Privacy Policy

1. Data Controller

Hill River Design, Via Monte Misma 1, 24060 Gorlago BG, Italy. Email: hello@hillriverdesign.com. Phone: +39 035 954 638. P.IVA: IT-XXXXXXXXXXX.

2. Applicable Legislation

GDPR (EU 2016/679); Codice Privacy (D.lgs. 196/2003 as amended by D.lgs. 101/2018); Garante guidelines; D.lgs. 70/2003; Codice del Consumo (D.lgs. 206/2005). Supervisory authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.

3. Data Categories

Contact: Name, email, phone, company. Project data: Figma access, brand assets, user research data — confidential under NDA. Payment: Stripe (PCI DSS L1). Analytics: Plausible (cookieless, EU-hosted).

4. Legal Bases

Contract (Art. 6(1)(b)). Legal obligation (Art. 6(1)(c)). Legitimate interest (Art. 6(1)(f)). Consent (Art. 6(1)(a)).

5. Project Data Confidentiality

All project files NDA-protected, AES-256 encrypted, EU servers, accessible only to assigned team, deleted within 90 days of engagement end upon request.

6. Your Rights

Access, rectification, erasure, restriction, portability, objection. Contact: hello@hillriverdesign.com. 30 days. Garante complaint available.

7. Retention

Client data: engagement + 10 years. Invoices: 10 years. Project files: engagement + 90 days. Research data: project + 30 days.

8. Security

TLS 1.3, AES-256, MFA, EU servers, NDA for all team, 72h breach notification.

Last updated: March 2026.