Privacy notice
Last updated: 1 November 2026
In short
We use your data to reply to you and to work with you, if we both decide to. We don't sell it, profile you or send you advertising. This notice is given under Article 13 of EU Regulation 2016/679 (GDPR).
Who handles your data
The joint controllers are Riccardo Staiano e Mattia Cassanelli. For any privacy question write to vexus.agency.lab@gmail.com: you can contact either of us. We have not appointed a data protection officer.
What data
Please don't include health data or other special categories of data in your message, or other people's data without their knowledge.
- Contact form: your name, email or phone number, your message and whether you are a company or an individual.
- Direct messages: what you send us by email, WhatsApp or Instagram, including your address, number or profile.
- Technical browsing data: the server hosting the site may log IP address, date and time, page requested and browser type.
- Data saved in your browser: it stays on your device and is described on the cookies page.
Why, and on what legal basis
- Replying to your request and preparing a quote or contract: pre-contractual steps you asked for and performance of a contract, Art. 6(1)(b) GDPR.
- Meeting legal duties, such as tax and accounting, if we start working together: Art. 6(1)(c) GDPR.
- Keeping the site secure, blocking automated submissions and defending our rights: legitimate interest, Art. 6(1)(f) GDPR. You can object at any time.
Do you have to give us this data?
No, contacting us is your choice. But without a name, a contact and a message we can't reply. We don't make automated decisions and we don't profile you.
Who can see it
We don't sell your data or give it to others for their marketing.
- Hostinger: hosts the site and handles technical data and the form while it is being sent. The site doesn't save requests in a database.
- Google (Gmail): our email and form requests arrive and are stored here.
- WhatsApp and Instagram (Meta): only if you choose to write to us there. The message goes through your app, and Meta's own terms and privacy notice also apply.
- Accountants, advisers and authorities: only where needed for legal duties or to defend a right.
Outside the European Union
Google and Meta may also process data outside the European Economic Area, for example in the United States. In those cases the transfer relies on the tools in Articles 44-49 GDPR, such as an adequacy decision or standard contractual clauses. You can ask us for more information at vexus.agency.lab@gmail.com.
How long we keep it
We may keep data for longer only where needed for an ongoing dispute.
- Requests that don't become a project: up to 24 months from the last contact, then we delete them.
- Contracts and accounting records: 10 years, as required by Article 2220 of the Italian Civil Code.
- Server technical data: for the time set by the hosting provider for security and operation.
- Data in your browser: the periods are listed on the cookies page.
Your rights
Under Articles 15-22 GDPR you can ask for access, correction, erasure, restriction and portability of your data, and you can object to processing based on legitimate interest. Just email vexus.agency.lab@gmail.com: it's free and we reply within one month.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of the country where you live.
Minors
Our services are intended for adults. If you are under 18, please ask a parent or guardian to contact us for you.
Changes
If anything changes we update this page and the date at the top.