Privacy policy: how we handle your data

Who handles your data

The data controller, that is, whoever decides how and why your data is used, is Flag Agency, based at via XXXI Maggio 13, 80027 Frattamaggiore (NA), Italy, VAT number 09224551219.

For anything concerning your data, write to info@flagagency.it or by post to our office address.

We have not appointed a data protection officer (DPO): for a business like ours it isn’t mandatory.

What data we process

When you browse the site

Like almost every website, the server hosting flagagency.it automatically records some technical information on each visit: IP address, date and time, page requested, referring page, browser type and operating system, outcome of the request. These are the so-called server logs. They are used to run the site, to protect it from attacks and to understand any errors. We don’t use them to find out who you are.

The site doesn’t load fonts, maps, videos or other content from third-party servers: until you click an external link, you only talk to our server.

When you fill in a form

There are 13 forms on the site. Each one asks only for what we need to reply to you. Required fields are also marked with an asterisk in the form.

Data requested by each form on the site
Form	Where you find it	Required data	Optional data	What we need it for
Contact and quote	home, Contact, About us, Work	name, email and/or phone (one is enough), service you’re interested in	message	Reply to you and, if you ask, prepare a quote
E-commerce quote	PrestaShop e-commerce development	first and last name, email or phone, indicative budget	whether you already have an online shop, your website address, approximate number of products, message	Assess the project and prepare a quote
E-commerce cost calculator	E-commerce cost calculator	first and last name, email or phone	your website address, message, your calculator answers and the resulting estimate	Get back to you for a call and prepare the detailed quote from your choices
Business website	Business website	name, email or phone, type of business	whether you already have a domain	Get back to you and prepare the proposal for the business website
Social media review	Social media and TikTok	name, email or phone, TikTok or Instagram profile	your website address, social media goal, monthly ads budget	Look at your public profile and send you the review you asked for
PrestaShop support	PrestaShop support	name, email or phone, your website address, description of the problem	PrestaShop version	Understand the problem, look at your shop and send you an estimate
PrestaShop server review	PrestaShop hosting (managed server)	name, email or phone, your website address, message	hosting you use today, approximate monthly visits	Analyse your shop and the server you use today and propose a solution
PrestaShop 9 migration check-up	PrestaShop 9 migration	your website address, email	phone	Look at your shop and send you the check-up result and the quote for the migration
PrestaShop theme or module request	PrestaShop theme, PrestaShop modules and the individual module pages	name, email or phone	your website address, PrestaShop version, message	Check compatibility with your PrestaShop and explain how to get the theme or module
Custom module request (classic form or chat)	Custom PrestaShop modules	name, email and/or phone (one is enough), description of the module you need, how urgent it is	PrestaShop version, PHP version, software to connect (management system, ERP…)	Assess the module you need and send you timing and price
Accessibility report	Website accessibility	name, email, your website address, i have read the privacy notice and agree to you using this data to send me the report and get back to me.	phone, package you’re interested in, your calculator answers and the resulting estimate	Send you the analysis report and, if you ask, get back to you about a package
AI Academy application	AI Academy	first and last name, email, phone, what you do today (study, work…), subject you’re interested in, motivation	link to portfolio, website or profile	Assess the application, call you for the interview and select the participants
Job application	Careers	first and last name, email, position you’re applying for, message	phone, link to portfolio or LinkedIn profile, CV in PDF	Assess the application and, if the profile fits, contact you to get to know each other

Along with what you write, the form automatically sends us:

which form you used and the page of the site you sent it from (only the page address);
if you came from one of our campaigns, the UTM parameters of the link (for example “source: newsletter, campaign: autumn”): they tell us which campaign worked, not who you are.

We don’t store your IP address or browser type with the request. To block automated submissions (spam) the server counts how many requests come from the same IP address, but it keeps it only as a non-reversible fingerprint (hash) and uses it only for 15 minutes.

In the free-text fields (message, description of the problem, motivation) write only what’s needed. Please don’t include health data, political or religious opinions, or other “special category” data: we don’t need them.

If you apply to the AI Academy

For the application we need your first and last name, email, phone, what you do today, the subject you’re interested in and a few lines about your motivation; the portfolio link is optional. We use them to assess the application, call you for the interview and choose the participants (the Academy has at most 4 places). If you’re selected, we’ll give you a specific privacy notice for the programme.

If a company applies on behalf of one of its staff, the candidate’s data reaches us from the company: in that case the company must have informed the person, who can read this page and ask us at any time what we know about them. At the first contact we tell them who we received their data from.

If you apply to work with us

From the Careers page you can apply for an open position or send us a speculative application. We need your first and last name, email, the position you’re interested in and a few lines about you; phone, a link to your portfolio or LinkedIn profile and a CV are optional. We use this data only to assess the application and, if your profile matches what we’re looking for, to contact you and get to know each other.

