Privacy Policy

This policy describes how VisionFlow ("we", "the studio") processes the personal data of users who visit the website and use the contact form, in accordance with Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 (Privacy Code, as amended by Legislative Decree 101/2018) and the Italian Data Protection Authority's Guidelines on cookies and other tracking tools (2021).

The website uses two web-analytics tools — Google Analytics 4 and Yandex Metrica. Neither loads before your consent: until you press "Accept" in the cookie banner, no analytics script is added to the page. After consent, statistical data about the visit is collected: pages viewed, referral source, device and browser type, visit duration. Reports are aggregated and are not used to identify an individual visitor.

The site carries no profiling or advertising tools: no advertising-network pixels, no remarketing. In Yandex Metrica, Webvisor is disabled — no session recording or screen content is captured. Besides analytics, identifying data is processed through the contact form and the server's technical logs, as described below.

1. Data Controller

The Data Controller is:

• {{LEGAL_NAME}} (VisionFlow)
• VAT no. (P.IVA): {{VAT}}
• Registered office: {{REGISTERED_ADDRESS}} — Milan, Italy
• Phone: {{PHONE}}
• E-mail: hello@visionflow.video

The studio has not appointed a Data Protection Officer (DPO), as the mandatory conditions under Art. 37 GDPR do not apply. For any request concerning personal data, you may write to the e-mail address above.

2. Personal data we collect

2.1 Data provided through the contact form

When you complete and submit the contact form, we collect the data you enter yourself:

• Name;
• E-mail address;
• Project type (e.g. brand, corporate, content, event, personal, other);
• Budget range indicated;
• Timeline requested;
• Free-text message (whose content is determined by you: please do not include unnecessary data or special categories of data within the meaning of Art. 9 GDPR);
• GDPR consent: we record the fact that the consent checkbox was ticked at the time of submission.

The form also contains a hidden anti-spam field ("honeypot"): it is neither visible nor fillable by human users, collects no personal data and is used solely to discard automated submissions.

The form data is not stored in a website database: it is transmitted by e-mail (SMTP protocol) to the studio's mailbox so that we can respond to the request.

2.2 Server logs

Like any website, the hosting infrastructure automatically records certain technical data (access logs), including:

• the device's IP address;
• the user-agent (browser type and operating system);
• the date and time of the request, the resources requested and the server's response codes.

These data are collected by the hosting provider for technical and security purposes and are not used to identify or profile users.

2.3 Cookies and local storage

The website sets no tracking cookies. The only items present are:

• a local storage key (localStorage) named vf-consent, which stores your choice regarding the cookie banner ("accepted"/"declined"). It is a technical / strictly necessary tool and does not require consent;
• a possible technical language preference (set by the internationalization framework), used to display the site in the chosen language.

Should statistical analytics tools or other non-technical cookies be introduced in the future, they will be activated only with the user's prior consent, collected through the dedicated banner, and this policy (or a dedicated cookie policy) will be updated accordingly.

3. Purposes and legal bases of processing

Providing data through the form is optional, but failure to provide the data marked as mandatory (name, e-mail, message, consent) makes it impossible to act on the request.

4. Method of processing

Data are processed using IT and electronic tools, adopting technical and organizational measures adequate to ensure their security, confidentiality and integrity and to prevent unauthorized access, loss or disclosure (Art. 32 GDPR). Form submission takes place via SMTP transmission; the connection to the site is protected by an encrypted protocol (HTTPS). Access to the data is limited to the studio's authorized persons, bound by confidentiality. No form of profiling and no automated decision-making within the meaning of Art. 22 GDPR is carried out.

5. Recipients and Data Processors

Data may be processed, on our behalf and on our instructions, by the following parties acting as Data Processors (Art. 28 GDPR) or service providers:

• Beget — hosting (VPS) and mail infrastructure (SMTP relay) provider, which processes the technical browsing data (logs) and carries the transmission of the form;
• Google LLC (Gmail) — requests sent through the form are received in a Gmail mailbox of the studio (hello@visionflow.video); Google therefore acts as the e-mail service provider for storing and consulting the messages received;
• the studio's collaborators and professionals authorized to process the data, within the limits of their respective duties.

We do not transfer, sell or disclose data to advertising networks, data brokers or third parties for marketing purposes. Data may be disclosed to competent authorities solely where required by a legal obligation.

6. Transfer of data to non-EU/EEA countries

Some of the providers indicated above (in particular the Google mail service and, depending on the configuration, the hosting/SMTP infrastructure) may involve the processing or storage of data outside the European Union / the European Economic Area.

In such cases the transfer takes place in compliance with Arts. 44-49 GDPR, on the basis of appropriate safeguards under Art. 46 GDPR, such as the Standard Contractual Clauses (SCCs) adopted by the European Commission and/or any applicable adequacy decisions. {{TRANSFER_SAFEGUARDS_DETAIL — the studio confirms, for each provider, the specific basis of the transfer (SCCs, adequacy decision e.g. EU-US Data Privacy Framework, etc.) and makes a copy of the safeguards available on request}}.

7. Retention period

• Contact form data: kept for as long as necessary to handle and respond to the request and, absent any further follow-up, deleted within {{PERIOD — e.g. 12-24 months}} of the last contact. If the request evolves into a contractual relationship, the relevant data are kept for the duration of the relationship and for the terms required by legal obligations (e.g. accounting/tax obligations, up to 10 years under Art. 2220 of the Italian Civil Code).
• Server logs: kept for the time strictly necessary for technical and security purposes, as a rule no longer than {{PERIOD — e.g. 12 months}}, save for any need for further retention in the event of security incidents or authority requests.
• Cookie-banner choice / language preference: kept on the user's device until deleted by the user (by clearing the browser's local storage).

8. Rights of the data subject

In relation to the data processed, the data subject may exercise at any time the rights set out in Arts. 15-22 GDPR:

• access to their data (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure ("right to be forgotten", Art. 17);
• restriction of processing (Art. 18);
• portability of the data provided, in a structured, machine-readable format (Art. 20);
• objection to processing based on legitimate interest (Art. 21);
• not to be subject to automated decision-making, including profiling (Art. 22) — processing which, in any case, we do not carry out;
• withdrawal of consent at any time (Art. 7(3)), without affecting the lawfulness of processing based on consent given before withdrawal.

To exercise these rights, simply send a request to hello@visionflow.video. We will respond without undue delay and, in any event, within one month of receiving the request (Art. 12 GDPR). Exercising these rights is free of charge, except in cases of manifestly unfounded or excessive requests.

9. Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, a data subject who believes that the processing of their data infringes the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

• Piazza Venezia 11, 00187 Rome, Italy
• E-mail: garante@gpdp.it — Certified e-mail (PEC): protocollo@pec.gpdp.it
• Website: www.garanteprivacy.it

10. Minors

The website and the studio's services are aimed at an adult, professional audience and are not intended for minors. We do not knowingly collect personal data from minors. Under Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code, in Italy a minor who has reached 14 years of age may validly give consent in relation to information society services; for younger minors, the consent of the holder of parental responsibility is required. Should we become aware that we have processed a minor's data without valid consent, we will delete it promptly.

11. Changes to this policy

We reserve the right to amend or update this policy to reflect regulatory or organizational changes or the introduction of new tools. The version in force is the one published on this page, bearing the "last updated" date shown at the top. In the event of material changes, we will give appropriate notice.

12. Contacts

For any questions regarding this policy or the processing of your personal data:

• {{LEGAL_NAME}} (VisionFlow) — Milan, Italy
• E-mail: hello@visionflow.video
• Phone: {{PHONE}}