AdaWebPro

Privacy Policy

Last updated: October 26, 2026

This Privacy Policy explains how AdaWebPro collects, uses, stores and protects personal data from users who visit adawebpro.it (the "Site"), in compliance with Regulation (EU) 2016/679 ("GDPR") and applicable Italian privacy law.

In short: the Site is hosted on Google Firebase Hosting, uses no analytics or advertising tracking tools and sets no profiling cookies. We collect personal data only when you provide it yourself (contact form, free scanner, AdaTrainer webinar sign-up and AdaTrainer Founder Seats order form). Fonts and images are self-hosted, with no external CDNs.

1. Data Controller

The data controller is:

AdaWebPro Via XXVII Marzo 1, 10040 Volvera (TO), Italy VAT: IT13470950018 Email: adawebpro@gmail.com Phone: +39 389 517 6199 (sales) / +39 334 780 7206 (technical)

2. Data We Collect

2.1 Contact form

When you use the contact form we collect your name and surname, email address, phone number, website address (optional, only if you provide it), the message content and the page of the Site from which the form was sent. This data is collected only when you provide it voluntarily, after reading this notice. Requests are sent to a cloud function operated by the controller and hosted in the European Union, then delivered by email to the controller's mailbox, where they are kept (see Section 6.2). For the AdaTrainer webinar sign-up see Section 2.6.

2.2 Free website Scanner

The Site offers a free tool ("Scanner") for the technical analysis of a website. To use it you provide your email address and the URL to analyse. We use this data to run the requested analysis and, where necessary, to send you at most one service message about the result, with no promotional content. The form also contains an optional, unticked box: if you tick it, you consent to receive emails from AdaWebPro with comments on the results and a proposal to improve the analysed website (Section 3, letter e). Without the tick you will receive no commercial proposals and the report remains available in any case. The analysis is run directly by your browser, which contacts two third-party services: r.jina.ai (reading the page content) and Google PageSpeed Insights (measuring page speed). These services receive the URL to analyse and, as with any web request, your IP address (see Section 6.3). When you start the analysis, the controller receives an email notification with your email address, the analysed URL, the score obtained, your choice on the consent box (ticked or not), the box text shown to you and the date and time, at most once a day for each combination of email, analysed website and consent choice (see Section 6.2). This notification is also the record we use to demonstrate your consent, if you gave it. The report and the "notification already sent" reminder are stored in your browser (local storage), as described in the Cookie Policy.

2.3 Navigation (technical) data

For the sole operation and security of the Site, the hosting infrastructure automatically processes technical data such as IP address, browser type and operating system, date and time of the request, pages requested, referrer and device type. This data is processed for technical purposes and is not used for advertising profiling.

2.4 Cookies

The Site uses only technical cookies required for operation. For details, please read our Cookie Policy.

2.5 Anti-abuse data for forms

To protect the forms (contact form, Scanner notifications and AdaTrainer webinar sign-up) from automated, bulk or duplicate submissions, on each submission the controller's cloud function records:

a request counter over a 10-minute window and a daily counter, both linked to a cryptographic hash (HMAC-SHA-256 with a secret key) of the IP address (the IP address is not stored in clear text: pseudonymised data), automatically deleted after 24 and 48 hours respectively;
an anti-duplicate fingerprint, i.e. a keyed HMAC hash of the email address and message text, used only to avoid delivering the same message twice if you resubmit it; neither the email nor the text can be recovered from this value; automatically deleted after 1 hour;
aggregate daily counters (numbers only, no personal data), deleted after 3 days, and a daily count, also free of personal data, of submissions discarded because they were recognised as automated.

The forms also contain a hidden anti-spam field that collects no data and only serves to detect automated submissions. The automatic deletions described above normally take place within 24 hours of the stated expiry. For the AdaTrainer Founder Seats order form see Section 2.7.

2.6 AdaTrainer webinar sign-up

On the AdaTrainer «Founder Seats» pre-sale page (adawebpro.it/en/adatrainer/founders) you can sign up for a presentation webinar. We collect:

name and email address;
phone number (optional);
partner code (optional, only if you enter one);
your choice on the two boxes of the form: the first, needed to sign up, with which you ask to receive the webinar link, reminders and recording by email; the second, optional and unticked, with which you consent to receive commercial communications about AdaTrainer (Section 3, letter e);
to demonstrate your choices (Art. 7(1) GDPR): date and time of the sign-up and of the consents, the IP address from which you sent the form, the page language, the version and exact text of the boxes shown to you, and the date of this notice.

