Privacy Policy

Privacy notice for users of the website adnetapp.com (the "Website"), provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the "Italian Privacy Code").

This document explains which personal data we collect through the Website, why, with which tools and providers, how long we keep it and which rights you have. Information on cookies and other tracking tools is in the Cookie Policy, which forms part of this notice.

Last updated: November 7, 2026

Summary

In short, these are the purposes and services for which we process your data. Each item is detailed in the sections below.

Contacting the User and replying to requests

Contact form and quote calculator · data: first and last name, email, phone number, company, service of interest, budget, selected features, message, technical data about the request.
Email, phone · data: what you share with us.

WhatsApp (WhatsApp Ireland Limited) · data: phone number, profile name and message content, only if you choose to message us on WhatsApp.

Contact forms on Facebook and Instagram (Meta Platforms Ireland Limited) · data: name and surname, email, phone, company and answers to the form questions, only if you fill in a form in our ads.

Managing requests and client relationships

Internal request archive (the Website's CRM) · data: what you send through the forms and the history of our communications.
Confirmation emails and notifications · the Controller's email service.

Hosting and operation of the Website

Verpex · data: browsing data and data sent through the forms.
Spam and abuse protection · data: IP address, usage data.
Cookie consent management · data: your choices, random identifier, anonymised IP, browser.
Anonymous internal statistics · aggregate page view counts only, with no cookies or personal data.

Analytics (only with your consent)

Google Analytics 4 (Google Ireland Limited) · data: usage data, online identifiers, device information.

Campaign measurement and advertising (only with your consent)

Meta Pixel (Meta Platforms Ireland Limited) · data: usage data, online identifiers, request submission event.

Google ads and request measurement (only with your consent)

Google Ads (Google Ireland Limited) · data: ad click identifier, usage data, outcome of the request (qualified or became a client).

Displaying content from external platforms

YouTube videos in privacy-enhanced mode (Google Ireland Limited) · data: usage data, IP address; only on pages that contain a video.

Wistia videos (Wistia, Inc.) · data: IP address and technical browser data; only if you start the video.

Google reviews · public data of review authors (display name, profile photo, rating, text, date).

1. Data controller

The data controller is ADNET, registered office: Via Pompeo Sarnelli 297, Polignano a Mare (BA), 70044, VAT no. 08289880729 (the "Controller").

• Contact email: info@adnet-office.it
• Phone: +39 351 900 8779

The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply. For any question about this notice or to exercise your rights, write to the email address above.

2. Types of data collected

The Website collects, directly or through third parties, the following categories of personal data.

a) Browsing and usage data

The IT systems and software that run the Website acquire, during normal operation, some data whose transmission is implicit in the use of Internet communication protocols. This includes: IP address, browser type and operating system, device domain name, URIs of the requested resources, time of the request, method used, response size, server response status code and other parameters about the user's device and IT environment. This data is not collected to be associated with identified individuals, but by its nature it could allow identification when processed and combined with data held by third parties.

b) Data you provide voluntarily

When you fill in the contact form or the quote calculator we collect: first and last name, email address, phone number, company name (optional), service of interest, indicative budget, selected features and estimated total, the text of your message and the Website language. Together with the request we record some technical data needed to handle it and to prevent abuse: IP address, browser (user agent), landing page and referring site; only if you have accepted analytics tools, also the parameters of the campaign you came from (UTM).

We also process the personal data contained in the communications you send us by email, phone or messaging apps.

Please do not include special categories of data (for example health data, political opinions or religious beliefs) or third-party data in the forms unless strictly necessary to describe your project. If you share other people's data with us, you confirm that you have informed them and are entitled to do so.

c) Cookies and other tracking tools

The Website uses tools that are necessary for it to work and, only with your consent, analytics and marketing tools. Types, purposes, duration and providers are described in the Cookie Policy.

d) Data made public by third parties

The Website displays the reviews users have published on the Controller's Google Business Profile (display name, profile photo if any, rating, text and date). This data has been made public by the authors themselves on Google's platform.

Unless otherwise stated, providing the data marked as required in the forms is necessary to reply to your request; failure to provide it makes it impossible to follow up. Providing optional data is free and has no consequences.

3. Methods and place of processing

Methods

The Controller processes personal data using IT and electronic tools, in ways strictly related to the stated purposes, and adopts appropriate technical and organisational measures to ensure security and confidentiality and to prevent unauthorised access, disclosure, modification or destruction. These include: encrypted connections (HTTPS), password-protected access to the admin panel limited to authorised people, protection against repeated login attempts, backups, software updates, data minimisation and automatic periodic deletion of data that is no longer needed.