The CV can only be attached as a PDF (up to 5 MB). We store it with a random name in an area of the server that is not reachable from the web: it has no public address and can only be downloaded by the administrators of our panel, with personal access. Put in your CV only what’s needed to assess you: no photos, health data, political or religious opinions are needed. If you send them anyway, we use them only for the selection.

Applications and CVs are deleted automatically 12 months after they are sent. If you want us to delete your application sooner, just ask. If you’re hired, the data needed moves on to the employment relationship, with a specific privacy notice.

If you write to us on WhatsApp, by email or call us

If you click one of the WhatsApp buttons, the WhatsApp app opens with a pre-written message: no data passes through our site. The chat takes place on WhatsApp, a service of WhatsApp Ireland Limited (Meta group), which processes your data as an independent controller under its own privacy policy. We see your number, your profile name and what you write to us, and we use them only to reply to you.

The same goes for emails to info@flagagency.it and phone calls: we use the data you give us only to reply to you.

If you use the custom modules chat

On the Custom PrestaShop modules page you can describe the module you need to an AI assistant: it’s a program, not a person. What you write in the chat (the description of the module, the PrestaShop and PHP versions, the software to connect, how urgent it is and, at the end, name, email and/or phone) is sent to Anthropic PBC (United States), the provider of the artificial intelligence model, which processes it on our behalf only to generate the chat replies (provider’s privacy policy).

When the request is complete, the assistant writes a summary that we store like form requests, with name and contact details: a person from the team reads it to reply to you. The full conversation stays on our server only while you’re chatting: it is deleted after 2 hours of inactivity and in any case within 24 hours. We never write the chat text in the panel log. Don’t write passwords, shop logins or payment details in the chat. If you’d rather not use the assistant, the classic form is always there, and it doesn’t go through the AI provider.

If you use the free accessibility check

On the Website accessibility page you enter the address of a website: our server downloads that public page (and, if there is one, the accessibility statement page) and checks it. We don’t ask you for personal data and we don’t store the full address checked: for the service statistics we store only the domain (for example shop.com), with date, language, score, check results and whether you then contacted us; this data is deleted automatically after 24 months. To prevent abuse we count the checks coming from the same IP address, kept only as a non-reversible fingerprint for 60 minutes.

If you then request the full report with the form below the result, we store name, email, phone (if you enter it), website address, the package you’re interested in and your consent, like other requests. Our checking server opens a few public pages of the website with an automated browser: we send that server only the website address, never your data. The report is on a private page, reachable only with the link we email you, valid for 90 days.

The site uses only technical browser storage and, only if you accept, measurement tools. You’ll find the full list, with names and durations, in the cookie policy.

Why we use it and on what legal basis

The GDPR requires us to state, for each use of the data, its “legal basis”, that is, the reason that makes it lawful. Here they are, in plain words.

Purposes of processing and legal bases
Why we use the data	Legal basis (GDPR)
Replying to your requests: quotes, support, social media reviews, information	Pre-contractual steps taken at your request (Art. 6(1)(b))
Assessing your AI Academy application and arranging the interview	Pre-contractual steps taken at your request (Art. 6(1)(b))
Assessing your job application (including speculative ones) and CV, and contacting you to get to know each other	Pre-contractual steps taken at your request (Art. 6(1)(b)); for CVs sent on your own initiative no consent is required (Art. 111-bis of the Italian Privacy Code)
Collecting your custom module request with the AI chat and passing it to the team	Pre-contractual steps taken at your request (Art. 6(1)(b))
Checking the accessibility of the page you give us and showing you the result	Pre-contractual steps taken at your request (Art. 6(1)(b)): the address is not stored
Running the site and protecting it from spam and attacks (server logs, submission limit)	Our legitimate interest in the security of the site (Art. 6(1)(f))
Understanding which page or campaign requests come from (submission page and UTM parameters)	Our legitimate interest in understanding which pages work, with minimal data (Art. 6(1)(f))
Measuring visits to the site statistically	Your consent, given in the cookie banner and revocable whenever you like (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code)
Defending our rights in case of disputes	Our legitimate interest (Art. 6(1)(f))
If you become a client: contract, invoices and tax obligations	Performance of the contract and legal obligations (Art. 6(1)(b) and (c))

Where we rely on legitimate interest, we have checked that it doesn’t weigh on your rights: we use little data, for a short time. You can still object.

We don’t use form data to send you newsletters or advertising, and we don’t sell it. The only artificial intelligence service that receives data from the site is the assistant in the custom modules chat, and only for what you write there; we don’t pass data from the classic forms to artificial intelligence services.

Do you have to give us your data?

No, nobody makes you. But without the required fields of the form (name and a way to get back to you) we can’t reply to you or assess your application. The optional fields help us give you a more precise answer: if you prefer, leave them empty.

