Last updated: 8 October 2026

This policy describes how the personal data of users visiting the website https://sabrielagency.com (the “Website”) is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian legislation (Legislative Decree 196/2003, as amended).

1. Data Controller

Sara Casciaro – Sole proprietor, VAT No.: 05461670753
Trade name: Sabriel Agency
Operating address: Via San Antonio 68, 73059 Ugento (LE), Italy
General email: supporto@sabrielagency.com
Dedicated privacy (GDPR) requests email: privacy@sabrielagency.com

The Data Controller has not appointed a Data Protection Officer (DPO), as the circumstances outlined in Art. 37 GDPR do not apply.

2. Types of Data Processed

a) Browsing data (technical data): During normal browsing, technical data is automatically collected, such as IP address, date and time of access, URLs of pages visited, device and browser information, and security logs. This data is necessary for the technical operation of the Website, for security purposes, and for maintenance. It is not used to directly identify users.

b) Data provided through the contact/quote request form: When a user submits a request through the form on the Website, the following data is processed: first and last name, email address, phone number (optional), type of service requested, project description, and any other information freely entered. Providing this data is optional but necessary to process the request. Requests are received via email and are also stored in the Website’s database, in the form entries archive.

c) Data processed via professional email: Email communications are managed through a professional email account hosted on Hostinger infrastructure. The data processed includes the sender’s email address, message content, and any attachments.

d) Data processed via WhatsApp Business: For communications following the initial request or agreed upon with the client, the Data Controller uses WhatsApp Business (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). The data processed is limited to what is necessary for communication: phone number, message content, and any files shared. For more information: https://www.whatsapp.com/legal/privacy-policy.

e) Data processed via Microsoft Teams: For introductory calls and project meetings with prospective or current clients, the Data Controller may use Microsoft Teams (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The data processed is that necessary for communication (name, email, call content). For more information: https://privacy.microsoft.com/en-us/privacystatement.

f) Website analytics data (Google Analytics 4): Subject to the user’s explicit consent, the Website uses Google Analytics 4 (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics 4 uses cookies and pseudonymous identifiers to collect information about pages visited, session duration, traffic sources and devices. GA4 does not log or store IP addresses. Reports allow this information to be analysed in aggregate. This data is used exclusively for statistical analysis and Website improvement.

g) Cookies and similar technologies: The Website uses technical cookies necessary for its operation and, subject to consent, analytics cookies (Google Analytics). Consent management is handled through the CookieYes banner. For full details on the cookies used, please refer to the Website’s Cookie Policy.

h) Payment data: When a contractual relationship begins, payments are handled by bank transfer, PayPal or Stripe. The Data Controller does not collect or store clients’ card details. Data required by the payment provider is processed by that provider.

i) Data provided through blog comments: Users may post comments on blog articles. In such cases, the following data is processed: name (or pseudonym), email address, and comment content. Comments are subject to manual approval by the Data Controller before publication. The data is not shared with third parties and is used exclusively for comment management purposes. Legal basis: user consent (Art. 6(1)(a) GDPR).

j) Data processed through the virtual assistant (Sabriel AI chat): the Website includes a virtual assistant based on artificial intelligence. When users interact with it, the following are processed: the messages written in the chat and any attached files or images, the data users choose to provide (first name, last name, email address and, optionally, phone number) and the service they are interested in. If users book an appointment, request a quote or a check of their website through the chat, the data needed for that request is also processed (appointment date and time, quote details, address of the website to be checked and the related PDF report). Emails related to these requests (confirmations, reminders, quotes, reports) are sent from the Website through the Data Controller’s professional mailbox. If users use the microphone, voice transcription is handled by the browser and, depending on the browser, the audio may be processed by an external service of the browser provider.
To generate replies, messages and attachments are sent to Google LLC through the Gemini API service. To prevent disposable email addresses, when users enter their email the Website sends only the domain of the address (the part after the @) to an external service based in the United States, never the full address.
Conversations are saved in the Website database together with the email address, if provided, and a copy is sent by email to the Data Controller. Each conversation is given an interest rating (hot, warm or cold lead) with a short explanation, used to organize requests and to decide whether to send a follow-up. Hot and warm leads who left their email may receive no more than two follow-up emails (on the third and seventh day for hot leads, on the sixth and fourteenth day for warm leads); each email contains a link to stop receiving them, and the sequence stops if the user books an appointment or requests a quote. Nothing is sent to cold leads.
To resume the conversation when users return from the same device, the assistant derives a short code from the browser that stays on the Website, without using cookies. Chat usage statistics are internal to the Website and are activated only if the user has given consent. If users tick the box to receive email updates, their address is added to the Mailchimp list (The Rocket Science Group LLC) and the consent is recorded with its date; without the tick, no subscription takes place.
Legal bases: for replies, appointments, quotes and website checks, performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR); for saving conversations, the interest rating, follow-up emails and the disposable email check, legitimate interest of the Data Controller in managing and following up on the requests received and preventing abuse (Art. 6(1)(f) GDPR); for chat statistics and the Mailchimp subscription, user consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.
Retention: conversations and data collected in the chat are kept for 12 months from the last message and then deleted; data for appointments and quotes that lead to a contract follows the periods set out in section 7; the Mailchimp subscription remains active until the user unsubscribes. Google, Mailchimp and the email check service may process data in the USA, on the basis of the Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Users can request the export or deletion of their data at any time by writing to privacy@sabrielagency.com. Please do not share special categories of data in the chat, such as health information.

