Last updated: 12/04/2026

This policy describes how the personal data of users visiting the website https://sabrielagency.com (the “Website”) is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian legislation (Legislative Decree 196/2003, as amended).

1. Data Controller

Sara Casciaro – Sole proprietor, VAT No.: 05461670753
Trade name: Sabriel Agency
Operating address: Via San Antonio 68, 73059 Ugento (LE), Italy
General email: supporto@sabrielagency.com
Dedicated privacy (GDPR) requests email: privacy@sabrielagency.com

The Data Controller has not appointed a Data Protection Officer (DPO), as the circumstances outlined in Art. 37 GDPR do not apply.

2. Types of Data Processed

a) Browsing data (technical data): During normal browsing, technical data is automatically collected, such as IP address, date and time of access, URLs of pages visited, device and browser information, and security logs. This data is necessary for the technical operation of the Website, for security purposes, and for maintenance. It is not used to directly identify users.

b) Data provided through the contact/quote request form: When a user submits a request through the form on the Website, the following data is processed: first and last name, email address, phone number (optional), type of service requested, project description, and any other information freely entered. Providing this data is optional but necessary to process the request. Requests are received via email and are not stored in the Website’s database.

c) Data processed via professional email: Email communications are managed through a professional email account hosted on Hostinger infrastructure. The data processed includes the sender’s email address, message content, and any attachments.

d) Data processed via WhatsApp Business: For communications following the initial request or agreed upon with the client, the Data Controller uses WhatsApp Business (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). The data processed is limited to what is necessary for communication: phone number, message content, and any files shared. For more information: https://www.whatsapp.com/legal/privacy-policy.

e) Data processed via Microsoft Teams: For introductory calls and project meetings with prospective or current clients, the Data Controller may use Microsoft Teams (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The data processed is that necessary for communication (name, email, call content). For more information: https://privacy.microsoft.com/en-us/privacystatement.

f) Website analytics data (Google Analytics 4): Subject to the user’s explicit consent, the Website uses Google Analytics 4 (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics collects browsing data in aggregated and anonymized form (truncated IP, pages visited, session duration, traffic source, device type) through analytics cookies. This data is used exclusively for statistical analysis and Website improvement.

g) Cookies and similar technologies: The Website uses technical cookies necessary for its operation and, subject to consent, analytics cookies (Google Analytics). Consent management is handled through the CookieYes banner. For full details on the cookies used, please refer to the Website the respective payment processors.

i) Data provided through blog comments: Users may post comments on blog articles. In such cases, the following data is processed: name (or pseudonym), email address, and comment content. Comments are subject to manual approval by the Data Controller before publication. The data is not shared with third parties and is used exclusively for comment management purposes. Legal basis: user consent (Art. 6(1)(a) GDPR).

3. Purposes and Legal Bases of Processing

Technical operation of the Website, security, and abuse prevention — Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) and technical necessity.

Management of requests submitted via the contact/quote form — Legal basis: performance of pre-contractual measures at the data subject’s request (Art. 6(1)(b) GDPR).

Communication via email, WhatsApp Business, and Microsoft Teams — Legal basis: performance of pre-contractual or contractual measures (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

Statistical traffic analysis via Google Analytics 4 — Legal basis: user consent (Art. 6(1)(a) GDPR). The service is activated only after acceptance of analytics cookies via the banner. Consent may be withdrawn at any time through the cookie preferences center.

Map display via Google Maps — Legal basis: user consent (Art. 6(1)(a) GDPR) and legitimate interest in geographic orientation (Art. 6(1)(f) GDPR).

Payment management — Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Fulfillment of tax, accounting, and administrative obligations — Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Technical optimization of the Website (LiteSpeed Cache, QUIC.cloud) — Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).

Management and publication of blog comments — Legal basis: user consent (Art. 6(1)(a) GDPR).

4. Processing Methods and Security

Data is processed using IT tools and technical and organizational measures suitable to ensure confidentiality, integrity, and availability, in compliance with Art. 32 GDPR. Access is limited to the Data Controller only. There are no employees, permanent collaborators, or other individuals authorized to process the Website’s users’ data.

5. Data Recipients (who may process the data)

Personal data may be disclosed to the following categories of third parties, acting as data processors (Art. 28 GDPR) or as independent data controllers:

Hostinger International Ltd. Website hosting provider. Registered office: 61 Lordou Vironos str., 6023 Larnaca, Cyprus (EU). Acts as data processor under the GDPR, with a Data Processing Addendum (DPA) available at  https://www.hostinger.com/legal/dpa. Main servers are located in Europe. For more information: https://www.hostinger.com/legal/privacy-policy.

