- Communications and project progress updates.
Such documents may contain personal data relating to clients or other individuals involved in the projects.
3.4 Technical and browsing data
The following information may be processed when using the website:
- IP addresses;
- Access dates and times;
- Browser and device information;
- Session identifiers;
- Technical and security logs;
- Information concerning website interactions, within the limits of authorised analytics features.
4. Purposes and legal bases for processing
Personal data is processed for the purposes set out below.
A. Managing enquiries
Responding to communications and providing information about professional services.
Legal basis: Article 6(1)(b) GDPR where processing relates to pre-contractual measures requested by the data subject; Article 6(1)(f) for other legitimate communications connected with professional activities.
B. Performing professional engagements
Managing design, consultancy, coordination, technical documentation and client relationships.
Legal basis: Article 6(1)(b) GDPR where processing is necessary for the performance of a contract with the data subject; Article 6(1)(f) for professional relationships involving representatives and contacts of organisations.
C. Managing the private client portal
Activating accounts, authenticating users, managing access permissions and providing access to project information.
Legal basis: Article 6(1)(b) GDPR where necessary for the performance of the contractual relationship; Article 6(1)(f) for managing access by other authorised individuals.
D. Service communications
Sending invitations, technical communications, account notifications and messages necessary for the provision of services.
Legal basis: Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the nature of the communication and relationship.
E. Information security
Preventing unauthorised access, protecting information systems and identifying anomalies or attempted misuse.
Legal basis: Article 6(1)(f) GDPR, based on the Controller's legitimate interest in protecting its infrastructure and information; Article 6(1)(c) where processing is necessary to comply with legal obligations.
F. Website analytics
Analysing website traffic, understanding how pages are used and improving website content and user experience.
Legal basis: Article 6(1)(a) GDPR where processing requires the user's consent.
G. Legal compliance and protection of rights
Complying with legal, tax and accounting obligations and establishing, exercising or defending legal claims.
Legal basis: Article 6(1)(c) or Article 6(1)(f) GDPR, depending on the relevant purpose.
5. Private client portal and authentication
The Artimatik private client portal is intended exclusively for clients and expressly authorised individuals.
Accounts are created through invitations sent to the recipient's email address.
Users may independently complete account activation and create their personal password.
Authentication and the technical management of credentials are provided through Supabase Auth.
Access to projects and associated content is governed by permissions assigned to individual accounts.
Artimatik may suspend, disable or revoke access when authorisation is withdrawn or when security measures become necessary.
Users are responsible for safeguarding their credentials and must promptly report any suspected compromise.
6. Technical infrastructure and data storage
Artimatik operates an integrated infrastructure comprising internal information systems and cloud services.
Artimatik NAS and internal infrastructure
Photographic documentation and project-related content are stored on NAS systems located within the Artimatik studio.
Access to and availability of content through the private portal are managed through the application's technical infrastructure and the applicable access permissions.
Supabase
Supabase is used for the application database, authentication, account management and features associated with the private client portal.
The project is configured in a European region.
The location of the primary database does not exclude the possibility that certain ancillary activities, including technical support, logging and infrastructure operations, may involve processing in other geographical locations.
7. Electronic communications and Resend
Artimatik uses email services for professional and operational communications.
Resend is used to send automated and transactional emails associated with the private client portal.
These communications may include:
- Account activation invitations;
- Authentication messages;
- Credential recovery emails;
- Technical notifications;
- Service-related communications.
Resend may process email addresses, message content, technical transmission data and delivery-related information.
Email open tracking and click tracking features are not enabled in Artimatik's current configuration.
The processing of technical information necessary for email transmission, delivery and administration may nevertheless occur.
8. Google Analytics and website statistics
Artimatik uses Google Analytics to collect statistical information about website usage, assess page performance and improve digital content.
Depending on its configuration, the service may process information concerning pages visited, interaction duration, technical device characteristics, traffic sources and online identifiers.
Analytics cookies and tracking technologies requiring consent are used only after the user has provided prior, freely given, specific and informed consent.
Users may refuse or withdraw their consent without affecting access to essential website functionality.
Further information about the technologies used, cookie lifetimes and preference management is available in the Cookie Policy.
9. Recipients of personal data
Personal data may be accessed by Artimatik personnel and authorised collaborators, within the scope of their respective responsibilities.
It may also be processed by external providers of technical, IT, administrative or professional services, including:
- Supabase, for application infrastructure and authentication;
- Resend, for transactional email communications;
- Google, for Google Analytics and any other services actually used;
- Lovable, for relevant application services;
- Hosting, infrastructure and technical support providers.
Service providers processing personal data on behalf of Artimatik are subject, where applicable, to agreements pursuant to Article 28 GDPR.
Other recipients may act as independent Data Controllers in relation to their respective activities.
Personal data may be disclosed to competent authorities where required by law.
Artimatik does not sell personal data to third parties.
10. International data transfers
The use of certain technology providers may involve the transfer or processing of personal data outside the European Economic Area.
In particular, Resend uses infrastructure located in the United States, including for the storage of data associated with electronic communications.
