Privacy Policy

Last updated: 31 August 2026

This policy describes how VisionFlow ("we", "the studio") processes the personal data of users who visit the website and use the contact form, in accordance with Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 (Privacy Code, as amended by Legislative Decree 101/2018) and the Italian Data Protection Authority's Guidelines on cookies and other tracking tools (2021).

The website uses two web-analytics tools — Google Analytics 4 and Yandex Metrica. Neither loads before your consent: until you press "Accept" in the cookie banner, no analytics script is added to the page. After consent, statistical data about the visit is collected: pages viewed, referral source, device and browser type, visit duration. Reports are aggregated and are not used to identify an individual visitor.

The site carries no profiling or advertising tools: no advertising-network pixels, no remarketing. In Yandex Metrica, Webvisor is switched off: the screen, cursor movements and typed text are not recorded — only the click map and link-click statistics are used. Besides analytics, identifying data is processed through the contact form and the server's technical logs, as described below.

1. Data Controller

The Data Controller is:

• VisionFlow — video production studio, Milan, Italy
• VAT number (P.IVA): 14861030964
• E-mail: hello@visionflow.video

All data-protection enquiries are handled at the e-mail address above.

The studio has not appointed a Data Protection Officer (DPO), as the mandatory conditions under Art. 37 GDPR do not apply. For any request concerning personal data, you may write to the e-mail address above.

2. Personal data we collect

2.1 Data provided through the contact form

When you fill in and submit the contact form, we collect the data you enter yourself:

• name;
• e-mail address;
• project type (brand and advertising, corporate, content and social, event, personal portrait, other);
• shooting city;
• dates / period of the shoot;
• the budget range indicated;
• the timeline you have in mind;
• the deliverable format (photo, video, vertical formats and so on);
• the usage rights for the materials;
• your free-text message (its content is up to you: please do not include details unrelated to the enquiry, or special categories of data within the meaning of Art. 9 GDPR);
• consent: we keep, together with your enquiry, a record that the consent box was ticked at the time of sending, and the date of sending, so that we can demonstrate the consent given (Art. 7(1) GDPR).

The form also contains a hidden anti-spam field ("honeypot"): it is invisible and never filled in by people, collects no personal data and serves solely to discard automated submissions.

The form data is not stored in a website database: it is transmitted by e-mail to the studio's mailbox and mirrored as a Telegram notification, so that we can respond to the request sooner.

2.2 Server logs

Like any website, the hosting infrastructure automatically records certain technical data (access logs), including:

• the device's IP address;
• the user-agent (browser type and operating system);
• the date and time of the request, the resources requested and the server's response codes.

These data are collected by the hosting provider for technical and security purposes and are not used to identify or profile users.

The platform's operational logs may also record technical messages about failures in delivering e-mails and notifications; they contain no text of your message and are kept for the same period as the other logs (section 7).

2.3 Cookies and local storage

Before you give consent, the site sets no tracking cookies. The items always present are technical only:

• the local storage (localStorage) entry vf-consent, which records your choice per cookie category (necessary, analytics, marketing) together with the date of that choice; it requires no consent;
• the session cookie NEXT_LOCALE holding the interface language you selected (IT / EN / RU), deleted when the browser closes;

Once you have accepted analytics in the banner, Google Analytics 4 and Yandex Metrica set their own cookies — they are listed, with their durations, in the Cookie Policy. Withdrawing consent stops them being set. Should new non-technical tools appear, both policies will be updated before they are activated.

2.4 Contacting us through messaging apps

Besides the form, the site links directly to WhatsApp and Telegram. If you write to us there, we process the username or phone number the service displays and the content of the conversation, solely in order to answer your enquiry (Art. 6(1)(b) GDPR). The conversation travels through that service's own infrastructure — WhatsApp (Meta group) and Telegram — under their own privacy policies, over which we have no control. Conversations are kept for the same period as form enquiries (section 7).

3. Purposes and legal bases of processing

Providing data through the form is voluntary; however, not providing the data marked as required (name, e-mail, message, consent) makes it impossible to handle the enquiry. Refusing analytics cookies does not restrict your use of the site in any way.

4. Method of processing

Data are processed using IT and electronic tools, adopting technical and organizational measures appropriate to the risk, ensuring their security, confidentiality and integrity and to prevent unauthorized access, loss or disclosure (Art. 32 GDPR). Form submission takes place over an encrypted connection to the mail delivery service; the connection to the site is protected by an encrypted protocol (HTTPS). Access to the data is limited to the studio's authorized persons, bound by confidentiality. No form of profiling and no automated decision-making within the meaning of Art. 22 GDPR is carried out.

