Your information,
clearly explained.

Privacy notice updated on 12 November 2026 · version 2026-11-12.

Professionals and contact details

mobius. is the shared name used by Marco Franciolini, Daniele Cipinti and Lorenzo Castaldini, professionals with separate VAT registrations; it does not identify a company. Their common professional contact address for this form is Corso Italia 27, Florence, Italy.

Within the studio, info@mobiusarchitecture.it is accessed exclusively by the three professionals. All three also handle requests concerning personal data protection.

The three professionals jointly decide how to collect, manage and distribute website enquiries and act as joint controllers for these activities. They have signed an internal agreement allocating their responsibilities. Lorenzo Castaldini coordinates privacy requests and checks at least monthly which enquiries must be deleted; Marco Franciolini acts as his substitute when absent and manages the technical aspects of the website. Each professional protects the data they access and cooperates in handling requests and any incidents. This information summarises the essence of the agreement. You may exercise your rights against any of the three professionals and request further information through the shared privacy contact.

VAT numbers, professional registrations and professional information

Information we collect

The form collects your first name, last name, email address, service of interest and message. Phone numbers and attachments are optional. Technical data needed to transmit and protect submissions and recognise repeated attempts are also processed, including request identifiers and identifiers derived from the IP address or preview access.

Fields marked * are required to submit an enquiry through the form. Without this information the form cannot be used; you can still contact us directly by email or telephone. Attachments should contain only relevant information: avoid identity documents, health information, payment details and unnecessary information about other people.

Purposes and legal bases

We use the information to assess and answer your enquiry and carry out the discussions you request about a possible engagement. When you request a quotation or service for yourself, the legal basis is taking steps at your request before entering into a contract, under Article 6(1)(b) GDPR.

For professional communications on behalf of a business and for form security, the basis is the legitimate interest in handling requested contacts and preventing abuse, within Article 6(1)(f) GDPR and respecting the individual's rights.

The form checkbox acknowledges this notice. The form does not subscribe you to newsletters, feed promotional campaigns, or carry out profiling or solely automated decisions with legal or similarly significant effects.

How the message is delivered and who receives it

Messages and attachments are sent through Resend to info@mobiusarchitecture.it, a mailbox hosted by Aruba. Your email address enables us to reply. There is no private area for reading messages on the website.

Message contents and files are not stored in the website database or file storage. They remain in email correspondence and the systems of the providers involved in sending and receiving them. New enquiries are received in the practice’s Aruba mailbox. We do not use other enquiry-management systems for the website.

In addition to the three professionals, technical providers process data to deliver the services: OpenAI Ireland Ltd for ChatGPT Sites, with its infrastructure and subprocessors including Cloudflare; Plus Five Five, Inc. for Resend; and Aruba for email. Processing on the studio's behalf is governed by the data processing agreements applicable to those services. Data is not made public; disclosures to authorities take place where required by law.

Until 12 November 2026, mail from the Aruba mailbox was also copied to a personal Gmail account shared by the three professionals. POP retrieval has been disabled, and the practice has checked with a test message that mail is received in Aruba without a new copy appearing in Gmail. Earlier copies have not been deleted automatically: they remain subject to the practice’s relevance, retention and deletion reviews. For these copies, Google applies its consumer terms and privacy policy; the Google One subscription provides storage and does not constitute a Google Workspace contract. Reviewing the existing archive remains separate from handling new enquiries.

How long we retain information

For enquiries that do not lead to an appointment, emails and attachments are retained for no more than 12 months after the last exchange concerning the enquiry, then deleted from the practice’s mailbox. This period also covers replies and copies managed by the practice. Lorenzo Castaldini checks expired enquiries at least monthly and arranges deletion, with Marco Franciolini as his substitute. This procedure covers copies in Aruba and Gmail, sent mail, deleted-item folders and any saved attachments, without prejudice to each professional’s responsibilities for their own processing. If an appointment follows, the necessary documentation moves into the management of the professional relationship, covered by its own privacy notice.