Additional transfers may arise from the use of Google, Supabase and other service providers, depending on their respective configurations and contractual conditions.
International transfers are governed by Chapter V of the GDPR and are carried out on the basis of applicable adequacy decisions or appropriate safeguards, including the European Commission's Standard Contractual Clauses.
For transfers to the United States, the EU-U.S. Data Privacy Framework may apply where the recipient is validly certified and the processing falls within the scope of the relevant adequacy decision.
Data subjects may request further information from the Controller concerning the safeguards applicable to transfers of their personal data and the means of obtaining or accessing a copy, subject to applicable legal limitations.
11. Personal data retention
Artimatik retains personal data for periods proportionate to the purposes for which it was collected.
11.1 Contact enquiries
Data submitted through contact forms is ordinarily retained for a maximum of 24 months, unless a professional relationship is established or additional legitimate retention requirements apply.
11.2 Professional relationships
Documentation associated with professional engagements is retained throughout the duration of the relationship and subsequently for periods required by applicable law or justified by the protection of rights and professional responsibilities.
11.3 Private client portal
The private portal area associated with a project is deleted within three months following completion of the works.
Deletion terminates the client's access to the relevant page and its content through the portal.
Information may continue to be retained in the studio's professional archives for separate and lawful purposes.
11.4 Project and photographic documentation
Technical drawings, photographs and other documents stored in the professional archive may be retained after the closure of the private portal where necessary for legal obligations, professional responsibilities, documentation of completed services and the protection of legal rights.
Retention is limited to the data necessary and to periods justified by the relevant purposes.
11.5 Technical logs and backups
Logs, technical information and backups are retained in accordance with criteria proportionate to operational requirements, security, business continuity and system recovery.
Applicable retention periods are determined based on actual system configurations, risks and legal obligations.
11.6 Analytics data
Information collected through Google Analytics is retained according to the service's configured settings and the authorised statistical purposes.
Once the applicable retention periods expire, personal data is deleted or anonymised, without prejudice to legal obligations or legitimately justified retention requirements.
12. Processing methods and security
Personal data is processed using information systems and organisational procedures appropriate to the nature of the information and the associated risks.
Artimatik implements measures aimed at protecting:
- Data confidentiality;
- Information integrity;
- Document availability;
- Account security;
- Access control;
- Prevention of unauthorised use.
Access permissions for project content are managed according to the roles and authorisations assigned to users.
Technical and organisational measures are assessed in light of system characteristics and evolving cybersecurity risks.
13. Provision of personal data
The provision of personal data through contact forms is voluntary; however, the information necessary to process an enquiry must be provided for Artimatik to respond.
Personal data required for account creation and management is necessary to access the restricted services.
Failure to provide such information may prevent access to the corresponding functions.
The provision of data required by law is governed by applicable legislation.
14. Third-party data and special categories
In the course of professional engagements, Artimatik may process personal data relating to clients, collaborators, consultants, technicians and other individuals involved in projects.
Where personal data is obtained from parties other than the data subject, Artimatik complies with the applicable information requirements under Article 14 GDPR, subject to the exceptions provided by law.
Artimatik's digital services are not specifically intended for the collection of special categories of personal data within the meaning of Article 9 GDPR.
Where such data is necessary in connection with specific activities, processing is carried out only where the legal conditions and safeguards are satisfied.
15. Rights of data subjects
Data subjects may exercise the following rights, subject to the conditions established by the GDPR:
- Right of access;
- Right to rectification;
- Right to erasure;
- Right to restriction of processing;
- Right to data portability;
- Right to object;
- Right to withdraw consent, where applicable;
- Rights relating to automated individual decision-making.
Requests may be submitted to:
Artimatik responds within the time limits established by Article 12 GDPR, ordinarily within one month of receipt, subject to legally permitted extensions.
The exercise of rights is free of charge, except in circumstances expressly provided for by law.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), through www.garanteprivacy.it, or with another competent supervisory authority.
16. Automated decision-making
Artimatik does not use, within the services described in this Policy, solely automated decision-making processes, including profiling, which produce legal effects or similarly significantly affect data subjects.
17. Cookies and similar technologies
The website uses technical technologies necessary for website operation and session management.
It may also use cookies and statistical analysis tools, including technologies associated with Google Analytics.
Non-essential technologies are subject to the conditions established by applicable law, including prior consent where required.
Detailed information concerning the technologies used, their purposes and preference management is available in the website's Cookie Policy.
18. Links to external services
The website may contain links to pages or services managed by third parties.
Personal data processing independently carried out by such third parties is governed by their respective privacy policies.
Users are encouraged to review those documents before using external services.
19. Changes to this Privacy Policy
Artimatik may update this Privacy Policy to reflect changes in legislation, technology, organisational arrangements or the services offered.
The updated version will be published on the website together with the revision date.
Where changes materially affect personal data processing activities, data subjects will be informed through appropriate means where required by law.
---
ARTIMATIK | BUILDING & MARINE
Artimatik di Edoardo Lovaglio
55049 Viareggio (LU), Italy
www.artimatik.com
info@artimatik.com