Privacy Policy
Last updated: 3 October 2026
This is a translation. The Italian version is the legally binding one: read it in Italian.
What personal data the PassoDigitale24 website collects, why, for how long, and what rights you have and how to use them simply.
On this page
This page explains what personal data I collect through the passodigitale24.it website, why I do it, how long I keep it and what control you have over it. It is the privacy notice required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
I wrote it to be read, not skipped. If anything is unclear, write to me and I will explain it.
1. Who handles your data
Data controller
Karina Nicoleta Berban, PassoDigitale24
Registered office: Giacciano con Baruchella (RO), Italy
Place of work: Verona (no office open to the public)
VAT no.: 01643600297
Email: info@passodigitale24.it
Phone: +39 353 426 4450
I have not appointed a Data Protection Officer (DPO). My business is not one of the cases where Article 37 of the GDPR makes this mandatory. For any question about your data, write to the address above. I reply personally.
2. What I collect, why and for how long
I only collect the data I need to reply to you and to do my work. No profiling, no automated decisions, no selling of data to third parties.
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Messages you send me on WhatsApp, by email or by phone, and the discovery call | Name, phone number or email address, content of the messages | Pre-contractual measures requested by the data subject (Art. 6(1)(b)) | 24 months from the last contact |
| Client management and invoicing (only if you become a client) | Business and tax details, contact details, amounts | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) | 10 years, as required for accounting records (Art. 2220 of the Italian Civil Code) |
| Newsletter sign-up | Email address | Consent (Art. 6(1)(a)), given with the dedicated checkbox | Until you withdraw it |
| Log of choices made on the cookie banner | A random code generated by the browser, the choice, the banner version, date and page. No data that identifies a person | Legal obligation: being able to demonstrate consent (Art. 7(1) GDPR) | 24 months from the choice |
| Running and securing the website | IP address, browser, page requested, date and time | Legitimate interest in the security of the service (Art. 6(1)(f)) | For as long as the hosting provider keeps its technical logs |
| Statistics and marketing | See the Cookie Policy | Consent (Art. 6(1)(a)) | See the Cookie Policy |
3. Each type of processing in detail
3.1 WhatsApp, email, phone and discovery call
WhatsApp is the only way to write to me from the site: there is no form to fill in. Every button opens a chat with a message already written, which you can edit or not send, and which says which page you came from: it tells me what we are talking about before I even reply.
If you write to me on WhatsApp (I use WhatsApp Business), the message goes through that platform's servers, which handle it as an independent controller under its own privacy notice. I use your name, your number and what you write only to reply, set up the discovery call and prepare your quote. The same applies to emails to info@passodigitale24.it and to phone calls: they are still listed in the footer and on these pages, but they are not the channel I point you to.
You are free to write what you like, but please avoid special category data (health, political or religious opinions, criminal matters): I do not need it and I do not want to handle it. During the discovery call I record nothing without asking you first. Retention: 24 months from the last contact.
The site also has plain links to my social profiles: it does not load their buttons or widgets, so the social networks receive nothing until you click.
3.2 Newsletter sign-up
If you sign up from the form in the footer I collect your email address only, to send you content about websites and being findable online. The legal basis is your consent, given by ticking the dedicated box (never ticked in advance), which you can withdraw whenever you like: from the unsubscribe link in every message, or by writing to me. Withdrawing it does not make the earlier processing unlawful. I keep the address until you withdraw.
It is the only form left on the site, and it is entirely separate from asking for a quote: writing to me on WhatsApp does not sign you up to anything.
3.3 Website check
On the “How hard is your website actually working for you” page you answer eight questions and the result appears in your browser only: nothing reaches me, and if you close the page nothing is left anywhere. The check no longer asks for your email or your website address.
At the end there is a button that opens WhatsApp with the result already written into the message. It is up to you whether to send it: if you do, section 3.1 applies.
3.4 Clients and invoicing
If you accept a quote and become a client, I process the business data needed to perform the contract and issue invoices. I share it with my accountant and keep it for 10 years, as Italian law requires for accounting records.
3.5 Site assistant
The assistant window answers frequent questions with pre-written text. It is not an artificial intelligence, it does not record the conversation and collects no data. When a question goes beyond the pre-written answers it offers to open WhatsApp, carrying over the topic you were asking about: from there, section 3.1 applies.
3.6 Browsing data and system logs
The server hosting the site automatically records, as any web server does, some technical information: IP address, browser and operating system, page requested, date and time. I do not use it to identify you or to build profiles. It keeps the site running, helps diagnose faults and defends against automated attacks: that is the legitimate interest under Art. 6(1)(f) GDPR.
3.7 Statistics and marketing
The site uses traffic measurement and marketing tools, but only after you have explicitly consented through the banner. Until you press “Accept” no request goes out to them and no cookie is written. The full list, tool by tool, with the provider and a link to its privacy notice, is in the Cookie Policy.
