Privacy Policy

1. Data Controller

The Data Controller for the processing of personal data is FlexCode, with registered and operating office in Sant'Agata di Militello (Messina), Italy, VAT IT03670160831, reachable at the following contact details:

• Email: info@flexcode.it
• Phone: +39 331 189 1085
• Registered and operating office:Sant'Agata di Militello (Messina), Italy

2. Types of Data Collected

FlexCode collects and processes the following categories of personal data:

2.1 Data provided voluntarily by the user

• Contact data: first name, last name, email address, phone number
• Business data: company name, industry sector, role within the company
• Project-related data: project description, indicative budget, type of service requested
• Communications: content of messages sent through the contact form or by email

2.2 Data collected automatically

• Browsing data: IP address, browser type, operating system, pages visited, time and duration of the visit
• Cookies and similar technologies: as described in our Cookie Policy

FlexCode does not collect special categories of data pursuant to Art. 9 GDPR (e.g., data concerning health, political opinions, religious beliefs, or sexual orientation).

3. Purposes and Legal Basis of Processing

Personal data is processed for the following purposes, each with its own legal basis:

4. Methods of Processing

Data is processed using IT and electronic tools, following logic strictly related to the purposes indicated, and adopting technical and organizational measures adequate to ensure a level of security appropriate to the risk (Art. 32 GDPR).

Data is not subject to automated decision-making or automated profiling within the meaning of Art. 22 GDPR.

5. Data Recipients

Personal data may be disclosed to the following categories of recipients:

• IT service providers: hosting, email, CRM and work-tool providers (e.g., Google Workspace, Vercel, AWS), acting as Data Processors pursuant to Art. 28 GDPR
• Professionals and consultants: accountants, lawyers, labor consultants, bound by professional confidentiality
• Public authorities: where required by law or ordered by a judicial authority

Data is never sold or transferred to third parties for third-party marketing purposes.

6. Transfer of Data to Third Countries

Some service providers used by FlexCode (e.g., Google, AWS, Vercel) may transfer data outside the European Economic Area (EEA). In such cases, the transfer takes place in compliance with the safeguards set out in Chapter V of the GDPR, such as:

• Adequacy decisions issued by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Recognized certification mechanisms (e.g., the EU-U.S. Data Privacy Framework)

7. Retention Period

Personal data is retained for the time strictly necessary to fulfil the purposes for which it was collected:

• Contact requests not followed by a contract: 24 months from the date of receipt
• Data relating to contractual relationships: 10 years from the termination of the relationship (tax and accounting obligations)
• Browsing data and logs: a maximum of 12 months
• Newsletter and commercial communications: until consent is withdrawn

At the end of the retention period, data will be irreversibly deleted or anonymized.

8. Rights of the Data Subject

Pursuant to Articles 15–22 GDPR, you have the right to:

• Access (Art. 15): obtain confirmation as to whether personal data concerning you is being processed and obtain a copy of it
• Rectification (Art. 16): obtain the correction of inaccurate data or the completion of incomplete data
• Erasure (Art. 17): obtain the erasure of your personal data ("right to be forgotten")
• Restriction of processing (Art. 18): obtain the restriction of processing in certain cases
• Data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format
• Objection (Art. 21): object to processing at any time, in particular for direct marketing purposes
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal

To exercise one or more of the rights indicated above, you may send a request to info@flexcode.it. We will respond within 30 days of receiving the request. In cases of particular complexity, this period may be extended by a further 60 days, with prior notice.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it), if you believe that the processing of your personal data violates the GDPR.

9. Data Security

FlexCode adopts adequate technical and organizational measures to protect personal data from unauthorized access, loss, destruction or disclosure. Measures adopted include:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of sensitive data at rest
• Data access restricted to authorized personnel
• Regular backups and disaster recovery procedures
• Periodic staff training on data security

In the event of a personal data breach, FlexCode will notify the Garante and, where necessary, the data subjects concerned, within the timeframes set out in Articles 33–34 GDPR.

10. Cookies

FlexCode's website uses cookies and similar technologies. For detailed information on the cookies used, their purposes, and how to manage them, please refer to our Cookie Policy.

11. Changes to This Privacy Policy

FlexCode reserves the right to amend this notice at any time, in particular in the event of regulatory changes or changes to the services offered. Amendments will be published on this page, together with an update to the date shown at the bottom. In the event of substantial changes, we may notify you by email.

We invite you to periodically review this page. Continued use of the site after amendments have been published constitutes acceptance of such amendments.