5. Recipients and Data Processors

Data is processed on our behalf and on our instructions by the following processors (Art. 28 GDPR):

• Cloudflare — website hosting (the Cloudflare Workers platform) and connection security; processes the technical browsing data (logs);
• Resend — the e-mail delivery service through which the form message is sent to the studio;
• Apple (iCloud Mail) — provider of the studio's mailbox hello@visionflow.video, where the messages received are stored and consulted;
• Telegram — a notification about each new enquiry, containing the data entered in the form, is delivered to the messenger so that the studio can reply sooner;
• WhatsApp (Meta group) — the messaging service, if you write to us through the link on the site (section 2.4).

Google (Google Analytics 4) and Yandex (Yandex Metrica) load only after consent and, as regards their own analytics infrastructure, act as independent controllers: they also process data for their own purposes under their policies, while we receive aggregate reports only. Analytics receives the fact that a form was submitted and the selected project type; your name, e-mail address and message are not sent to analytics.

Authorised staff and contractors of the studio access the data under our authority and are bound by confidentiality (Art. 29 GDPR).

We do not transfer, sell or disclose data to advertising networks, data brokers or third parties for marketing purposes. Data may be disclosed to competent authorities solely where required by a legal obligation.

6. Transfer of data to non-EU/EEA countries

Some of the providers indicated above (in particular the hosting, mail delivery and web analytics services) may involve the processing or storage of data outside the European Union / the European Economic Area.

In such cases the transfer takes place in compliance with Arts. 44-49 GDPR, on the basis of appropriate safeguards under Art. 46 GDPR, such as the Standard Contractual Clauses (SCCs) adopted by the European Commission and/or any applicable adequacy decisions. The transfer terms applied by the analytics services are published in their own policies: Google and Yandex. The terms of the other providers are set out in their respective privacy policies.

7. Retention period

• Contact form data: kept for as long as necessary to handle and respond to the request and, absent any further follow-up, deleted within 24 months of the last contact. If the request evolves into a contractual relationship, the relevant data are kept for the duration of the relationship and for the terms required by legal obligations (e.g. accounting/tax obligations, up to 10 years under Art. 2220 of the Italian Civil Code).
• Server logs: kept for the time strictly necessary for technical and security purposes, as a rule no longer than 30 days, save for any need for further retention in the event of security incidents or authority requests.
• Cookie banner choice (`vf-consent`): kept in your browser's local storage until you clear the site's data.
• Interface language (`NEXT_LOCALE`): a session cookie, deleted when the browser closes.
• Analytics cookies: Google Analytics 4 — up to 2 years, Yandex Metrica — up to 1 year from the last visit; withdrawing consent stops them being set.

8. Rights of the data subject

In relation to the data processed, the data subject may exercise at any time the rights set out in Arts. 15-22 GDPR:

• access to their data (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure ("right to be forgotten", Art. 17);
• restriction of processing (Art. 18);
• portability of the data provided, in a structured, machine-readable format (Art. 20);
• objection to processing based on legitimate interest (Art. 21);
• not to be subject to automated decision-making, including profiling (Art. 22) — processing which, in any case, we do not carry out;
• withdrawal of consent at any time (Art. 7(3)), without affecting the lawfulness of processing based on consent given before withdrawal.

To exercise these rights, simply send a request to hello@visionflow.video. We will respond without undue delay and, in any event, within one month of receiving the request (Art. 12 GDPR). Exercising these rights is free of charge, except in cases of manifestly unfounded or excessive requests.

9. Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, a data subject who believes that the processing of their data infringes the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

• Piazza Venezia 11, 00187 Rome, Italy
• E-mail: garante@gpdp.it — Certified e-mail (PEC): protocollo@pec.gpdp.it
• Website: www.garanteprivacy.it

10. Minors

The website and the studio's services are aimed at an adult, professional audience and are not intended for minors. We do not knowingly collect personal data from minors. Under Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code, in Italy a minor who has reached 14 years of age may validly give consent in relation to information society services; for younger minors, the consent of the holder of parental responsibility is required. Should we become aware that we have processed a minor's data without valid consent, we will delete it promptly.

11. Changes to this policy

We reserve the right to amend or update this policy to reflect regulatory or organizational changes or the introduction of new tools. The version in force is the one published on this page, bearing the "last updated" date shown at the top. In the event of material changes, we will give appropriate notice.

12. Contacts

For any questions regarding this policy or the processing of your personal data:

• VisionFlow — Milan, Italy
• E-mail: hello@visionflow.video