1. Data controller
The data controller is CityPixel LLC, a limited liability company registered at [registered address, Wyoming, USA].
For any question about your data, or to exercise your rights, write to info@[dominio-citypixel].
We have not appointed a Data Protection Officer (DPO), as it is not required for the type and volume of processing we carry out.
2. Representative in the European Union
As CityPixel LLC is established outside the European Union and offers its services to people in the EU, it has designated a representative under Article 27 GDPR, whom you can contact on any matter relating to the processing of your data: [to be appointed: name and address in the EU].
3. What data we process
- "Free review" form data: full name, email, WhatsApp number, city, industry, indicative advertising budget, your current setup (website, social media, Google Maps, advertising) and whether you want to receive emails. We also record the date and time of submission, language, page you wrote from and the version of this policy you saw, as proof of your request and of any consent.
- Communications data: the messages you send us via WhatsApp or email and the information you share during the review video call.
- Client data: if you hire us, the data needed for the contract and invoicing (company name, tax ID, address, payment details).
- Browsing data: the server hosting the website automatically records technical data in its log files, such as IP address, date and time of the request, page visited, browser type and operating system.
- Data collected through cookies and analytics tools: only if you consent, we collect statistical browsing data (pages viewed, visit duration, traffic source, device type, approximate location) via Google Analytics. See the cookie policy for details.
- Cookie consent data: the choices you make in the cookie banner, together with an anonymous identifier, the date and an anonymised IP address.
We do not ask for, and do not want to receive, special categories of data (such as health data): please do not include them in your messages.
4. Why we process data and on what legal basis
| Purpose | Legal basis | Data used |
|---|---|---|
| Replying to your request, arranging the free review and preparing a quote | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | Form and communications data |
| Sending you emails with tips and news | Your optional, revocable consent (Art. 6(1)(a)) | Name, email, proof of consent |
| Managing client relationships, invoicing and accounting | Performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) | Client data |
| Measuring how the website is used, in statistical form, to improve it | Your consent via the cookie banner (Art. 6(1)(a)) | Data collected through analytics cookies |
| Recording and proving your cookie choices | Legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1)) | Cookie consent data |
| Running the website and protecting it from attacks and abuse | Legitimate interest in website security (Art. 6(1)(f)) | Browsing data |
| Defending our rights in the event of a dispute | Legitimate interest (Art. 6(1)(f)) | Only the data strictly needed |
5. Do you have to give us your data?
The form fields are needed to reply to you and arrange the review: without them we cannot contact you. The email box is optional, and leaving it unticked makes no difference to your request. Analytics cookies are optional too: you can decline them and the website will still work.
6. How we protect data
We process data electronically and apply appropriate technical and organisational measures: encrypted connection (HTTPS), access limited to people who need it, accounts protected by passwords and two-step verification, and providers offering security guarantees.
7. Who we share data with
We do not sell your data or pass it on to third parties for their own marketing. To run our service we rely on a few providers, who process data on our behalf as processors (Art. 28 GDPR), under a contract and only following our instructions:
| Provider | What we use it for | Provider's privacy policy |
|---|---|---|
| Hostinger | Website and email hosting | hostinger.com |
| Make (Celonis) | Automation that receives and forwards form data | make.com |
| Storing requests (Google Sheets), notification emails (Gmail), Google Tag Manager and Google Analytics | policies.google.com | |
| Usercentrics (Cookiebot) | Cookie banner and consent records | cookiebot.com |
| WhatsApp (Meta) | Communicating with you when you contact us, or we contact you, on WhatsApp | whatsapp.com |
Data may also be disclosed to tax and legal advisers bound by professional secrecy, and to authorities where required by law.
8. Transfers outside the European Union
CityPixel LLC is based in the United States, and some providers (for example Google, Meta and Celonis, the company behind Make) may process data in the United States or other countries outside the EU.
These transfers only take place with the safeguards provided by the GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework, for companies certified under it (you can check the official list), or the Standard Contractual Clauses approved by the European Commission. You can ask us about the safeguards in place by writing to info@[dominio-citypixel].
9. How long we keep data
| Data | Retention period |
|---|---|
| Requests that do not turn into a project | 24 months from the last contact, then deleted |
| Tips and news emails | Until you withdraw consent, or after 24 months without any interaction |
| Client data and accounting records | For the whole relationship and then for the periods required by applicable tax and accounting rules |
| Google Analytics statistics | 14 months |
| Cookie consent records | 12 months; the banner is shown again when they expire |
| Server technical logs | For the period set by the hosting provider for security purposes |
10. Your rights
At any time, and free of charge, you can:
- access your data and get a copy (Art. 15);
- correct it if it is inaccurate or incomplete (Art. 16);
- ask for it to be erased (Art. 17);
- restrict its processing (Art. 18);
- receive it in a structured, machine-readable format, or have it sent to another controller (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before (Art. 7(3)).
To exercise your rights, write to info@[dominio-citypixel]. We reply within one month; for complex requests we may extend this by two further months, letting you know. We may ask you to confirm your identity.
To stop receiving our emails, just click the link included in each one. To change your cookie choices, use the "Cookie preferences" link at the bottom of every page.
If you believe the processing breaches the GDPR, you can lodge a complaint with the supervisory authority of the EU country where you live, work or where the alleged breach took place: for example the Garante per la protezione dei dati personali in Italy or the Agencia Española de Protección de Datos in Spain.
11. Automated decisions and profiling
We do not make decisions about you based solely on automated processing, and we do not use the form data to profile you.
12. Children
Our services are aimed at businesses and professionals. The website is not intended for children under 16, and we do not knowingly collect their data.
13. Visitors outside the European Union
The website and our services are designed for businesses in Europe. We apply the protections in this policy to all visitors. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under US state privacy laws.
14. Changes to this policy
We may update this policy when our processing or the law changes. The version in force and the date of the last update are always shown at the top.