Privacy Policy

This notice explains how PennyWeb processes the personal data of people who visit this website or contact us, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 7 October 2026.

1. Data controller

The data controller is PennyWeb, VAT no. 06920340483. For any request about your data, write to info@penny-web.it.

2. What data we process

• Browsing data. For the sole purpose of running and securing the site, our server and hosting provider log data such as IP address, date and time of the request, page visited, browser and device type.
• Data you send us. When you use the contact form or the guided quote you give us your name, email, phone (optional), company (optional), your message and a summary of the options chosen in the quote. If you write to us by email or WhatsApp we process the address or number you write from and the content of your messages.
• Site usage data (only with your consent). If you accept statistics cookies, Google Analytics 4 collects aggregated information such as pages viewed, visit duration, device type, referral source and approximate location, linked to online identifiers (cookies). See the Cookie Policy.

3. Why we process it and on what legal basis

• Replying to your requests and preparing a quote: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract).
• Keeping the site secure and preventing abuse (for example limiting repeated form submissions and blocking automated messages): the controller’s legitimate interest, Article 6(1)(f) GDPR.
• Statistics on site usage: consent, Article 6(1)(a) GDPR. You can refuse or withdraw it at any time without affecting your use of the site.
• Complying with legal obligations, such as tax and accounting rules if a contract is concluded: Article 6(1)(c) GDPR.

We do not send promotional messages or newsletters without your specific, separate consent, and we do not sell your data.

4. Providing your data

The fields marked as required in the forms (name and email) are needed to reply to you: without them we cannot handle your request. Other fields are optional. Accepting statistics cookies is always optional.

5. Recipients

Data is processed by the controller and authorised persons. It may be shared with suppliers acting as data processors, in particular: the site’s hosting and email provider; Google Ireland Limited for Google Analytics, only if you have given consent. If you contact us through WhatsApp, your data is also processed by WhatsApp under its own notice: the site only contains a link and does not load any WhatsApp components. Data is not disclosed to the public.

6. Transfers outside the European Economic Area

Google may process data in non-EU countries, in particular the United States. Transfers rely on GDPR safeguards such as the adequacy decision for companies certified under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. How long we keep data

• Enquiries and quotes: for as long as needed to reply and handle the negotiation and, if nothing else follows, no longer than 24 months from the last contact.
• Contract, tax and accounting data: for the periods required by law (usually 10 years).
• Browsing data: for as long as strictly necessary for security and operation, according to the hosting provider’s settings.
• Statistics data (Google Analytics): for the retention period set in the controller’s Google Analytics account. Cookies last as stated in the Cookie Policy.
• Your cookie choice: 6 months, after which you will be asked again.

8. Your rights

You can ask us at any time for access to your data, rectification, erasure, restriction of processing, portability, and you can object to processing (Articles 15-22 GDPR). You can withdraw consent to statistics cookies with the “Manage cookies” button at the bottom of every page, without affecting the lawfulness of processing already carried out. To exercise your rights write to info@penny-web.it. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country of residence.

9. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects on you.

10. Children

The site is aimed at businesses and professionals and is not intended for children under 14. If you believe a child has sent us personal data, write to us and we will delete it.

11. Changes to this notice

We may update this notice, for example if the services we use or the law change. The version in force is always the one published on this page, with the update date shown at the top.