Privacy policy

This notice explains how we process the personal data of visitors to this website and of users of the Cookie Smart service, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").

Last updated: 9 October 2026

1. Data controller

PC Web Agency, with registered office at Via Carlo Treves, 24 - 88046 Lamezia Terme (Cz) Italy, VAT no. 02787830799.
Email: info@cookiesmart.it — PEC (certified email): info@pec.pcwebagency.it.

2. Data protection officer (DPO)

The data protection officer is Ing. Carmine Palermo, who can be contacted at ing.carmine.palermo@gmail.com for any matter concerning the processing of your data and the exercise of your rights.

3. What data we process

• Account data: name, email address, password (stored only as a hash, which not even we can read), date of acceptance of the terms, account and role in the team.
• Billing data: company name or full name, VAT number or tax code, SdI recipient code, PEC, address.
• Payment data: payments are made through PayPal. We do not receive or store your card or account details: from PayPal we receive the subscription and transaction identifiers, the amount, the date and the outcome.
• Technical data: while you use the dashboard, the session records your IP address and browser, which are deleted when the session expires. Sensitive operations, such as exporting the consent log, are recorded with the truncated IP address. The web server logs, managed by the hosting provider, may contain the IP address, date and requested page.
• Fingerprints for the free trial: when an account is deleted we keep a cryptographic fingerprint (hash) of the owner's email and of the domains of their websites. The email or domain cannot be derived from the fingerprint: it is used only to recognise them if they are used again for a free trial.
• Free cookie check: the address of the website you ask us to analyse and the result of the check (cookies and external services found on the home page, outcome). We do not ask for your email or any other data about you. To limit use to one check per day we temporarily keep a cryptographic fingerprint of your IP address: the address is not stored in clear and the fingerprint is not linked to the result. The analysed domain is personal data only if it corresponds to a person's name.
• Contact form: name, email, company (optional) and the text of the message. They are not stored on the website: they reach our mailbox by email.
• Communications: the messages you send us and the service emails we send you (address verification, team invitations, expiry, renewal and payment notices).

• Statistics of the public website: only if you consent to analytics cookies, Google Analytics collects browsing data (pages visited, duration, device, browser, referrer and approximate location derived from the IP address, which is not stored). Without your consent Google Analytics does not store cookies on your device. We do not use these data for advertising, we do not combine them with other data and we do not profile users. Google Analytics is not used in the dashboard.

We do not show advertising on this website and we do not profile users.

4. Purposes and legal bases

• Providing the service (registration, dashboard, banner, scans, support): performance of the contract, Art. 6(1)(b) GDPR.
• Invoicing and tax and accounting obligations: legal obligation, Art. 6(1)(c) GDPR.
• Service emails (expiry, renewals, payment problems, data deletion): performance of the contract and, for notices about data deletion, the obligation under Art. 28(3)(g) GDPR.
• Security of the service and abuse prevention, logging of sensitive operations: legitimate interest, Art. 6(1)(f) GDPR.
• Preventing repeated use of the free trial: legitimate interest, Art. 6(1)(f) GDPR, using only irreversible fingerprints.
• Free cookie check: carrying out the check you request, Art. 6(1)(b) GDPR; limiting abuse (one check per day) and producing statistics on the use of the tool, legitimate interest, Art. 6(1)(f) GDPR. We do not use the analysed domains to contact the website owners.
• Replying to contact form messages and to requests for information or quotes: pre-contractual measures at your request, Art. 6(1)(b) GDPR. The form is protected from spam without external services.
• Visit statistics of the public website (Google Analytics): your consent, Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code. You can withdraw it at any time from the cookie preferences.
• Defence of legal claims: legitimate interest, Art. 6(1)(f) GDPR.

We do not send marketing communications. If we do so in the future, it will be only with your consent.

5. How long we keep the data

• Account data (account, users, websites and settings): for the whole duration of the service. When the service ends without renewal, that is when the trial expires, at the end of the paid period after a cancellation or in case of non-payment, they are deleted automatically. We notify you by email beforehand.
• Billing and payment data: 10 years, as required for accounting records (Art. 2220 of the Italian Civil Code), even after the account is deleted.
• Fingerprints for the free trial: 24 months from the deletion of the account, then deleted automatically.
• Free cookie check: the full result stays available for 7 days, then it is deleted; the address of the analysed website, the date and the outcome are kept for 12 months for statistical purposes, then deleted; the fingerprint of the IP address is kept for 24 hours.
• Contact form messages: for the time needed to reply and in any case no longer than 24 months, unless a contractual relationship arises.
• Dashboard sessions: until the session expires.
• Google Analytics statistics: no longer than 14 months, then deleted automatically by Google. Google Analytics cookies last 13 months from the last visit.
• Log of sensitive operations: for the duration of the service, then deleted together with the account.

6. Who we share the data with

The data are processed by the controller and by authorised persons bound to confidentiality. We share them only with:

• the hosting provider (Contabo GmbH., AG Munich), which hosts the service's server, appointed as data processor;
• the email service provider (Aruba S.p.A., Italia), for sending service emails and receiving contact form messages, appointed as data processor;
• BunnyWay d.o.o. (bunny.net), Ljubljana, Slovenia (EU), which delivers the banner script from its European servers (CDN): it receives the IP address of the visitors to our customers' websites, kept in its logs for no more than 3 days and truncated, appointed as data processor;
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, which handles payments as an independent controller under its own privacy notice;
• Google Ireland Limited, Dublin, which provides Google Analytics as data processor, only for visitors who have consented to analytics cookies;
• accounting and tax advisers and public authorities, where required by law.

The data are stored on servers located in the European Economic Area. PayPal may transfer data outside the European Economic Area, with the safeguards described in its privacy notice. Google may transfer Google Analytics data to the United States: Google LLC participates in the EU-US Data Privacy Framework, recognised as adequate by the European Commission (decision of 10 July 2023), and the transfer is also covered by standard contractual clauses.

7. Data of visitors to our customers' websites

When one of our customers installs the Cookie Smart banner on their website, we record on their behalf the visitors' cookie choices: random consent identifier, accepted categories, date, truncated IP address, browser type, language and page. For these data the controller is the owner of the visited website, while we act as data processor (Art. 28 GDPR) under the terms of service. We keep them for 12 months and in any case delete them, together with the customer's account, when the service ends.

If you are a visitor to one of those websites, to exercise your rights contact the website owner, as described in their privacy notice. If you contact us directly, we will forward your request to our customer.

8. Your rights

You can request at any time access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15–22 GDPR). Write to info@cookiesmart.it or to the DPO (ing.carmine.palermo@gmail.com): we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

9. Whether providing data is mandatory

Account data are necessary to use the service, and billing data to take out a subscription: without them we cannot provide the service.

10. Cookies

This website uses technical cookies and, only with your consent, Google Analytics cookies. The details are in the cookie policy.