If you accept, these tools also receive a few events: opening a WhatsApp chat and from which page, completing the check, switching language, and the fact that you read three quarters of a page. This is pseudonymous browsing data; it does not contain what you write and is not used to identify you.
4. How I handle the data
- Who has access: only me. I have no employees or collaborators with access to your data.
- How I protect it: the website runs over an encrypted connection (HTTPS). Access to the providers' dashboards is protected by strong passwords and two-factor authentication where available.
- No profiling: I do not build profiles or make automated decisions about you (art. 22 GDPR).
- No selling of data: I do not sell, rent or swap your data with anyone.
- Data minimisation: I collect the bare minimum and delete it when the planned period has ended.
5. Who I share it with
Your data is also processed by the technical providers that make the service possible. Each one is appointed as a data processor under art. 28 GDPR and is bound to process it only on my instructions.
| Provider | What it does | Data involved | Privacy policy |
|---|---|---|---|
| Netlify, Inc. | Hosts the website and receives form submissions | All form data, plus technical logs | netlify.com/privacy |
| Register.it S.p.A. | Runs the info@passodigitale24.it mailbox | The emails you send me and the form notifications | register.it |
| Yahoo EMEA Limited | Receives a copy of emails forwarded from info@passodigitale24.it, as an alert | The emails you send me and the form notifications | legal.yahoo.com |
| Google Ireland Ltd. | Website visit statistics (Google Analytics 4), only if you accept analytics cookies | Pseudonymous browsing data: pages viewed, device type, where the visit came from; anonymised IP address | policies.google.com/privacy |
| Microsoft Ireland Operations Ltd. | Heatmaps and anonymous recordings of browsing sessions (Microsoft Clarity), only if you accept analytics cookies | Pseudonymous browsing data: clicks, scrolling, pages viewed, device type; text typed into forms is masked | privacy.microsoft.com |
| Meta Platforms Ireland Ltd. | Measuring visits for any Facebook and Instagram ads (Meta Pixel), only if you accept marketing cookies | Pseudonymous browsing data: pages viewed, device type, browser identifiers | facebook.com/privacy/policy |
This list is short on purpose: the website does not load anything from third-party servers. Fonts, images and videos sit on the same server as the pages. Opening the website does not tell anyone else that you visited, and you do not need to give consent to avoid it.
I may also share data with public authorities when the law requires it, and with my advisers (for example my accountant), limited to the invoicing data of actual clients.
If I switch on the statistics or marketing tools described in the Cookie Policy in the future, I will add their providers to this table before they start working.
6. Transfers outside the European Union
Netlify, which hosts the website and collects form submissions, is a US company and may process data on servers outside the European Union. The same may happen with Yahoo, which is part of a US group, and may apply to other providers I switch on in the future. In those cases the transfer is based on the standard contractual clauses approved by the European Commission and, where the provider has signed up to it, the EU-U.S. Data Privacy Framework.
You can ask me for a copy of the safeguards in place by writing to the controller's address.
7. Your rights and how to use them
The GDPR gives you rights that you can exercise free of charge, at any time:
- Access (art. 15): find out whether I process your data and get a copy.
- Rectification (art. 16): correct wrong or incomplete data.
- Erasure (art. 17): the right to be forgotten, when I no longer have a reason to keep the data.
- Restriction (art. 18): freeze the processing instead of deleting the data.
- Portability (art. 20): receive your data in a format another system can read.
- Objection (art. 21): object to processing based on legitimate interest.
- Withdrawal of consent (art. 7.3): withdraw consent you have already given. This does not make earlier processing unlawful.
How to do it: write to info@passodigitale24.it and say which right you want to exercise. You do not need a special form. I reply within 30 days. If the request is complex, I may extend this by two more months, and I will tell you why.
If you think your data is being handled wrongly, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority), at garanteprivacy.it, or take legal action.
8. Children
The website is aimed at professionals, businesses and companies. It is not intended for children under 16, and I do not knowingly collect their data. If you notice that a child has sent me data, write to me and I will delete it.
9. Changes to this policy
If the tools I use or the purposes of processing change, I update this page and the date at the top. If there are substantial changes to processing based on consent, I will ask for your consent again.
10. Definitions and legal references
- Personal data: any information that can identify you, directly or indirectly.
- Processing: any operation carried out on data: collection, storage, consultation, deletion.
- Data controller: whoever decides why and how the data is processed. In this case, that is me.
- Data processor: whoever processes data on behalf of the controller, following the controller's instructions. Here, that means the technical providers.
- Data subject: the person the data relates to. In this case, that is you.
References: Regulation (EU) 2016/679 (GDPR); D.Lgs. 196/2003 as amended by D.Lgs. 101/2018 (Italian Privacy Code); decisions of the Garante on cookies and tracking tools.