Privacy Policy

This policy explains what personal data we collect through this website and through VT Media, why we collect it, who we share it with and what you can ask us to do about it. It is written under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

1. Who is responsible

The data controller is Visual Twins — [RAGIONE SOCIALE, P.IVA E SEDE LEGALE DA INSERIRE], reachable at info@visualtwins.it and at +39 344 433 8124. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

2. When you contact us or book a call

Our request and booking forms collect your name, email address, phone number, the company or brand you represent where you give it, the date and type of event, the service you are interested in, and anything else you choose to write to us. If you book a call we also record the slot you selected.

We use this to answer you, to prepare a quotation and to hold the date. The legal basis is the performance of pre-contractual measures taken at your request (Article 6.1.b GDPR). Giving us this information is optional, but without it we cannot reply or hold a date for you.

3. Statistics, and why there is no cookie banner

We measure how the site is used with our own system. It does not use cookies and does not store anything on your device — no cookies, no local storage, nothing that persists after you close the page.

To count returning visits within a single day we generate a one-way fingerprint: your IP address and browser identification are combined with the current date and a secret key and put through a SHA-256 hash. We store only the resulting string. Your IP address is never written to our database, the fingerprint cannot be reversed, and because the date is part of it, the value changes every night and cannot follow you from one day to the next. We also record the page visited, the referring site, and the country, browser and device type derived from your request.

The legal basis is our legitimate interest in understanding how the site performs (Article 6.1.f GDPR). Because no information is stored on or read from your device, this measurement does not require prior consent.

4. Photography and video at events

We photograph and film at fashion shows, film festivals, red carpets, private events and weddings. Where we work under a commission, the images are processed to perform that contract (Article 6.1.b GDPR).

At public and press events we also carry out editorial and reportage photography, on the basis of our legitimate interest and of the right to report and to freedom of expression, which Article 85 GDPR and Italian law reconcile with data protection. Images used commercially — in advertising or to promote a product — are published only where the person portrayed has agreed, as required by Articles 96 and 97 of the Italian Copyright Act.

If you appear in one of our images and want it removed from our website or galleries, write to info@visualtwins.it describing the event and the date and we will act on it.

5. VT Media and facial recognition

VT Media lets guests at an event find their own photographs by taking a selfie. This section describes it in full, because it involves biometric data, which the GDPR treats as a special category (Article 9).

How it works. When a gallery is prepared, our provider analyses the faces appearing in the event photographs and creates a mathematical representation of each one — a numerical template, not a copy of the picture. When you then take a selfie, that image is compared against those templates and you are shown the photographs you match.

Your selfie is not kept. It is transmitted for the duration of the comparison and is not added to any index, not written to our database and not stored by us afterwards.

What is kept is the set of face templates generated from the event photographs, held in an Amazon Rekognition collection for that gallery, together with the reference linking each template to the photograph it came from. This is what makes the search possible on the second and on the hundredth visit.

Legal basis. We process these biometric data on the basis of your explicit consent under Article 9.2.a GDPR. You may withdraw that consent at any time by writing to info@visualtwins.it, and withdrawing it does not affect processing already carried out.

You can say no and still get your photographs. Facial recognition is a convenience, not a condition. Write to info@visualtwins.it and we will send you your images, and remove your face templates from the gallery index.

6. Payments

Payments are handled by Stripe. Card details are entered on Stripe's systems and never reach our servers: we receive the outcome of the transaction and the billing information needed to invoice it. We keep accounting records for the ten years Italian law requires.

7. Who else is involved

We use a small number of suppliers who process data on our instructions, as processors under Article 28 GDPR: Vercel (hosting), Supabase (database and file storage), Amazon Web Services (facial recognition), Cloudflare (media delivery), Google (calendar and availability for bookings), Resend (email delivery), Stripe (payments) and Pic-Time (client galleries). We do not sell personal data and we do not share it for anyone else's marketing.

8. Transfers outside the European Economic Area

Some of these suppliers are established in the United States. Where data is transferred outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy decision, together with the additional safeguards the supplier applies. You may ask us for a copy of the safeguards in place.

9. How long we keep things

Contact and booking requests that do not become work: 24 months from the last exchange. Client files and correspondence: 10 years, for accounting and to defend legal claims. Site statistics: 24 months. Face templates for an event gallery: for as long as that gallery is online, and removed when it is taken down or when you ask us to remove yours.

10. Your rights

You may ask us for access to your data, for it to be corrected or erased, for processing to be restricted, and for a copy in a portable format. You may object to processing based on our legitimate interest, and you may withdraw consent where consent is what we rely on. Write to info@visualtwins.it and we will respond within one month.

If you believe we have handled your data wrongly you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live.

11. Changes

If we change this policy we will update the date shown at the top of this page, and we will tell you directly where the change materially affects work we are doing for you.