This data is stored in Google Cloud Firestore (region eur3, European Union) and the controller receives an email notification with the same data, except the IP address. If you use a partner code, we only tell the partner the number of sign-ups and founder subscriptions made with their code, never your name or contact details. If you tick the second box, before sending you any commercial communication we ask you to confirm your email address with a link (double opt-in), via Brevo or from the controller's mailbox: commercial communications start only after confirmation. The webinar takes place on the online platform Google Meet and is recorded: the recording contains the speaker and the questions written in the chat with the first name only; participants' microphones and cameras stay off.

2.7 AdaTrainer Founder Seats order form

On the page adawebpro.it/en/adatrainer/founders/purchase you can request the AdaTrainer Founder contract. We collect the data needed for the contract and the invoice:

company or full name, VAT number, tax code (optional, if different from the VAT number), registered address or residence, SDI recipient code (optional);
the contact person who signs, email address, phone number (needed for the verification code of the electronic signature), certified email (PEC, optional);
activity and ATECO code;
the chosen plan and the partner code, if you use one;
the two declarations of the form (contract request and professional use), with date, time, language and the exact text shown.

The request is sent to a cloud function of a separate Google Cloud project dedicated to AdaTrainer and stored in Google Cloud Firestore in the European Union; the price and the payment reference are calculated by the server. To limit automated or repeated submissions the function records, as in Section 2.5, only counters linked to a keyed cryptographic hash of the IP address (deleted after 24 and 48 hours) and an anti-duplicate fingerprint (keyed hash of VAT number, plan and email, deleted after 24 hours): the IP address is not stored in clear. The controller may receive an email notification with the request data. With this data we prepare the contract and send it for electronic signature via Skribble; after signing, payment is by bank transfer and, once paid, we issue the electronic invoice through the Italian e-invoicing system (Sistema di Interscambio). If you use a partner code, we only give the partner numbers (contracts, plans and commission amount), never your name or contact details. The data of partners who refer AdaTrainer is processed under the privacy notice of their partner agreement.

3. Purposes and Legal Bases

a) Responding to your requests (contact form): Art. 6(1)(b) GDPR, pre-contractual measures at your request. b) Providing the free Scanner: Art. 6(1)(b) GDPR (service you requested) and Art. 6(1)(f) GDPR (legitimate interest in following up on requests). The email and URL are processed to run the requested analysis and, where necessary, to send you a single service message about the result, with no commercial proposals; comments and proposals about our services fall under purpose e) and are sent only if you ticked the optional box. The transmission of the URL and your IP address by your browser to the third-party services listed in Section 6.3 is necessary to run the analysis you requested. c) Site operation and security: Art. 6(1)(f) GDPR, legitimate interest. d) Legal obligations (e.g. tax and accounting): Art. 6(1)(c) GDPR. e) Informational or promotional communications: only with your explicit, free and optional consent, given by ticking an unticked box. In the Scanner form the box covers emails from AdaWebPro with comments on the analysis results and a proposal of AdaWebPro's own services to improve the analysed website. Consent is not a condition for using the Scanner: the report is shown in any case. In the AdaTrainer webinar sign-up form the optional box covers commercial communications about AdaTrainer (news, founder pre-sale, offers) by email and, if you left your number, by phone or WhatsApp; for email, you also need to confirm your address with the link you receive (double opt-in). Consent is not a condition for signing up for the webinar. You can withdraw it at any time and free of charge by replying to a message, following the opt-out instructions included in every email or writing to the contacts in Section 8; after withdrawal you will receive no further proposals. Your data is not shared with third parties for promotional purposes. Legal basis: Art. 6(1)(a) GDPR and Art. 130(1) and (2) of Italian Legislative Decree 196/2003. f) Preventing abuse, spam and duplicate submissions on the forms (counters and fingerprints, Section 2.5): Art. 6(1)(f) GDPR, legitimate interest in the security of the controller's services. g) AdaTrainer webinar sign-up (Section 2.6): signing you up for the webinar and sending you the link, reminders and recording. Legal basis: Art. 6(1)(b) GDPR, performance of your request. The record of your choices on the boxes is kept to demonstrate consent: Art. 6(1)(c) GDPR, in connection with Art. 7(1) GDPR.

h) AdaTrainer Founder Seats order form (Section 2.7): preparing the contract you request, sending it to you for electronic signature, managing the payment, applying any partner code and calculating its commission, activating the service and issuing the invoice. Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before entering into the contract and performance of the contract; Art. 6(1)(c) GDPR for tax and accounting obligations; Art. 6(1)(f) GDPR, legitimate interest in the security of the form, for the anti-abuse counters.

