Privacy
Last updated 11 November 2026
Plain-language summary
We collect only what you type into a form or need for an order. No analytics, no advertising trackers, no newsletter. Stripe handles card payments; we never see your card. Order and invoice records are kept for 10 years because tax law says so; messages and quote requests for 12 months; project materials until after handover. You can ask to see, correct or delete your data, and complain to the Italian data protection authority.
This summary helps you find your way; the sections below are the notice.
1. Who is responsible
The data controller is Zhiheng Zhong (Design Plus Dev), Via Acerbi, 10, 20022 Castano Primo (MI), Italy. Email office@designplusdev.com, phone +39 313 219 0730. Write to that email for anything on this page.
We haven’t appointed a data protection officer; as a one-person business we’re not required to.
2. What we collect, and why
| Where | What | Why (legal basis) | Kept for |
|---|---|---|---|
| Checkout and order | Name, email, buyer type, what you bought, amount, your consent records with time, Stripe payment reference | To make and carry out the contract (art. 6(1)(b) GDPR); to keep accounting and tax records (art. 6(1)(c)) | 10 years from the order |
| Brief form | What you tell us about your business, links to your files, colours, references, deadlines | To do the work you’ve ordered (art. 6(1)(b)) | Until the project’s handover, then deleted within 90 days |
| Invoice details (in the brief) | The company’s name, VAT number, codice fiscale, Codice Destinatario or PEC, billing address | Tax and invoicing obligations (art. 6(1)(c)) | 10 years |
| Quote form | Name, company, email, phone if given, what you tell us about your catalogue | To answer your request before a possible contract (art. 6(1)(b)) | 12 months, or as order records if you then buy |
| Contact form and emails | Name, email, your message | To answer you (art. 6(1)(f), our legitimate interest in replying) | 12 months from the last message |
| Withdrawal form | Name, order reference or email, acknowledgement email, your message, date and time | To meet our legal duty to record and acknowledge withdrawals (art. 6(1)(c)) | 10 years, with the order records |
| Server logs | IP address, browser type, page requested, time | Security and abuse prevention (art. 6(1)(f)) | 30 days |
Giving us the data marked as required on a form is needed to do what the form is for; without it we can’t take the order or answer.
Tools that stay in your browser. The catalogue sizer, the header-paste classifier, the yarn test and the swatch download all run on your device. What you paste into them isn’t sent to us unless you then send a form or place an order with the note attached.
3. Who else sees it
- Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments. It acts on our behalf for the payment itself and, for its own fraud-prevention and legal duties, as a separate controller under its own privacy policy. Stripe may transfer data outside the EU under the safeguards described in that policy.
- The company that hosts this website and our email, which stores form messages and order records for us under a data processing agreement.
- Our accountant, for tax and accounting records.
- Authorities, only where the law requires it.
We don’t sell your data or share it for advertising.
4. Cookies and local storage
Only technical storage that the site needs: details on the Cookies page. No analytics or advertising cookies.
5. Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy;
- correct it;
- delete it, where we don’t have to keep it by law;
- restrict how we use it;
- send it to you or another company in a common format (portability);
- stop using it where we rely on our legitimate interest (objection).
Write to office@designplusdev.com. We answer within one month. We may ask you to confirm who you are first.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, garanteprivacy.it), or the authority where you live or work in the EU.
6. Security
Forms are sent over an encrypted connection and checked against spam and abuse. Card data goes straight to Stripe and never reaches our server. Access to order records is limited to us.
7. Children
Our services are for adults. We don’t knowingly collect data from anyone under 18.
8. Automated decisions
We don’t make decisions about you by automated means alone, and we don’t profile visitors.
9. Changes
If this notice changes, the new version appears here with a new date. For anything that affects an order in progress, we’ll also email you.