LiteSpeed Technologies / QUIC.cloud Optimization plugin active on the Website (LiteSpeed Cache). QUIC.cloud is used for resource optimization services (images, CSS). The CDN feature is disabled. This processing concerns technical resources of the Website, not personal data of users in identifiable form.

Google LLC – Google Analytics 4 Website traffic statistical analysis service. Property ID: G-8GJ2WBV1RR. Data is transferred to the USA on the basis of Standard Contractual Clauses (SCC) and, where applicable, the EU-US Data Privacy Framework. IP anonymization is active. Privacy Policy: https://policies.google.com/privacy. To opt out of tracking: https://tools.google.com/dlpage/gaoptout.

Google LLC – Google Maps The Website embeds a Google Maps map on the contact/quote page. Displaying the map involves transmitting technical data (IP address) to Google LLC in the USA, on the basis of Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Privacy Policy: https://policies.google.com/privacy.

Meta Platforms Ireland Ltd. – WhatsApp Business Used for communications with prospective and current clients. Registered office: 4 Grand Canal Square, Dublin 2, Ireland (EU). Data may be transferred to servers in the USA on the basis of Standard Contractual Clauses. Privacy Policy: https://www.whatsapp.com/legal/privacy-policy.

Microsoft Ireland Operations Ltd. – Microsoft Teams Used for introductory calls and project meetings. Registered office: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (EU). Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement.

PayPal (Europe) S.à r.l. et Cie, S.C.A. Payment processor. Registered office: 22-24 Boulevard Royal, L-2449 Luxembourg (EU). Data necessary for the transaction is processed directly by PayPal as an independent data controller. Privacy Policy: https://www.paypal.com/us/legalhub/privacy-full.

Stripe Payments Europe, Limited Payment processor. Registered office: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (EU). Data necessary for the transaction is processed directly by Stripe as an independent data controller. Privacy Policy: https://stripe.com/privacy.

CookieYes Ltd. Provider of the cookie consent management system (banner). Registered office: 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. Privacy Policy: https://www.cookieyes.com/privacy-policy/.

The transfer of data to the United Kingdom is lawful on the basis of the adequacy decision adopted by the European Commission on June 28, 2021.

Fatture in Cloud – TeamSystem S.p.A. Used for issuing electronic invoices. Clients’ tax data (name, VAT number/tax code, address, amounts) is processed by TeamSystem as data processor. Registered office: Via Sandro Pertini 88, 61122 Pesaro (PU), Italy. Privacy Policy: https://www.fattureincloud.it/privacy/

6. Transfers Outside the EEA

Some tools used by the Website involve data transfers to third countries, particularly the USA: Google Analytics 4 (Google LLC), Google Maps (Google LLC), WhatsApp Business (Meta Platforms), and Microsoft Teams (Microsoft). Such transfers take place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, the EU-US Data Privacy Framework adopted in 2023. European providers (PayPal Europe, Stripe Europe, Hostinger, Microsoft Ireland, Meta Ireland, TeamSystem/Fatture in Cloud) process data within the EEA. The CookieYes service is based in the United Kingdom, a country for which the European Commission adopted an adequacy decision on June 28, 2021 — no additional safeguards are required for such transfers.

7. Data Retention

Requests via the contact form: retained in the Data Controller’s email inbox for as long as necessary to handle the request and for potential legal protection in the event of disputes, generally up to 12 months from the last contact.

Communications via professional email: retained for as long as necessary to manage the relationship and for protection in the event of disputes, generally up to 12 months from the last communication, unless longer retention obligations arise from contractual relationships.

Data related to contractual relationships: retained for the periods required by Italian tax and accounting regulations (10 years pursuant to Presidential Decree 600/1973 and Presidential Decree 633/1972).

Analytics data (Google Analytics 4): retained according to the Analytics property settings, generally for a period not exceeding 14 months.

Technical and security logs: retained in accordance with security purposes and the policies of the Hostinger provider.

WhatsApp Business and Microsoft Teams communications: retained for as long as necessary to manage the professional relationship.

Blog comments: retained for as long as the comment remains published on the Website. If the comment is deleted, the data is erased.

8. Data Subject Rights

Under Articles 15-22 GDPR, you have the right to obtain: access to your data, rectification of inaccurate data, erasure (“right to be forgotten”), restriction of processing, objection to processing, data portability (in the cases provided for), and withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please write to: privacy@sabrielagency.com

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.

9. Changes

This Privacy Policy may be updated at any time to reflect regulatory, technological, or operational changes. The most current version is always available on this page, along with its update date. For material changes, the Data Controller may provide notice via a prominent notice on the Website.