Notice
Privacy notice
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"). Last updated: 6 October 2026.
1. Data controller
Volano di Spadoni Andrea (“Volano”), registered office at Via Enrico Mattei 22/2, 60019 Senigallia AN, VAT no. IT02563590427, email sig.spado@me.com.
2. What data we process, why and for how long
Requesting the free audit or a preview of the new website
Name, company, email, phone number if you provide it, website address and your answers to the form (for the new website, also any text, photos, documents and social media links you upload). We use them to analyse your website, prepare the report and the preview, and send them to you. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b)). We keep the data for as long as needed to handle your request; you can ask for it to be deleted at any time.
Clients
Contract and billing data, and the content and login details you entrust to us in the client area (passwords are stored encrypted). Legal basis: performance of the contract (point b) and legal obligations (point c). Accounting records are kept for 10 years (Art. 2220 of the Italian Civil Code); everything else is kept for the duration of the service, then returned or deleted.
Researching businesses to contact
We collect from public sources (company websites, Google Maps listings) the business name, address, phone number, website and published email addresses, in order to assess whether their website could be improved and to offer our service. Legal basis: legitimate interest in making our services known to other businesses (point f), with no automated or bulk mailings. You can object at any time: we will stop contacting you immediately and delete the data, keeping only what is needed to avoid contacting you again.
Browsing data
For technical reasons, our servers receive your IP address, the date and time, the page requested and the browser type. This data is used to run and protect the website (legitimate interest, point f) and is kept in the hosting provider's technical logs only for as long as strictly necessary.
Facebook and Instagram ads (Meta Pixel and Conversions API)
Only if you accept marketing cookies in the cookie banner, your browser loads the Meta pixel, which records the public pages you visit and certain steps: requesting your website score, opening the payment page, creating an account, starting the trial and subscribing. The pixel does not run on pages with a personal link (client area, proposal, score, preview, contracts). When you pay for a subscription, if you have given your consent, our server sends Meta the same event via the Conversions API: your email converted into an unreadable code (SHA-256), the _fbp and _fbc cookie identifiers, browser type, IP address, amount and currency. This data is used to find out how many people who arrive from our ads try the service and subscribe, and to have the ads shown to people who may be interested.
Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time via "Cookie preferences" at the bottom of every page, with no effect on the service. For the collection and transmission of this data we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR, under Meta's terms for data from business tools); any further processing is decided by Meta, as explained in its privacy policy, which you can also refer to in order to exercise your rights. Meta may transfer the data to the United States (Meta Platforms, Inc. participates in the Data Privacy Framework). We keep the identifiers collected at payment for a maximum of 6 months, the time needed to report to Meta a subscription that starts after the trial; the campaign you arrived from (the link's utm parameters) is kept with your request and the client data.
3. Who we entrust data to
Only to suppliers we need in order to work, appointed as data processors (Art. 28): server and database hosting; card payments (Stripe: card details are processed only by Stripe, and we never see them); sending emails; internal Telegram notifications to the agency; business profiles on Google Maps; artificial intelligence services which, if enabled, help us write the website copy based on the public content of your website and the materials you upload; electronic invoicing. Only with your consent, Meta to measure our ads (see "Facebook and Instagram ads"). We do not sell or transfer your data and we do not use it for third-party advertising. The up-to-date list of suppliers can be requested from sig.spado@me.com.
4. Transfers outside the European Union
Some providers may process data in the United States or in other countries outside the EU: such transfers take place on the basis of the EU-US adequacy decision (Data Privacy Framework) for certified providers, or of the European Commission's standard contractual clauses (Articles 45 and 46 GDPR).
5. Our clients' websites
For the websites we build, the data controller is our client, whose details you will find in the privacy notice on their website; we act as data processor for technical management.
6. Your rights
Access, rectification, erasure, restriction, portability and objection (Articles 15–22 GDPR), and withdrawal of consent where processing is based on it. Write to us at sig.spado@me.com: we will reply within one month. You can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it). We do not make decisions based solely on automated processing.