Besides the Controller, the data may be accessed, within the limits of their duties, by persons authorised to process it (for example staff handling requests and developing projects) and by external parties acting on the Controller's behalf, appointed as data processors under Article 28 GDPR (hosting, email and IT service providers). An up-to-date list of processors is available from the Controller on request.

Place

Data is processed at the Controller's premises and wherever the parties involved in the processing are located. The Website and its database are hosted by Verpex on servers located in European Union (Frankfurt). Some providers described in this notice may also process data outside the European Economic Area (EEA): in these cases the safeguards described in section 8 apply.

Retention period

Data is kept for as long as necessary to achieve the purposes for which it was collected, as set out in section 7. After that, it is deleted or irreversibly anonymised. As a result, once the retention period expires, the rights of access, erasure, rectification and portability can no longer be exercised.

4. Purposes of processing

Data is collected for the following purposes:

• replying to requests for information and quotes and contacting you to follow up;
• managing negotiations and, if you entrust us with a project, the contractual relationship (analysis, design, development, publication, support, invoicing);
• ensuring the operation and security of the Website and protecting it from spam, fraud and abuse;
• managing and documenting your cookie choices;
• only with your consent, producing statistics on the use of the Website to improve its content and operation;
• only with your consent, measuring the effectiveness of advertising campaigns and showing relevant ads on Meta platforms;
• only with your consent, measuring which Google ads bring requests and clients, to spend the advertising budget on the most useful ads;
• complying with obligations under laws, regulations and EU legislation and with requests from authorities;
• establishing, exercising or defending the Controller's rights in or out of court.

5. Detailed information on the processing of personal data

Personal data is collected for the purposes and through the services described below.

5.1 Contacting the User

Contact form and quote calculator (this Website)
By filling in the contact form or the quote calculator, you agree to the use of the data entered to reply to requests for information, quotes or anything else stated in the form's header. When you submit it, you receive an automatic confirmation email at the address you provided.
Data processed: first and last name, email, phone, company, service of interest, budget, selected features, estimated total, message, language, IP address, user agent, landing page, referrer and, with consent to analytics tools, UTM parameters.
Legal basis: pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
Retention: 24 months from the last interaction if the request does not turn into an engagement; for the duration of the relationship and then for the period required by law if you become a client.

Contact by email and phone
If you contact us directly using the details published on the Website, we process the data you share to reply.
Data processed: email address or phone number, name and the content of the communication.
Legal basis: pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR) or legitimate interest in replying to communications received (Art. 6(1)(f) GDPR).

WhatsApp (WhatsApp Ireland Limited)
The Website contains buttons that open a WhatsApp conversation with the Controller. The button is a plain link: no data is sent to WhatsApp until you tap it. If you choose to message us on WhatsApp, WhatsApp's processing of your data is governed by its privacy policy.
Data processed: phone number, profile name, message content.
Legal basis: pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR).
Place of processing: Ireland, with possible transfers to the United States (see section 8). WhatsApp Privacy Policy.

Contact forms in our Facebook and Instagram ads (Meta Platforms Ireland Limited)
If you fill in a contact form inside one of our ads on Facebook or Instagram, Meta collects the data you enter (some fields may be pre-filled from your profile) and makes it available to us. We copy it into the Website's internal request archive to reply to you, with the same purposes, retention and rights described for the Website's forms. Meta processes this data as an independent controller according to its own policy.
Data processed: name and surname, email address, phone number, company name, answers to the form questions, campaign and ad from which you sent the request.
Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR).
Place of processing: Ireland, with possible transfers to the United States (see section 8). Meta Privacy Policy.

5.2 Managing requests and contacts

Internal request archive
Requests sent from the Website are stored in the Website's database and managed by the Controller through a private admin panel, which records the status of the negotiation and the history of communications.
Data processed: all data sent through the forms, internal notes and contact history.
Legal basis: pre-contractual measures and performance of a contract (Art. 6(1)(b) GDPR); legitimate interest in organising the business (Art. 6(1)(f) GDPR).
Retention: requests that do not turn into an engagement are automatically deleted 24 months after the last update.

Email service (Verpex)
Notifications of new requests and confirmation emails are sent through the Controller's email service.
Data processed: email address, name and content of the request.
Legal basis: pre-contractual measures at the data subject's request (Art. 6(1)(b) GDPR).