k) Purchase of Sabriel AI licenses: paid licenses for the Sabriel AI plugin are purchased on the Freemius checkout (Freemius, Inc., USA), which processes purchase data (name, email, billing and payment details) as an independent controller under its own privacy policy. The Data Controller receives the name, email and license details, used for support and license management (legal basis: performance of a contract, Art. 6(1)(b) GDPR) and kept for the periods set out in section 7.

3. Purposes and Legal Bases of Processing

Technical operation of the Website, security, and abuse prevention — Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) and technical necessity.

Management of requests submitted via the contact/quote form — Legal basis: performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR).

Communication via email, WhatsApp Business, and Microsoft Teams — Legal basis: performance of pre-contractual or contractual measures (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

Statistical traffic analysis via Google Analytics 4 — Legal basis: user consent (Art. 6(1)(a) GDPR). The service is activated only after acceptance of analytics cookies via the banner. Consent may be withdrawn at any time through the cookie preferences center.

Map display via Google Maps — Legal basis: user consent (Art. 6(1)(a) GDPR) and legitimate interest in geographic orientation (Art. 6(1)(f) GDPR).

Payment management — Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Fulfillment of tax, accounting, and administrative obligations — Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Technical optimization of the Website (LiteSpeed Cache, QUIC.cloud) — Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).

Management and publication of blog comments — Legal basis: user consent (Art. 6(1)(a) GDPR).

4. Processing Methods and Security

Data is processed using IT tools and technical and organizational measures suitable to ensure confidentiality, integrity, and availability, in compliance with Art. 32 GDPR. Access is limited to the Data Controller only. There are no employees, permanent collaborators, or other individuals authorized to process the Website’s users’ data.

5. Data Recipients (who may process the data)

Personal data may be disclosed to the following categories of third parties, acting as data processors (Art. 28 GDPR) or as independent data controllers:

Hostinger International Ltd. Website hosting provider. Registered office: 61 Lordou Vironos str., 6023 Larnaca, Cyprus (EU). Acts as data processor under the GDPR, with a Data Processing Addendum (DPA) available at  https://www.hostinger.com/legal/dpa. Main servers are located in Europe. For more information: https://www.hostinger.com/legal/privacy-policy.

LiteSpeed Technologies / QUIC.cloud Optimization plugin active on the Website (LiteSpeed Cache). QUIC.cloud is used for resource optimization services (images, CSS). The CDN feature is disabled. This processing concerns technical resources of the Website, not personal data of users in identifiable form.

Google LLC – Google Analytics 4 Website traffic statistical analysis service. Property ID: G-8GJ2WBV1RR. Data is transferred to the USA on the basis of Standard Contractual Clauses (SCC) and, where applicable, the EU-US Data Privacy Framework. GA4 does not log or store IP addresses. Privacy Policy: https://policies.google.com/privacy. To opt out of tracking: https://tools.google.com/dlpage/gaoptout.

Google LLC – Google Maps The Website embeds a Google Maps map on the contact/quote page. Displaying the map involves transmitting technical data (IP address) to Google LLC in the USA, on the basis of Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Privacy Policy: https://policies.google.com/privacy.

