Privacy Policy

1. Data Controller

Virtual Zone Italia Srl, VAT IT03339540597 — [email protected]

2. Data Collected

We collect name, email, phone (mandatory in the request forms) and venue details when you submit a request form. If you consent, we collect pseudonymised browsing and usage data via Google Analytics, Vercel Web Analytics and Speed Insights, PostHog and Reviy, and data about the campaign you come from: UTM parameters and Meta and Google click identifiers. UTMs stay in your browser for the duration of the session even before you choose; click identifiers only if you accept Marketing.

3. Purpose and Legal Basis

Request form data is processed to respond to your commercial inquiry (legitimate interest / pre-contractual measures). Analytics and marketing data from the cookies and tools described in the Cookie Policy is processed based on your consent.

Advertising campaign measurement (optional). If you tick the dedicated checkbox, separate from the one to be contacted, you agree that the data of this request is shared with Meta Platforms Ireland Ltd. and Google to measure the effectiveness of our campaigns. To Meta we send the request event and its outcome with your contacts in pseudonymised (hashed) form, IP address, browser and the ad click identifier, also when the request becomes a qualified contact or a customer: it is then our CRM that sends these later events. From Google we keep in our CRM the ad click identifier, for offline conversions. It applies only to this request and does not set cookies. The legal basis is your consent (Art. 6(1)(a) GDPR). It is not needed to get a reply: if you do not tick the box your request is handled the same way and these transmissions do not take place. You can withdraw consent at any time by writing to [email protected]: we will send no further data, while data already received by Meta and Google remains subject to their own notices. We keep the request data, including data used for this measurement, for up to 24 months.

4. Retention

Contact data, including data used for campaign measurement, is retained for up to 24 months from collection, unless required by law. Google Analytics data is retained for 14 months; Vercel, PostHog and Reviy data according to the settings of the respective services. Meta and Google retain the data they receive according to their own notices.

5. Data Recipients

Data may be processed by providers acting as data processors under Art. 28 GDPR: Vercel Inc. (hosting, Web Analytics and Speed Insights), Google LLC (Analytics, Tag Manager, Ads, also for enhanced conversions), Meta Platforms Ireland Ltd. (Pixel and Conversions API for campaign measurement), PostHog (analytics, EU servers), Reviy (visit analytics), Twilio Inc. (WhatsApp Business API), Resend (email delivery), and our internal CRM. We do not sell or share data for purposes other than those listed.

6. Transfers Outside the EU

Some providers (Google, Meta, Vercel, Twilio, PostHog) are based in the United States or transfer data outside the EEA. Transfers occur under Art. 46 GDPR based on Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, on Data Privacy Framework (DPF) certifications.

7. Your Rights

You have the right to access, rectify, erase, restrict, port, and object to processing (Arts. 15-22 GDPR). To exercise your rights write to [email protected]. We will respond within 30 days. You may also withdraw consent for analytics and marketing cookies at any time via the cookie banner (re-openable from the footer) or from our Cookie Policy. You may also withdraw at any time your consent to sharing the request data with Meta and Google by writing to [email protected].

8. Right to Lodge a Complaint

You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if you believe processing of your data violates the GDPR.

9. Automated Decision-Making

We do not carry out solely automated decision-making producing legal effects on the data subject (Art. 22 GDPR). Phone contact with you may also be made using automated calling systems; the legal basis is the consent collected in the contact form, and it can be withdrawn at any time.

10. Cookies

See our Cookie Policy for details.