5.3 Hosting and infrastructure

Verpex
The Website, its database and the server logs are hosted by Verpex, which provides the technical infrastructure needed to deliver the Website and acts as a data processor.
Data processed: browsing data and all data sent through the Website.
Legal basis: legitimate interest in making the Website available and secure (Art. 6(1)(f) GDPR) and pre-contractual measures for form data (Art. 6(1)(b) GDPR).
Place of processing: European Union (Frankfurt).

Locally hosted resources
Fonts, animation libraries, images and review photos are hosted directly on the Website's server: displaying them does not send any data to third-party providers (for example Google Fonts).

5.4 Security and spam protection

Anti-spam and security systems (this Website)
To protect the forms and the admin panel, the Website uses automatic checks: fields invisible to visitors, minimum completion time, a check that the form is filled in from a browser, filters on message content (for example links and advertising text), a check that the email address domain exists, a limit on submissions from the same IP address and blocking of repeated login attempts. Requests recognised as automated are kept separately and are not answered.
Data processed: IP address, usage data.
Legal basis: legitimate interest in the security of the Website and abuse prevention (Art. 6(1)(f) GDPR).
Retention: data about login attempts is deleted within 24 hours.

Cloudflare Turnstile (Cloudflare, Inc.)
On pages with a contact form the Website uses Cloudflare Turnstile to check that the sender is a person and not an automated program. The check usually requires no action from you; Turnstile does not use profiling cookies or data for advertising.
Data processed: IP address, technical browser and device data, page interaction data needed for the check.
Legal basis: legitimate interest in the security of the Website and abuse prevention (Art. 6(1)(f) GDPR).
Place of processing: United States and European Union, under the safeguards provided by the GDPR (see section 8). Cloudflare Privacy Policy.

5.5 Consent management

Cookie banner and consent log (this Website)
The Website records the choices you make on the cookie banner in order to respect them and, where necessary, to demonstrate that consent was collected correctly (Art. 7(1) GDPR).
Data processed: random choice identifier, accepted or rejected categories, notice version, date and time, anonymised IP address (last part removed), browser.
Legal basis: legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR).
Retention: 24 months, then automatic deletion.

Anonymous internal statistics (this Website)
To understand which pages are useful and which need improving, the Website counts in aggregate how many times each page is viewed and which type of source visits come from (search engine, AI assistant, social network, another website or direct access). Only a counter per page and per day is stored: no IP address, no identifier, no cookie or other tool stored on the device, no information that could identify an individual visitor. Visits from automated programs (bots) are not counted. In addition, when you submit a form, the page you submitted it from is recorded.
Data processed: no personal data (aggregate counts only); for forms, the address of the submission page together with the request.
Legal basis: legitimate interest in improving the Website (Art. 6(1)(f) GDPR); consent is not required because no information on the device is accessed.
Retention: counts for 25 months, then automatic deletion.

5.6 Analytics

Google Analytics 4 (Google Ireland Limited)
Google Analytics 4 is a web analytics service that lets the Controller understand, in aggregate form, how the Website is used (pages visited, traffic sources, devices, interactions) and improve its content. It is loaded only after you consent to the "Analytics" category. According to Google, Google Analytics 4 does not log or store the IP addresses of users in the European Union.
Data processed: usage data, online identifiers (cookies), device and browser information, approximate location, request submission event.
Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code), which can be withdrawn at any time.
Place of processing: Ireland, with possible transfers to the United States (see section 8).
Retention: according to the service settings, up to 14 months for event-level data; cookies up to 2 years (see Cookie Policy).
Google Privacy Policy · Google Analytics opt-out browser add-on.

5.7 Campaign measurement and advertising

Meta Pixel (Meta Platforms Ireland Limited)
Meta Pixel is an analytics and advertising service by Meta that links visits to the Website and request submissions to advertising campaigns on Facebook and Instagram, to measure their effectiveness and show relevant ads to groups of users. It is loaded only after you consent to the "Marketing" category. For event measurement, the Controller and Meta act as joint controllers under Article 26 GDPR, in accordance with Meta's Controller Addendum.
Data processed: usage data, online identifiers (cookies), device and browser information, request submission event.
Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code), which can be withdrawn at any time.
Place of processing: Ireland, with possible transfers to the United States (see section 8).
Retention: cookies up to 90 days (see Cookie Policy); data held by Meta according to its policy.
Meta Privacy Policy · Meta ad preferences.