Google Fonts (Google LLC): the Our Work and Portfolio pages load the Syne and DM Sans typefaces from Google’s servers. Viewing these pages involves transmitting technical data (IP address) to Google LLC in the USA, on the basis of the Standard Contractual Clauses and the EU-US Data Privacy Framework. Privacy Policy: https://policies.google.com/privacy .

Meta Platforms Ireland Ltd. – WhatsApp Business Used for communications with prospective and current clients. Registered office: 4 Grand Canal Square, Dublin 2, Ireland (EU). Data may be transferred to servers in the USA on the basis of Standard Contractual Clauses. Privacy Policy: https://www.whatsapp.com/legal/privacy-policy.

Microsoft Ireland Operations Ltd. – Microsoft Teams Used for introductory calls and project meetings. Registered office: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (EU). Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement.

PayPal (Europe) S.à r.l. et Cie, S.C.A. Payment processor. Registered office: 22-24 Boulevard Royal, L-2449 Luxembourg (EU). Data necessary for the transaction is processed directly by PayPal as an independent data controller. Privacy Policy: https://www.paypal.com/us/legalhub/privacy-full.

Stripe Payments Europe, Limited Payment processor. Registered office: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (EU). Data necessary for the transaction is processed directly by Stripe as an independent data controller. Privacy Policy: https://stripe.com/privacy.

CookieYes Ltd. Provider of the cookie consent management system (banner). Registered office: 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. Privacy Policy: https://www.cookieyes.com/privacy-policy/.

Data transfers to the United Kingdom rely on the European Commission’s adequacy decision of 28 June 2021, as amended and renewed by Decision (EU) 2025/2574 of 19 December 2025.

Fatture in Cloud – TeamSystem S.p.A. Used for issuing electronic invoices. Clients’ tax data (name, VAT number/tax code, address, amounts) is processed by TeamSystem as data processor. Registered office: Via Sandro Pertini 88, 61122 Pesaro (PU), Italy. Privacy Policy: https://www.fattureincloud.it/privacy/

6. Transfers Outside the EEA

Some tools used by the Website involve data transfers to third countries, particularly the USA: Google Analytics 4 (Google LLC), Google Maps (Google LLC), Google Fonts (Google LLC), Google Gemini API (Google LLC), Mailchimp (The Rocket Science Group LLC), Freemius (Freemius, Inc.), the disposable email check service, WhatsApp Business (Meta Platforms), and Microsoft Teams (Microsoft). Such transfers take place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, the EU-US Data Privacy Framework adopted in 2023. European providers (PayPal Europe, Stripe Europe, Hostinger, Microsoft Ireland, Meta Ireland, TeamSystem/Fatture in Cloud) process data within the EEA. The CookieYes service is based in the United Kingdom, a country for which the European Commission adopted an adequacy decision on June 28, 2021 — no additional safeguards are required for such transfers.

7. Data Retention

Requests via the contact form: retained in the Data Controller’s email inbox and in the Website’s database for as long as necessary to handle the request and for potential legal protection in the event of disputes, generally up to 12 months from the last contact.

Communications via professional email: retained for as long as necessary to manage the relationship and for protection in the event of disputes, generally up to 12 months from the last communication, unless longer retention obligations arise from contractual relationships.

Data related to contractual relationships: retained for the periods required by Italian tax and accounting regulations (10 years pursuant to Presidential Decree 600/1973 and Presidential Decree 633/1972).

Analytics data (Google Analytics 4): retained according to the Analytics property settings, generally for a period not exceeding 14 months.

Technical and security logs: retained in accordance with security purposes and the policies of the Hostinger provider.

WhatsApp Business and Microsoft Teams communications: retained for as long as necessary to manage the professional relationship.

Blog comments: retained for as long as the comment remains published on the Website. If the comment is deleted, the data is erased.

8. Data Subject Rights

Under Articles 15-22 GDPR, you have the right to obtain: access to your data, rectification of inaccurate data, erasure (“right to be forgotten”), restriction of processing, objection to processing, data portability (in the cases provided for), and withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please write to: privacy@sabrielagency.com

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.

9. Changes

This Privacy Policy may be updated at any time to reflect regulatory, technological, or operational changes. The most current version is always available on this page, along with its update date. For material changes, the Data Controller may provide notice via a prominent notice on the Website.