4. Processing Methods and Security

Data is processed using electronic tools and organizational procedures related to the purposes above. AdaWebPro applies technical and organizational measures compliant with Art. 32 GDPR, including HTTPS (TLS), HTTP security headers (Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy) rate limiting on form submissions with the IP address stored only in pseudonymised form (keyed hash), except for the AdaTrainer webinar sign-up record, which keeps the IP address only as evidence of your choices on the boxes (Section 2.6), and the Founder Seats order form, which keeps only the hash of the IP address (Section 2.7), and access limited to authorized persons.

5. Retention Period

Contact form and Scanner data: kept in the controller's mailbox for the time needed to handle the request and for a maximum of 24 months from the last contact; where a commercial relationship begins, for the duration of the relationship and the following 10 years (tax and accounting obligations).
Form anti-abuse counters and fingerprints: 10-minute counter linked to the IP hash automatically deleted after 24 hours; daily counter linked to the IP hash after 48 hours; anti-duplicate fingerprint (hash of email and text) after 1 hour; aggregate daily counters, containing no personal data, after 3 days.
AdaTrainer webinar sign-ups: sign-up data up to 12 months after the webinar; data for commercial communications until consent is withdrawn and in any case no longer than 24 months from the last contact; the record of your choices on the boxes follows the consent-record rule below.
AdaTrainer Founder Seats order form: if the contract is not concluded, up to 12 months from the request; if it is concluded, for the term of the contract and the following 10 years (civil-law and tax obligations); anti-abuse counters after 24 or 48 hours; anti-duplicate fingerprint after 24 hours.
Navigation (technical) data: kept only for the period needed for security and operation.
Marketing data (with consent): used until consent is withdrawn and in any case for no longer than 24 months from the last contact. The record of consent and of any withdrawal (choice, date, time and box text shown) is kept for 5 years from the last message sent, as evidence of the lawfulness of the communications.

After the retention period, data is irreversibly deleted or anonymized.

6. Parties Processing the Data (Processors and Providers)

Personal data is not disseminated. It may be processed, as processors under Art. 28 GDPR, by the technical providers the controller relies on (Sections 6.1, 6.2, 6.6 and 6.7). The third-party services your browser contacts directly when you use the Scanner (Section 6.3) do not act on behalf of the controller: they receive the data as independent controllers and process it under their own privacy notices.

6.1 Hosting and infrastructure: Google Firebase Hosting

The Site is hosted on Google Firebase Hosting (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA). The infrastructure processes technical navigation data (including the IP address) to serve, distribute (CDN) and protect the Site. Privacy Policy: https://policies.google.com/privacy

6.2 Contact form and Scanner notifications: Google Cloud, Firestore and Gmail

Data submitted through the contact form and Scanner notifications (email address, analysed URL, score, consent box choice with date, time and text shown) are sent by the browser to a cloud function operated by the controller and run on Google Cloud Functions (the Site's Firebase project, region europe-west1, Belgium), which forwards them by email (Gmail, SMTP) to the controller's mailbox adawebpro@gmail.com, where they are kept. The content of the requests is not stored in spreadsheets or databases (AdaTrainer webinar sign-ups are: see Section 6.6). For anti-abuse protection only (Section 2.5) the function stores pseudonymised counters and fingerprints in Google Cloud Firestore (region eur3, European Union). Providers: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). Privacy Policy: https://policies.google.com/privacy

6.3 Third-party services contacted by your browser when you use the Scanner

When you use the Scanner, the analysis is run by your browser, which directly contacts two third-party services:

r.jina.ai (Jina AI, free public service, outside the EEA): reads the content of the page to analyse. It receives the URL to analyse and, like any web server, your IP address.
Google PageSpeed Insights (Google LLC, USA; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): measures the speed of the page to analyse. It receives the URL to analyse, your IP address and the Referer header, i.e. the indication that the request comes from adawebpro.it. Privacy Policy: https://policies.google.com/privacy

These services are contacted only if you choose to use the optional Scanner feature and receive the data to the extent implicit in the HTTP request, solely to enable the requested analysis. They do not act as processors on behalf of the controller: they are independent controllers and apply their own privacy notices. The controller has no contractual relationship with Jina AI; for safeguards on transfers outside the EEA see Section 7.

6.4 Fonts and images: self-hosted

Fonts (Montserrat and Colmeak) and images are hosted directly on the Site's servers. The Site does not use Google Fonts or external image CDNs: loading them involves no transfer of your IP address to third parties.

6.5 No analytics or advertising tracking

The Site does not use Google Analytics or other statistics/tracking tools and sets no profiling or third-party advertising cookies.