5.7a Google ads and conversions

Google Ads – conversion tracking (Google Ireland Limited)
If you reach the Website by clicking a Google ad and accept the "Marketing" category, the Website loads the Google Ads tag and keeps the ad click identifier (gclid or similar) together with your request. When the request becomes a quote or an engagement, the Controller sends Google only that identifier, the type of outcome, the date and any value, to learn which ads work. Your name, email and phone number are not sent to Google. Without "Marketing" consent the identifier is not stored and nothing is sent to Google.
Data processed: click identifier, usage data, online identifiers (cookies), outcome of the request.
Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code), which can be withdrawn at any time.
Place of processing: Ireland, with possible transfers to the United States (see section 8).
Retention: the identifier stays with the request for the periods in section 7; cookies up to 90 days.
Google Privacy Policy · Google ad settings.

5.8 Displaying content from external platforms

YouTube videos in privacy-enhanced mode (Google Ireland Limited)
Some pages (for example blog posts or case studies) may contain YouTube videos. Videos are embedded through the youtube-nocookie.com domain ("privacy-enhanced mode"): YouTube does not store information on your device until you start playback. Loading the player still sends your IP address and the technically necessary browsing data to Google; once you start playback, YouTube may use tracking tools according to its own policy.
Data processed: usage data, IP address, online identifiers after playback starts.
Legal basis: legitimate interest in showing relevant multimedia content (Art. 6(1)(f) GDPR); for any tracking after playback starts, your choice to play the video.
Place of processing: Ireland, with possible transfers to the United States (see section 8). Google Privacy Policy.

Wistia videos (Wistia, Inc.)
The home page and some service presentation pages contain a video hosted on Wistia. Until you press play you only see a preview image stored on the Website's server: your browser does not connect to Wistia. When you start the video, the player is loaded from Wistia's servers with viewing statistics disabled ("doNotTrack"); Wistia still receives your IP address and the technical browser data needed to stream the video.
Data processed: IP address, technical device and browser data, player usage data.
Legal basis: your request to play the video and the legitimate interest in presenting the services with multimedia content (Art. 6(1)(b) and 6(1)(f) GDPR).
Place of processing: United States, under the safeguards provided by the GDPR (see section 8). Wistia Privacy Policy.

Google reviews (Google Places API)
Reviews from the Controller's Google Business Profile are retrieved by the Website's server through Google's services and stored in the database, including profile photos: your browser does not connect to Google to display them and no visitor data is sent to Google.
Data processed: public data of review authors (display name, profile photo, rating, text, date).
Legal basis: legitimate interest in transparently presenting client feedback (Art. 6(1)(f) GDPR). Authors can ask the Controller at any time to remove their review from the Website.

Links to external websites and platforms
The Website contains links to third-party sites (for example App Store, Google Play, social profiles, client websites). These are plain links: no data is sent until you open them. The Controller is not responsible for the processing carried out by those sites; please refer to their privacy notices.

6. Legal basis of processing

The Controller processes personal data where one of the following applies:

• you have given consent for one or more specific purposes (Art. 6(1)(a) GDPR);
• processing is necessary for the performance of a contract with you or for pre-contractual measures taken at your request (Art. 6(1)(b) GDPR);
• processing is necessary to comply with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR);
• processing is necessary for the legitimate interests of the Controller or a third party, unless overridden by your interests or fundamental rights and freedoms (Art. 6(1)(f) GDPR).

Where processing is based on legitimate interest, the Controller has assessed that it is balanced against your rights, taking into account your reasonable expectations and the measures adopted. You may ask for information about this assessment and object to the processing as described in section 9. You can always ask the Controller to clarify the specific legal basis of each processing activity.

7. Retention period

Where processing is based on consent, data is kept until consent is withdrawn. Where it is based on legitimate interest, for as long as that interest exists or until your objection is upheld. The Controller may keep data longer where required to comply with a legal obligation, by order of an authority or to protect its rights in court.

8. Recipients and data transfers

Recipients

Data may be disclosed to: IT and technology service providers acting as data processors (hosting, email, Website maintenance); professionals and consultants assisting the Controller (for example accountants, legal advisers), bound by professional secrecy or confidentiality obligations; public and judicial authorities where required by law. The third-party service providers listed in section 5 process data within the limits described. Data is not disseminated or sold to third parties.

Transfers outside the European Economic Area

Some providers (in particular Google and Meta and, to a limited extent, infrastructure providers) may also process data in the United States or other countries outside the EEA. Transfers only take place with the safeguards required by Articles 44-49 GDPR:

• to countries or recipients covered by a European Commission adequacy decision, including the decision of 10 July 2023 on the EU-U.S. Data Privacy Framework for certified US companies (such as Google LLC and Meta Platforms, Inc.);
• otherwise, on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), supplemented by additional measures where necessary.