How long we keep it

Requests sent through the forms (quotes, support, social media reviews, contact): 365 days from receipt, then the system deletes them automatically. If you become a client in the meantime, the data moves on to the contract and we keep it for the time required by law (for example 10 years for accounting documents).
AI Academy applications: 365 days from receipt, like other requests. If you aren’t selected and want us to delete the application sooner, just ask.
Job applications and CVs: 12 months from receipt, then the system automatically deletes the application and the CV file. If you aren’t selected and want us to delete it sooner, just ask.
Notification emails the team receives for each request: The team receives a copy of the request in the info@flagagency.it mailbox. We delete them under the same rule as the forms.
Conversation with the custom modules chat assistant: On our server: deleted after 2 hours of inactivity and in any case within 24 hours. The summary of the request, with name and contact details, is kept like other form requests. At the AI provider:
Accessibility check: The full address checked is not kept; domain and results for the statistics are deleted after 24 months; the private report link expires after 90 days; the IP fingerprint for the check limit is deleted after 60 minutes.
WhatsApp chats and emails you send us directly: As long as needed to reply and follow up on the request.
Server logs: For the time set by the hosting provider for security reasons.
IP address fingerprint for the submission limit: 15 minutes.
Cookie choice: 180 days, in your browser: after that we ask you again.

If you ask us to delete your data sooner, we do it without waiting for the deadlines (unless the law requires otherwise).

Who else can see it

The data is seen only by the people on the Flag team who need to reply to you, with personal, password-protected access. To run the site we rely on some providers, who process the data on our behalf as processors (Art. 28 GDPR), under a contract that obliges them to protect it:

Hosting: the provider that hosts the site, the forms and their archive.
Email: the service that manages the info@flagagency.it mailbox and the notification emails.
Tag Manager Head: a tool enabled from our panel, only if you accept cookies.
Tag Manager Body: a tool enabled from our panel, only if you accept cookies.
Artificial intelligence: Anthropic PBC (United States), only for the messages you write in the custom modules chat.
Advisers (for example our accountant) only if you become a client and only for legal obligations.

WhatsApp (Meta) is not one of our providers for the site: if you choose to write to us there, it processes your data as an independent controller. The same applies to social networks, if you open our profiles. Your data is not disclosed or sold. We might have to give it to the authorities only if the law requires it.

Transfers outside the European Union

Form data stays in the European Union: it is on our hosting provider’s server.

If you use the custom modules chat, what you write is processed by Anthropic PBC in the United States: this is a transfer outside the European Union, carried out with the safeguards provided by the GDPR (European Commission standard contractual clauses in the contract with the provider). The classic form and the accessibility check don’t transfer data outside the Union.

If you write to us on WhatsApp, Meta may transfer the data to the United States: it does so with the safeguards described in its privacy policy (EU-U.S. Data Privacy Framework and European Commission standard contractual clauses).

Profiling and automated decisions

We don’t carry out profiling and we don’t make decisions based solely on automated processing. Every request and every application is read and assessed by a person on the team.

How we protect the data

The site works only over HTTPS: what you send travels encrypted.
The request archive sits outside the public part of the server and can’t be reached from the web.
CVs have a random name, sit in the same protected area and can only be downloaded from the panel, by administrators: no public link. The server checks that the file really is a PDF.
Only people on the team can access the private area, with personal credentials, lockout after too many failed attempts and automatic logout after a period of inactivity.
The panel activity log doesn’t contain the personal data in the requests.

Your rights and complaints to the supervisory authority

At any time, free of charge, you can ask us for:

access: to know whether we hold your data, what it is and receive a copy (Art. 15);
rectification: to correct or complete it (Art. 16);
erasure: to have it deleted (Art. 17);
restriction: to have us suspend the use of the data in some cases (Art. 18);
portability: to receive it in a machine-readable format, to give it to someone else (Art. 20);
objection: to object to uses based on our legitimate interest (Art. 21);
withdrawal of consent, if you gave it (for example for measurement cookies): without affecting what we did before the withdrawal (Art. 7).

To exercise them, write to info@flagagency.it. We reply within one month (Art. 12). If we can’t tell who you are, we may ask you for some information to verify it, so as not to give your data to someone else.

If you think we’re processing your data improperly, you can lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, via its website garanteprivacy.it, or with the supervisory authority of the European country where you live or work. If you like, write to us first: we’ll try to sort it out together.

Minors

The site is designed for businesses and professionals. We don’t knowingly collect data from children under 14: if you notice that a minor has sent us their data, write to us and we’ll delete it.

Changes to this policy

If we change the way we process data (for example if we enable an analytics tool or change provider) we update this page and the date at the top. For important changes we also let you know on the site.