6.6 AdaTrainer webinar sign-up: Google Cloud, Brevo and the webinar platform

Google Cloud Functions and Firestore (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; regions europe-west1 and eur3, European Union): receive and store the sign-up and the record of your choices on the boxes; the notification to the controller goes through Gmail, as for the contact form (Section 6.2); the emails with the webinar date, link and reminders are sent from the controller's Gmail mailbox (Section 6.2) or via Brevo.
Brevo (Brevo SAS, Paris, France): sends, when the service is active, the address confirmation email (double opt-in) to those who tick the commercial communications box and, after confirmation, the commercial communications about AdaTrainer; it may also be used for the emails with the webinar link, reminders and recording.
Google Meet (the webinar's online platform): hosts the webinar and its recording.

These providers process the data on behalf of the controller as processors (Art. 28 GDPR). Partners who provided a code receive no personal data: we only give them numbers (sign-ups and founder subscriptions made with their code).

6.7 AdaTrainer Founder Seats order form: Google Cloud, Skribble, Brevo and recipients for payment and invoicing

Google Cloud Functions and Firestore (Google Cloud EMEA Limited / Google Ireland Limited, Ireland; separate project dedicated to AdaTrainer, region europe-west1, European Union): receive and store the request (processor).
Skribble AG (Zurich, Switzerland): electronic signature platform we use to send you the contract; it receives the signatory's name, email and phone and the document (processor).
Brevo (Brevo SAS, Paris, France): notification email to the controller and communications about the contract (processor); until Brevo is active, emails are sent from the controller's Gmail mailbox (Section 6.2).
Revolut Bank UAB (Vilnius, Lithuania), the controller's payment institution: receives your bank transfer with the data you enter in the payment order.
The Italian Revenue Agency's Sistema di Interscambio: receives the electronic invoice as required by law.
The controller's tax advisor: receives invoicing data for accounting and tax obligations.

Partners who provided the code receive no personal data: we only give them numbers (contracts, plans, commission).

7. Transfers Outside the EEA

The cloud function and the anti-abuse database run in European Union data centres (Belgium; eur3 multi-region). However, the hosting provider and the provider of the mailbox in which requests are kept (Google, Gmail service) may process data through group companies located in the United States. For Google, such transfers comply with Chapter V GDPR, in particular through the EU-US Data Privacy Framework (DPF), to which Google LLC adheres (European Commission adequacy decision of 10 July 2023), and, additionally, the Standard Contractual Clauses (SCC) under Art. 46 GDPR. You may request information about the safeguards adopted by writing to adawebpro@gmail.com.

Brevo (Brevo SAS, Paris) stores email data on servers in the European Union (France, Belgium and Germany); Brevo group companies in the United States and India may access it for support and maintenance, under the EU-US Data Privacy Framework and Standard Contractual Clauses with supplementary measures, as provided by Brevo's data processing agreement (Appendix 3 of its Terms of Service, Annex 2).

When you use the Scanner, your browser sends the URL to analyse and your IP address directly to two third-party services (Section 6.3), at your initiative:

Google PageSpeed Insights is a service of Google LLC (USA): the safeguards described above for Google apply to the data it receives (Google LLC adheres to the EU-US Data Privacy Framework);
r.jina.ai (Jina AI) is a free public service based outside the European Union: the controller has no contractual safeguards with this provider and has not verified particular safeguards for the transfer.

If you do not want this data to reach these services, do not use the Scanner.

For AdaTrainer webinar sign-ups, the cloud function and the database run in European Union data centres. If Brevo or the webinar platform also process data outside the European Union through their own sub-processors, the transfer takes place with the Chapter V GDPR safeguards indicated by the provider (adequacy decision or Standard Contractual Clauses).

For the Founder Seats order form, the cloud function and the database run in European Union data centres. Electronic signature takes place on Skribble AG, in Switzerland, a country for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

8. Your Rights

Under Articles 15-22 GDPR you may request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent (Art. 7). You may object to promotional communications at any time and free of charge, including by replying to the message received or following the opt-out instructions included in every email (Art. 21(2) and (3) GDPR).

To exercise your rights, contact:

Email: adawebpro@gmail.com
Phone: +39 389 517 6199

The controller responds within one month (Art. 12(3) GDPR). You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

9. Minors

AdaWebPro services are not intended for users under 16. If we become aware of having collected data from a minor without valid consent, we will delete it as soon as possible.

10. External Links

This Site may contain links to external websites (e.g. portfolio projects). AdaWebPro is not responsible for the data processing carried out by those third-party sites.

11. Changes to This Policy

AdaWebPro may update this Privacy Policy at any time, publishing the updated version on this page with the latest update date.

12. Governing Law and Jurisdiction

This Privacy Policy is governed by Italian law. Any dispute shall fall under the exclusive jurisdiction of the Court of Turin, save for mandatory legal provisions in favour of the consumer.

13. Contacts

For any request regarding this Privacy Policy and the processing of personal data: