PRIVACY NOTICE
Privacy Policy
This notice explains how personal data of people who visit the LevelUp website and use its contact form is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree No. 196 of 30 June 2003 (the Italian Data Protection Code), as amended by Legislative Decree No. 101 of 10 August 2018.
The website is static: it has no registration, user accounts, restricted area, newsletter, comments, payment systems or advertising profiling. Personal data is therefore limited to what is needed to reply to enquiries and to keep the site running securely.
1. Data controller
The data controller is Ignazio Maria Macaluso, with registered office at SP79A 98, 92019 Sciacca (Agrigento), Italia, VAT number IT03068430846, tax code MCLGZM95R06I533P.
To exercise your rights under the GDPR or to ask any question about the processing of personal data, write to info@levelupwebagency.it.
The controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 of the GDPR are not met. Data protection requests should be sent to the contact details in this section.
2. Categories of data processed
The website requires no registration. The data processed falls into the following categories.
- Browsing data: IP address, date and time of the request, requested page, referring page, browser and operating system type, outcome of the request. These are recorded in the hosting provider's server logs to allow communication between browser and site, for security purposes and to investigate any unlawful activity.
- Data voluntarily provided in the contact form: name, email address and message content. Any other data voluntarily included in the message (for example a phone number, company name or project details) is processed solely to reply to the enquiry.
- Data sent by email or through the Instagram profile linked on the site: sender address and content of the communication, when one of these channels is used to contact us.
No cookies, advertising identifiers or location data are collected. No special categories of data (Article 9 GDPR) and no data relating to criminal convictions and offences (Article 10 GDPR) are processed: please do not include such data in the contact form.
3. Purposes and legal bases
Processing is carried out only for the purposes listed in the table below, each with its own legal basis.
| Purpose | Legal basis | Provision of data |
|---|---|---|
| Receiving and replying to enquiries sent through the contact form, by email or via Instagram, and managing the pre-contractual phase. | Article 6(1)(b) GDPR: performance of a contract or of pre-contractual measures taken at the data subject's request. | Required. Without the data we cannot respond to the enquiry. |
| Establishing, exercising or defending a right in judicial or out-of-court proceedings. | Article 6(1)(f) GDPR: legitimate interest of the controller in protecting its rights. | Required for the protection of rights. |
| Keeping the website secure, preventing abuse and automated submissions (spam) and ensuring the correct technical operation of the infrastructure. | Article 6(1)(f) GDPR: legitimate interest of the controller and of users in the security of the systems. | Required for the operation and security of the site. |
For these purposes processing is not based on consent: the data is necessary to take pre-contractual measures at the data subject's request or to pursue a legitimate interest of the controller. For this reason the contact form contains no consent checkbox.
You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21 GDPR) by writing to the controller's contact details.
Data is not used to send commercial communications, newsletters or promotional material, is not shared with third parties for marketing purposes and is not subject to profiling or automated decision-making within the meaning of Article 22 GDPR.
4. Processing methods and security measures
Processing is carried out with electronic tools, using logic strictly related to the purposes described above and adopting technical and organisational measures appropriate to ensure a level of security commensurate with the risk, as required by Article 32 GDPR.
- Pages are served over HTTPS only: traffic between browser and server is encrypted with TLS.
- The site is static and has no database: personal data is not stored in the site code or in an application archive.
- Messages sent through the form are delivered to the form-forwarding provider and to the controller's mailbox; access is limited to authorised persons.
- The hosting provider applies the security measures set out in its agreement and in its data processing agreement.
- Anti-spam services connected to the form may analyse the transmitted data solely to block fraudulent submissions.
5. Recipients and processors
Personal data may be disclosed to parties processing it on behalf of the controller as data processors under Article 28 GDPR, appointed by contract or through the data processing agreement made available by the provider.
| Party | Role and purpose | Data involved |
|---|---|---|
| Web3Forms (web3forms.com) | Data processor. Receives the form data, filters it and forwards it by email to the controller. Uses Amazon Web Services, Cloudflare and Hetzner as sub-processors. | Name, email address, message content, IP address and technical request metadata. |
| Cloudflare, Inc. | Data processor. Hosts the website and records server logs. | IP address and technical connection data. |
| CleanTalk and Akismet | Data processors, activated by the forwarding service. They filter submissions to prevent spam, abuse and phishing. | Sender IP address and email address. |
| Meta Platforms Ireland Ltd. (Instagram) | Independent controller. A link to the Instagram profile is present, but no Meta content is loaded automatically: processing begins only if the user opens the link. | Browsing and interaction data handled under Meta's own notice. |
Data may also be disclosed to judicial authorities, law enforcement or other public authorities where required by law or by a reasoned order. Data is never disseminated or sold to third parties for commercial purposes.
