(pursuant to Article 13 of EU Regulation 2016/679 – GDPR)
Last updated: [01/09/2026]
1. Who we are and how to contact us
Data Controller
Sitista Web Design
Address: [Insert full address, street, number, postal code, city, province]
VAT Number / Tax Code: [Insert VAT number or Tax Code]
Email (for privacy matters): [Insert dedicated email, e.g., privacy@yoursite.com]
Phone (optional): [Insert phone number]
Data Protection Officer (DPO) – if mandatory or voluntarily appointed
[Insert "The Data Controller has not appointed a Data Protection Officer as it is not mandatory under Article 37 GDPR." or insert DPO contact details]
2. What personal data we collect and why
Our website is a showcase/landing page. We do not require registration, we do not sell products online, and we do not use analytics or profiling cookies without consent. We only collect the data you voluntarily choose to provide to us.
2.1 Data collected through the contact form
| Type of data | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identification and contact data | First name, last name (or first name only), email address, phone number | To respond to your requests for information, quotes, assistance, or commercial inquiries | Performance of pre-contractual measures (Art. 6(1)(b) GDPR) – i.e., to provide you with a response to your specific request |
| Data contained in the message | Any information you freely write in the message field | To understand and respond to your request | Consent of the data subject (Art. 6(1)(a) GDPR) for any sensitive data you may voluntarily include |
Please note: We kindly ask you not to include data considered "special categories" under Art. 9 GDPR (e.g., health data, political opinions, religious beliefs, sexual orientation, etc.) in the contact form. If you voluntarily do so, the processing will take place solely on the basis of your implicit explicit consent in that specific communication.
2.2 Data collected through the WhatsApp button
| Type of data | Examples | Purpose | Legal basis |
|---|---|---|---|
| Phone number | Your WhatsApp number (collected when you start the chat) | To enable direct and immediate communication via the WhatsApp application | Performance of pre-contractual measures (Art. 6(1)(b) GDPR) |
| Exchanged messages | Content of text, voice, image, and document conversations | To provide assistance, information, or commercial support | Performance of pre-contractual measures (Art. 6(1)(b) GDPR) |
Important: By clicking the WhatsApp button, you will leave our website and be redirected to the WhatsApp application (or its web version). WhatsApp is operated by Meta Platforms, Inc. (or affiliated entities). For direct communication via WhatsApp, WhatsApp's terms and privacy policy apply, which we encourage you to review:
WhatsApp Privacy Policy
We (the Data Controller) will see your phone number and the messages you send us, exactly as in a normal phone call or SMS conversation. We do not use advanced WhatsApp Business APIs for automated promotional messaging.
2.3 Technical browsing data (server logs)
| Type of data | Examples | Purpose | Legal basis |
|---|---|---|---|
| Browsing data | IP address (in anonymized form or otherwise), browser type, operating system, date and time of visit, pages visited | To ensure the proper technical functioning of the website, security, and prevention of cyber attacks | Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) |
This data is stored temporarily (maximum 7 days) and is not used to profile users or for marketing activities.
2.4 Cookies
Our website does not use profiling or analytics cookies. It only uses:
- Strictly necessary technical cookies (e.g., to store your cookie banner acceptance preference, if applicable, or for server load balancing functionality). These cookies do not require your consent under Italian law and the GDPR.
We do not use Google Analytics, Facebook Pixel, retargeting tools, or any other tracking systems.
3. How we process your data (methods)
Your personal data is processed using electronic tools and, where applicable, paper-based tools, in compliance with the principles of lawfulness, fairness, transparency, data minimization, and confidentiality.
We adopt appropriate security measures to protect your data:
- Access to data limited to authorized personnel only (e.g., website administrators, staff responding to inquiries)
- Use of encrypted HTTPS connections
- Secure passwords and regular updates of the content management system (CMS)
4. Who we share your data with (recipients)
Your personal data is not disseminated. It may be shared with the following categories of recipients, acting as Data Processors or as independent Data Controllers:
| Category of recipient | Examples | Role | Data shared |
|---|---|---|---|
| Hosting services | Provider hosting our website | Data Processor | Contact form data (temporarily) and server logs |
| Email services | Gmail, Outlook, business email providers (e.g., Aruba, Register, etc.) | Data Processor | Sender's email address and contact form message content |
| WhatsApp (Meta Platforms) | WhatsApp Inc. / Meta Platforms Ireland | Independent Data Controller | Phone number and message content (for the chat initiated by the user) |
| Public authorities | Law enforcement, judicial authorities (if legally required) | Independent Data Controller | Data necessary to comply with legal obligations |
Specific note on the contact form:
When you fill in our contact form, the data is generally sent via email to the Data Controller's or staff's email address, or stored in a database on the website's server (depending on the technical configuration). In any case, the data is not used for purposes other than responding to your request.
5. Transfer of data outside the EEA
- For the contact form: If we use email services with servers located outside the European Economic Area (EEA) – for example, Gmail (Google LLC, USA) – the transfer takes place on the basis of standard contractual clauses approved by the European Commission and, for Google, adherence to the EU-US Data Privacy Framework.
- For WhatsApp: Data is transferred to Meta's servers in the United States or other third countries. Meta adheres to the EU-US Data Privacy Framework and provides adequate safeguards through standard contractual clauses.
You can review the respective providers' privacy policies for more details:
6. How long we retain your data
We retain your personal data for the time strictly necessary to respond to your request and, subsequently, to comply with any legal obligations.
| Type of data | Retention period |
|---|---|
| Contact form | Up to 12 months from the resolution of the request (to allow us to respond to follow-ups or track interactions with potential clients). After this period, data is deleted or anonymized. |
| Server logs (browsing data) | Maximum 7 days (unless necessary for investigating cyber crimes) |
| WhatsApp conversations | We retain WhatsApp chats on our business device/mobile as part of our normal communication management. We normally delete conversations when no longer relevant (e.g., project completed, request handled). |
| Emails received via the form | Up to 12 months, unless otherwise agreed by contract or required by law. |
7. What your rights are
As a data subject, you have the rights set out in Articles 15-22 of the GDPR. Here is a summary table:
| Right | What it means | How to exercise it |
|---|---|---|
| Access (Art. 15) | You can know whether we are processing your data and receive a copy | Send a written request to [privacy email] |
| Rectification (Art. 16) | You can have inaccurate data corrected | Send a request specifying the error |
| Erasure (Art. 17) | You can obtain deletion of your data (if no legal retention obligations apply) | Send a "right to be forgotten" request |
| Restriction (Art. 18) | You can request that processing be restricted (e.g., while we verify accuracy) | Send a reasoned request |
| Portability (Art. 20) | You can receive your data in a structured format (e.g., CSV, JSON) to transmit it to another Controller | Send a request |
| Objection (Art. 21) | You can object to processing based on our legitimate interest (e.g., server logs) | Send a reasoned objection request |
| Complaint (Art. 77) | You can lodge a complaint with the Italian Data Protection Authority | Contact: https://www.garanteprivacy.it |
Response times: We will respond within 30 days of receiving your request. The service is free of charge.
8. Are you obliged to provide us with your data?
- Contact form: Providing your data (name, email, phone, message) is optional. However, without it, we will not be able to respond to your request for information or a quote.
- WhatsApp button: Starting a chat is optional. If you do not wish to communicate via WhatsApp, you can use the contact form or call us by phone (if we provide a number).
No data is collected automatically without your explicit consent (e.g., no profiling cookies, no tracking).
9. Minors
Our website and the services offered are intended for adults (18 years of age) or, for minors under 18, with the assistance and consent of a parent or legal guardian. We do not intentionally collect data from minors. If we become aware that we have received data from a minor without parental consent, we will immediately delete such information.
10. Changes to this Privacy Policy
We reserve the right to update this policy in the event of regulatory, technological, or organizational changes. In the case of substantial changes, we will notify you via our website (e.g., informational banner). We encourage you to periodically review this page; the date of the last update is indicated at the top.
11. Where and how to submit requests
To exercise your rights, request clarification, or withdraw any consent (if given), please contact us exclusively at:
📧 Email: [Insert dedicated privacy email, e.g., privacy@yoursite.com]
If you prefer regular mail:
📬 [Insert full postal address]
Appendix – Third-party websites (WhatsApp)
Our website may contain a link (or button) that redirects to WhatsApp. By clicking on that link, you leave our website and access a third-party platform. We recommend reading WhatsApp's privacy policy before using the service.
Final implementation instructions:
- Fill in all fields in [ ] with your real business data (name, address, VAT number, privacy email).
- Check whether you use technical cookies – if you do not use any cookies (not even a consent banner or a session cookie to track banner acceptance), you can simplify section 2.4. If you display a banner with an "Accept/Reject" button, you will need to manage a small technical cookie.
- Placement of the Privacy Policy:
- Insert a link in the footer of every page of the website (e.g., "Privacy Policy").
- Insert a link immediately below the contact form (e.g., "By submitting this form, you accept our Privacy Policy" with an optional checkbox; not mandatory under GDPR if the legal basis is pre-contractual, but good practice).
- Insert a link near the WhatsApp button (optional but recommended, e.g., "Chat with us on WhatsApp. Read our Privacy Policy").
- If you add in the future newsletters, Google Analytics, Facebook Pixel, advanced chatbots, or any form of tracking, you will need to update this policy and implement a specific cookie consent banner.
- Retention of requests: Keep a record (even a simple spreadsheet) of data subject rights requests you receive via email, to demonstrate compliance in the event of an inspection.
For maximum safety, always have the text reviewed by a legal professional specialized in privacy