Legal

Privacy policy

What we collect when you send a project brief, why we need it, who else sees it, how long we keep it, and how to make us delete it.

Last updated: 29 September 2026

1. Who we are

BlackDevil Creative is the trading name of GP Economy S.R.L.S., a company registered in Italy, which is the data controller for the personal data described here.

Controller: GP Economy S.R.L.S.
Registered office: Via San Francesco da Paola 71, 89127 Reggio Calabria, Italy
VAT number: P.IVA 03330180807
Contact for privacy matters: info@blackdevilcreative.com
Certified email (PEC): gpeconomy@pec.it

We have not appointed a Data Protection Officer, and are not required to.

2. What we collect

2.1 When you send a project brief

The brief form at /start/ is the only place on this site where you can give us personal data. What it asks for:

About you: your name, your email address, your role in the company, and the country you are in.
About your company: company name, website, social profiles, what you sell and at what prices, where you sell it, who your customers are, competitors you rate, and how decisions get made internally.
About the project: what you need, what success looks like, budget range, timeline, constraints, a link to any files you want to share, and how you found us.
Technical, added automatically: the time of submission and a randomly generated reference for the submission.

Most of these fields are about your business rather than about you personally. Where the two overlap — a sole trader's business email, for instance — we treat the whole thing as personal data, which is the safer reading.

Please do not put special category data in the brief: health information, political or religious views, trade union membership, and similar. The form does not ask for any of it and we do not want it.

2.2 A draft saved in your own browser

While you are filling in the brief, your answers are saved locally in your browser so you do not lose them if you close the tab. That draft stays on your device and is never sent to us until you press submit. Clearing your browser storage deletes it.

2.3 Server logs

Our host records standard technical information when a page is requested: IP address, time, the page requested, and browser type. These logs exist to keep the site running and to stop abuse. We do not use them to build a picture of you, and we do not combine them with anything else.

3. Why, and on what legal basis

To answer your brief and quote for the work: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. This is why the brief exists, and without the required fields we cannot give you a useful answer.
To send you a confirmation with a copy of what you submitted: Article 6(1)(b) GDPR, same basis. It is part of answering you, and it means you have your own record of the brief.
To keep the form from being abused by bots: Article 6(1)(f) GDPR — our legitimate interest in a working contact form and a site that stays up.
To keep a record of enquiries and of work we have quoted for: Article 6(1)(f) GDPR — our legitimate interest in running the business and in being able to reconstruct what was agreed. You can object to this: see section 8.
To meet accounting and tax obligations, once you become a client: Article 6(1)(c) GDPR — a legal obligation under Italian law.

We do not send marketing email. Submitting a brief does not put you on a list, because there is no list.

There is no automated decision-making and no profiling. A person reads every brief.

4. Who else sees it

Your brief is read by us. Beyond that, it passes through three suppliers, each acting as a processor on our instructions under Article 28 GDPR:

Cloudflare, Inc.: Hosts the website, runs the code that receives the form, stores the submitted brief, and provides the bot check on the form.
Resend (Plus Five Five, Inc.): Sends the two emails triggered by a submission: the copy to us, and the confirmation to you.
Apple (iCloud Mail): Hosts our mailbox, and therefore holds the email conversation that follows your brief, in the same way it holds any other correspondence.

We do not sell personal data, we do not share it with advertising networks, and we do not pass it to other clients or agencies. We may disclose data if a court or a competent authority lawfully requires it.

5. Transfers outside the EEA

Cloudflare and Resend are established in the United States, so some processing happens outside the European Economic Area. These transfers rely on the European Commission's Standard Contractual Clauses, incorporated in our contracts with each supplier, together with the additional safeguards those suppliers publish. You can ask us for a copy of the relevant terms.

6. How long we keep it

Briefs that do not become projects: 24 months from submission, then deleted. We keep them this long because enquiries often come back a year later, and it is faster for you if we still have the context.
Briefs that become projects: For the life of the project and 10 years afterwards, matching the retention period Italian law requires for accounting records.
Server logs: Kept by our host for a short technical period, then deleted automatically.
The draft in your browser: Until you submit the form or clear your browser storage. It is on your device, not ours.

You can ask us to delete a brief earlier than this. See section 8.

7. Cookies and analytics

This site sets no analytics cookies and runs no tracking scripts. There is no Google Analytics, no advertising pixel, no heatmap, and no cookie banner — because there is nothing to consent to.

There is one exception, and it is on one page. The brief form at /start/ uses Cloudflare Turnstile to check that a submission comes from a person rather than a script. To do that, the page loads a script from challenges.cloudflare.com and Turnstile may store a short-lived token in your browser. It is strictly necessary for the form to work, it is not used to track you across sites, and it does not build an advertising profile.

There is a second, and it is ours. If you pick a language from the switcher at the top of the page, we store your choice in a cookie named bd_lang so the site stays in that language on your next visit. It holds two letters — en, it or de — lasts a year, and is readable only by our server. It is set only when you click, never by simply visiting: when you have made no choice, the language is worked out fresh on each request from the Accept-Language header your browser already sends, and nothing is stored. Clearing your cookies removes it.

Everywhere else, fonts, images, stylesheets and scripts are served from this domain: loading any other page here makes no request to any third party at all.

8. Your rights

Under the GDPR you can ask us to:

Give you a copy of the personal data we hold about you (Article 15).
Correct it if it is wrong or incomplete (Article 16).
Delete it (Article 17). We will, unless we are legally required to keep it — invoices, for example.
Restrict how we use it while a dispute about it is resolved (Article 18).
Receive it in a portable format so you can take it elsewhere (Article 20).
Object to processing we base on legitimate interest (Article 21).

Write to info@blackdevilcreative.com and we will answer within one month, as the GDPR requires. Exercising these rights is free. We may ask you to confirm your identity first, so that we do not hand your data to somebody else.

9. Complaints

If you think we have handled your data badly, tell us first — it is usually quicker. You also have the right to complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the supervisory authority in the EU country where you live or work.

10. Changes to this policy

If this policy changes, the new version goes up on this page with a new date at the top. If a change materially affects people whose briefs we already hold, we will email them rather than rely on them noticing.