Privacy policy

Last updated: 4 November 2026

This English version is provided for information only. In case of any discrepancy, the Italian version prevails.

This policy describes how the personal data of visitors to www.kmarchitect.eu, and of anyone who contacts the studio, are processed. It is provided under Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”), as amended by Legislative Decree 101/2018.

In short: the site only collects the data that users choose to send in order to be contacted. There is no profiling, no marketing, no analytics tools and no third-party content, and the data do not leave the European Union.

1. Data controller

Arch. Klodian Mana, sole practitioner, operating as “Klodian Mana Architect”.

• Office: Via Volti 56/A, 25010 Tremosine sul Garda (BS), Italy
• VAT no. (P.IVA) 04180180988
• Email: km@kmarchitect.eu
• PEC (certified email): mana.klodian@archiworldpec.it

Given the nature and limited amount of data processed, no Data Protection Officer (DPO) has been appointed, as this is not mandatory in this case.

2. What data are processed

Data provided voluntarily by the user. When users write to the email address shown on the site, or use a contact form where available, the data entered are processed: first and last name, email address, telephone number if provided, the content of the message and any attachments.

Please do not send special categories of data (for example health data) or data relating to third parties, unless strictly necessary for the request.

Technical browsing data. The servers hosting the site automatically record certain technical data (logs): IP address, date and time of the request, page visited, browser type and operating system. These are used only to ensure the operation and security of the site and are not used to identify users.

Security data. To protect the site, the IP address of anyone trying to access the login page of the private area is recorded (with date and time), so that repeated attempts can be blocked. To prevent automated submissions, the contact form keeps for 10 minutes an anonymous code derived from the IP address (not the address itself).

3. Purposes and legal bases

None of these processing activities is based on consent: writing to the studio, including through a contact form where available, therefore does not require any consent checkbox. The form contains a link to this policy, to be read before sending.

Providing data is optional. Without contact details, however, it is not possible to respond to the request. If an engagement follows, the data required for the contract and for tax compliance are necessary to conclude it.

4. How data are processed

Data are processed electronically and, where necessary, on paper, with appropriate technical and organisational measures to protect them (Art. 32 GDPR). These include an encrypted HTTPS connection, protected and restricted access, and regular updates.

Data are not used for profiling, for automated decision-making (Art. 22 GDPR), or for sending newsletters or promotional communications. They are not sold or transferred to third parties.

5. Who may receive the data

• Aruba S.p.A., based in Italy, provider of the site’s hosting and email services, acting as data processor under Art. 28 GDPR.
• If the request becomes an engagement, and only to the extent necessary: external professionals collaborating on the project (for example structural engineers, surveyors, building services engineers), the tax adviser, and the public bodies and offices responsible for building and land registry procedures.
• Public authorities, where required by law.

Data are not disclosed to the public or published.

6. Transfers outside the European Union

None. Data are stored on servers located in the European Union and are not transferred to third countries.

7. How long data are kept

• Contact requests: for the time needed to handle the request and any follow-up. If no engagement follows, the messages are deleted no later than 24 months after the last contact.
• Professional engagements: for the duration of the engagement and, after it ends, for the periods required by law, for example 10 years for tax and accounting records (Art. 2220 of the Italian Civil Code).
• Technical server logs: for a short period, linked to security needs, unless needed to investigate possible offences.
• Security log of access to the private area: no longer than 12 months. Contact form anti-spam code: 10 minutes.

8. Rights of the data subject

Data subjects may exercise the rights under Articles 15–22 GDPR at any time:

• access to their data (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• objection to processing based on legitimate interest (Art. 21).

Exercising these rights is free of charge.

To exercise them, simply write to km@kmarchitect.eu or to the PEC address mana.klodian@archiworldpec.it. A reply will be given without undue delay and in any case within one month (Art. 12 GDPR).

Anyone who believes that the processing infringes the law has the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Art. 77 GDPR), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or to apply to the courts.

9. Minors

The site is not intended for minors. Anyone under 14 (Art. 2-quinquies of the Privacy Code) should not send personal data.

10. Cookies

The site uses technical cookies only. Full details are in the Cookie policy.

11. Changes

This policy may be updated, for example following changes in the law or new services on the site. The current version is always published on this page, with the date of the last update.