6. Transfers to third countries
Some providers are based, or operate infrastructure, outside the European Economic Area. In particular, the form-forwarding service operates from India and relies on infrastructure distributed across multiple regions, while some anti-spam services are based in the United States.
Such transfers rely on an adequacy decision of the European Commission, where one exists, or on standard contractual clauses approved by the European Commission under Article 46 GDPR, as stated in the provider's data processing agreement. A copy of the safeguards adopted may be requested from the controller using the details in section 1.
7. Retention period
Data is kept only for as long as strictly necessary for the purposes for which it was collected and, in any case, within the periods set out in the table.
| Data | Retention period |
|---|---|
| Messages received through the form, email or Instagram | 24 months from the conclusion of the enquiry, unless the enquiry leads to a contractual relationship or is needed for the defence of legal claims. |
| Submissions stored by the form provider | Up to 36 months, the maximum period set by the provider, unless the controller deletes them earlier once the enquiry is closed. |
| Server logs of the hosting provider | Up to 12 months, unless needed to investigate unlawful activity or for security purposes. |
| Data required to comply with contractual, tax and accounting obligations | 10 years from the last record, as required by Article 2220 of the Italian Civil Code and tax legislation. |
Once the retention period has expired, data is securely deleted or irreversibly anonymised.
8. Your rights
As a data subject, under Articles 15-22 GDPR you have the right to obtain:
- access to your personal data and to information about the processing (Article 15);
- rectification of inaccurate data and completion of incomplete data (Article 16);
- erasure of data in the cases set out in Article 17;
- restriction of processing in the cases set out in Article 18;
- portability of the data you provided, in a structured, commonly used and machine-readable format (Article 20);
- objection to processing based on legitimate interest (Article 21).
Requests may be sent to info@levelupwebagency.it. The controller replies without undue delay and in any event within one month of receipt, a period that may be extended by two months where the request is particularly complex, with notice of the reasons for the extension (Article 12 GDPR). Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.
If you believe that the processing of your personal data infringes the law, you may lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy, phone +39 06 696771, certified email protocollo@gpdp.it, email garante@gpdp.it, website www.garanteprivacy.it, or with the supervisory authority of the Member State where you habitually reside or work (Article 77 GDPR). You may also seek a judicial remedy (Article 79 GDPR).
9. Children
The website is not intended for children under 14 and does not knowingly collect their personal data. In Italy the age of consent for information society services is 14, as set by Article 2-quinquies of the Italian Data Protection Code. If a child under 14 sends us personal data without the consent of a parent or guardian, please contact us: we will delete it promptly.
10. Cookies and tracking technologies
The website uses no profiling cookies, no third-party analytics, no advertising pixels and no browser storage for tracking purposes. Even the typefaces are hosted on this domain, so browsing the pages does not involve any connection to third-party services.
Because no cookies or tools requiring prior consent are used, within the meaning of Article 122 of the Italian Data Protection Code and Decision No. 231 of 10 June 2021 of the Italian data protection authority, no consent banner is displayed. Further details are available in the Cookie Policy linked in the footer.
11. Changes to this notice
The controller may amend this notice to reflect new legal requirements, guidance from supervisory authorities or changes to the services used. The updated version is published on this page together with the last-updated date. In the event of substantial changes, users are informed through a prominent notice on the site.
12. Legal references
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
- Italian Legislative Decree No. 196 of 30 June 2003, Data Protection Code, as amended by Legislative Decree No. 101 of 10 August 2018.
- Decision No. 231 of 10 June 2021 of the Italian data protection authority on cookies and other identifiers.
- Guidelines 05/2020 of the European Data Protection Board on consent.
Notice provided under Articles 13 and 14 of Regulation (EU) 2016/679.