Further retention may concern only information needed for specific legal obligations or to establish, exercise or defend a right, for the period required by that obligation or the particular dispute. It does not mean retaining all enquiries indiscriminately.

The website separately retains technical identifiers without message content or attachments: anti-abuse counters expire after one hour and fingerprints used to recognise repeat submissions after seven days; expired records are deleted when a subsequent submission is processed. There is currently no scheduled deletion independent of submissions.

Resend states that standard plans retain email data, including content, metadata and delivery events, for 30 days. Providers' technical copies, backups and logs follow the applicable service terms and do not necessarily have the same retention periods as the studio mailbox.

Where information is processed

Hosting and sending services may involve processing outside the European Economic Area, including in the United States. Selecting a European sending region in Resend does not guarantee that all processing takes place exclusively in the European Union.

Resend's agreement provides for the European Commission's standard contractual clauses for relevant transfers. The ChatGPT Sites agreement provides for standard contractual clauses or adequacy decisions for transfers by OpenAI Ireland. You may request information and a copy of the applicable safeguards by writing to the studio's privacy contact.

Your rights and how to contact us

Where and to the extent provided by Articles 15–22 GDPR, you may request access to your data, rectification, erasure, restriction of processing and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation.

Send requests to info@mobiusarchitecture.it or to the common address at Corso Italia 27, Florence, for the attention of the professionals at mobius. All three handle these requests. You will receive a response without undue delay and normally within one month; any extension allowed by Article 12 GDPR will be communicated with the reasons.

You may also lodge a complaint with the Italian data protection authority or the competent supervisory authority, without first having to submit a request to the studio.

Privacy contact · Italian data protection authority

Provider documents

ChatGPT Sites Data Processing Addendum

Resend Data Processing Addendum

Resend data retention information

Aruba Hosting and Domains service terms

Browsing and security

To display pages and protect them against abuse, the hosting infrastructure processes connection data such as IP address, date and time, the requested resource and browser information. The purpose is to operate and secure the website, based on the professionals’ legitimate interest in providing a reliable service. We do not use this data for promotional campaigns.

The website’s fonts and images are hosted alongside its pages: displaying them does not require connections to Google Fonts or external photography services. The website does not integrate Google Analytics, Google Tag Manager, Meta Pixel or other visitor analytics tools.

Connection and security data are processed by the hosting infrastructure for as long as necessary to provide the service, prevent abuse and manage incidents, under the providers’ terms. You may request further information through the practice’s privacy contact. Access to the restricted preview also uses ChatGPT authentication services, separate from the contact form.

Cookies and OpenStreetMap maps

Office maps are disabled by default and load only after a positive choice. Accept and Reject are available in the banner; you can change your choice in the footer preferences or disable maps on the Contact page. Your choice is remembered for six months. Scrolling does not constitute consent.

Maps use OpenStreetMap data and tiles served by tile.openstreetmap.org, operated by the OpenStreetMap Foundation. When you enable and view maps, the provider receives connection data including your IP address, browser information and referring website. Tile images may be cached by your browser according to the service headers. This integration does not load Google maps, advertising tools or analytics.

Withdrawing your choice removes maps and stops new loads without deleting data already transmitted. “Open in Google Maps” links are external links: Google is contacted only when you choose to open them. The public OpenStreetMap tile service has no availability guarantee; addresses and directions links remain available if tiles cannot be loaded.

Technology	Purpose	Duration
__cf_bm · Cloudflare	Protection against automated traffic. Technical cookie observed in the preview.	30 minutes of inactivity, according to the provider’s documentation.
mobius.maps-consent.osm.v1 · browser local storage	Remembers only your map choice, the date and the notice version. It contains no name, email or advertising identifier.	Six months from your choice; you can change it or clear browser data earlier.

OpenStreetMap privacy policy · OpenStreetMap tile usage policy · Cloudflare technical cookies

Back to the form