You can obtain more information on the safeguards adopted and a copy of them by writing to the Controller.

9. Your rights

At any time, free of charge, you may exercise the rights provided by Articles 15-22 GDPR against the Controller:

• Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. For cookies, use the "Cookie preferences" link at the bottom of every page.
• Object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR).
• Access your data: obtain confirmation of whether processing is taking place, information about it and a copy of the data (Art. 15 GDPR).
• Verify and request rectification of inaccurate data or its completion (Art. 16 GDPR).
• Request erasure of your data ("right to be forgotten") where the conditions of Art. 17 GDPR apply.
• Obtain restriction of processing in the cases set out in Art. 18 GDPR.
• Receive your data or have it transferred to another controller, in a structured, commonly used and machine-readable format, where processing is based on consent or a contract and carried out by automated means (Art. 20 GDPR).
• Lodge a complaint with the competent supervisory authority: in Italy the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it), or the authority of the EU Member State where you habitually reside, work or where the alleged infringement took place, or take legal action.

Details on the right to object

Where data is processed in the public interest, in the exercise of official authority or to pursue a legitimate interest of the Controller, you may object on grounds relating to your particular situation. If data were processed for direct marketing purposes, you may object at any time without giving any reason. The Website does not send marketing communications or newsletters.

How to exercise your rights

To exercise your rights, write to info@adnet-office.it. Requests are free of charge and are answered without undue delay and in any case within one month, which may be extended by two months for complex or numerous requests (in which case we will let you know within the first month). The Controller may ask for information needed to verify your identity. Any rectification, erasure or restriction will be communicated to the recipients to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort.

10. Automated decision-making and profiling

The Controller does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The estimated total shown by the quote calculator is a non-binding price indication for both you and the Controller and is not an automated decision.

With your consent to marketing tools, Meta may use the data collected through the Pixel to show you relevant ads, according to its own policy.

11. Children

The Website and the Controller's services are aimed at professionals and businesses and are not intended for people under 18. The Controller does not knowingly collect data from minors; if you believe a minor has sent us personal data, let us know and we will delete it.

12. Further information on processing

Legal action

Data may be used by the Controller in court or in the steps leading to possible legal action arising from improper use of the Website or related services, and to establish, exercise or defend its rights. The Controller may also be required to disclose data at the request of public authorities.

Specific information

Upon request, in addition to the information in this notice, the Website may provide additional and contextual information about specific services or the collection and processing of personal data.

System logs and maintenance

For operation and maintenance purposes, the Website and any third-party services it uses may collect system logs, i.e. files that record interactions and may contain personal data such as the IP address.

Information not contained in this notice

More details on the processing of personal data may be requested from the Controller at any time using the contact details in section 1.

"Do Not Track" and Global Privacy Control signals

The Website does not change its behaviour based on "Do Not Track" requests sent by the browser. However, analytics and marketing tools are never activated without your explicit consent given through the cookie banner.

13. Changes to this notice

The Controller reserves the right to amend this notice at any time by informing users on this page and indicating the date of the last update at the top. Please check it periodically. If the changes affect processing based on consent, the Controller will collect consent again where necessary.

14. Definitions and legal references

Personal Data (or Data): any information that, directly or indirectly, including in connection with other information such as a personal identification number, makes a natural person identified or identifiable.

Usage Data: information collected automatically through the Website, including by third-party applications integrated into it, such as: IP address or domain name of the device, URIs of requested resources, time of the request, method, response size, status code, country of origin, browser and operating system features, visit duration and path followed within the Website.

User: the individual using the Website who, unless otherwise specified, coincides with the Data Subject.

Data Subject: the natural person to whom the Personal Data refers.

Data Processor: the natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller (Art. 28 GDPR).

Data Controller: the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

Consent: any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which they agree to the processing of their data (Art. 4(11) GDPR).

Cookies and tracking tools: small files or pieces of data stored on or read from the User's device (cookies, local storage, pixels and similar technologies), described in the Cookie Policy.

European Economic Area (EEA): the Member States of the European Union, Iceland, Liechtenstein and Norway.

Legal references: Regulation (EU) 2016/679 (GDPR); Italian Legislative Decree no. 196 of 30 June 2003 as amended by Legislative Decree no. 101 of 10 August 2018 (Italian Privacy Code); Directive 2002/58/EC (ePrivacy); Guidelines of the Italian Data Protection Authority on cookies and other tracking tools of 10 June 2021. This notice relates solely to the Website.