Last updated: 26/10/2026
Asa's Mezzanine
Controller contact email: info@asasmezzanine.com
Among the personal data processed by this website, either directly or through third parties, are: email address entered in the mailing list sign-up form; IP address, usage data; email address, language, subscription and confirmation dates, one-way hash of the IP address and browser used; subscribers' email address and message content; usage data, online identifiers. Complete details on each type of data are provided in the sections dedicated to the individual services. Data may be provided voluntarily by the user (for example by filling in a contact form) or collected automatically while browsing (for example usage data and technical identifiers).
Users who choose not to provide certain data may be unable to use the corresponding services (for example, a contact request cannot be answered without contact details).
Data are processed for the following purposes:
For processing based on consent (art. 6.1.a GDPR), such as non-technical cookies, consent may be withdrawn at any time without affecting the lawfulness of processing carried out beforehand.
Processing is carried out using IT and telematic tools, with security measures adequate to prevent unauthorised access, disclosure, modification or destruction of the data. In addition to the Controller, the data may be accessed by authorised internal parties and by external providers appointed, where necessary, as data processors (art. 28 GDPR), such as hosting and technical service providers. The data are processed at the Controller's operating offices and at the data centres of the providers listed in this policy.
Where a service involves the transfer of data outside the EU (in particular to the United States), the transfer takes place on the basis of adequacy decisions of the European Commission or standard contractual clauses (arts. 45 and 46 GDPR).
Data are kept for the time necessary for the purposes for which they were collected: data provided to answer a request are kept for the time needed to handle it and for any legal obligations; data collected on the basis of consent are kept until consent is withdrawn, unless further retention obligations apply.
| Data | How long we keep them | Why |
|---|---|---|
| Mailing list subscription | Until unsubscription | The data is only needed while you want to receive the emails |
| Subscriptions never confirmed | 30 days | Without email confirmation the subscription is not valid and is deleted |
| Proof of mailing list consent (date, accepted text, confirmation) | 5 years from unsubscription | To be able to demonstrate consent as required by art. 7.1 GDPR, even after withdrawal |
Provider: Google Ireland Limited. Purpose: aggregate statistics on website usage. Data processed: usage data, online identifiers. Transfers to Google LLC (USA) are covered by the EU-US Data Privacy Framework. Provider's privacy notice: https://policies.google.com/privacy.
Provider: Meta Platforms Ireland Ltd. Purpose: ad measurement and remarketing. Data processed: usage data, online identifiers. Possible transfer to Meta Platforms Inc. (USA) under the Data Privacy Framework. Provider's privacy notice: https://www.facebook.com/privacy/policy.
Provider: Meta Platforms Ireland Ltd. Purpose: display of embedded facebook content (page plugin). Data processed: usage data, online identifiers. Possible transfer to Meta Platforms Inc. (USA) under the Data Privacy Framework. Provider's privacy notice: https://www.facebook.com/privacy/policy.
Provider: Spotify AB (Sweden). Purpose: display of embedded music players. Data processed: usage data, online identifiers. The provider is based in the EU; any transfers outside the EU are described in the provider's privacy notice. Provider's privacy notice: https://www.spotify.com/legal/privacy-policy/.
Provider: Google Ireland Limited. Purpose: display of embedded video content. Data processed: usage data, online identifiers. Transfer to Google LLC (USA) covered by the EU-US Data Privacy Framework. Provider's privacy notice: https://policies.google.com/privacy.
Provider: Script on the site; the data collected is sent to Meta Platforms Ireland Ltd through Meta Pixel. Purpose: stores traffic source, landing page and session to enrich the events sent to meta pixel. Data processed: usage data, online identifiers. Possible transfer to Meta Platforms Inc. (USA) under the Data Privacy Framework. Provider's privacy notice: https://www.facebook.com/privacy/policy.
Provider: Vercel Inc. (USA). Purpose: website hosting, content delivery network and technical infrastructure (technical logs and cookieless analytics). Data processed: IP address, usage data. Transfer to Vercel Inc. (USA): the provider states in its privacy notice that it is certified under the EU-US Data Privacy Framework. Provider's privacy notice: https://vercel.com/legal/privacy-notice.
Provider: Supabase, Inc. (USA). Purpose: database storing mailing list subscriptions and the proof of consent. Data processed: email address, language, subscription and confirmation dates, one-way hash of the IP address and browser used. Transfers outside the EU are governed by standard contractual clauses (EU Decision 2021/914) incorporated in the provider's DPA (supabase.com/legal/dpa). Provider's privacy notice: https://supabase.com/privacy.
Provider: SiteGround Spain S.L.. Purpose: mailbox that sends the mailing list emails and receives the messages written to the band. Data processed: subscribers' email address and message content. Provider's privacy notice: https://it.siteground.com/privacy.htm.
When the user gives consent through the website forms (for example by subscribing to the newsletter or sending a contact request), the Controller keeps evidence of the consent (date, form filled in and content transmitted) in order to demonstrate that it was given, pursuant to art. 7 GDPR. These records are kept for as long as the consent remains active and for the applicable limitation periods.
Under articles 15-22 GDPR, users have the right to obtain from the Controller access to their data, rectification, erasure, restriction of processing and portability, as well as the right to object to processing and to withdraw any consent given. Requests should be addressed to info@asasmezzanine.com.
Users also have the right to lodge a complaint with the competent supervisory authority: for Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
This website uses cookies and similar tools. The full notice is available in the Cookie Policy.
Personal Data (or Data): any information relating to an identified or identifiable natural person, directly or indirectly, including by reference to an identifier such as a name, an identification number, location data or an online identifier (art. 4(1) GDPR).
Usage Data: information collected automatically through this website (including from third-party applications integrated into it), such as: IP addresses or domain names of the devices used, URI addresses, time of the request, method used to submit the request to the server, size of the file received in response, numerical code indicating the status of the server's response, country of origin, browser and operating system characteristics, duration of the visit and the path followed within the website.
User / Data Subject: the natural person using this website, to whom the Personal Data refers.
Data Controller: the natural or legal person that determines the purposes and means of the processing of Personal Data (art. 4(7) GDPR); it is identified at the top of this policy.
Data Processor: the natural or legal person that processes Personal Data on behalf of the Controller (art. 4(8) GDPR), such as the technical service providers listed in this policy.
Cookies and similar tools: small pieces of data stored on the user's device, or other tools (such as pixels, local storage, fingerprinting) that allow information to be stored on or accessed from the device.
Legal references: this policy is drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018, also taking into account the Italian Data Protection Authority's Guidelines on cookies and other tracking tools of 10 June 2021. It applies solely to this website.
The Controller may amend this policy at any time by publishing the updated version on this page. The date of the last update is shown at the top.