Last updated: 13 September 2026
This Privacy & Cookie Policy explains how personal data is processed when individuals visit wpixo.com, submit an enquiry through the website, contact WPixo by email or WhatsApp, or enter into a pre-contractual or contractual relationship with WPixo.
This notice is provided in accordance with Articles 12 and 13 of Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR), Italian Legislative Decree no. 196 of 30 June 2003, as amended (the Italian Data Protection Code), and the applicable Italian and European rules governing cookies and similar tracking technologies.
Where mandatory data protection laws in another jurisdiction apply to a particular processing activity, any additional rights granted under those laws remain unaffected.
1. Data Controller
The Data Controller is:
Valerio Bellone – WPixo
Via della Vetriera 21
90133 Palermo (PA), Italy
Italian Tax Code: BLLVLR79D14G273V
VAT No.: 07441770828
Email: info.wpixo@gmail.com
2. Categories of Personal Data We Process
WPixo may process the following categories of personal data.
Browsing and security data
The website infrastructure, hosting provider and security tools may automatically collect technical information associated with website use, including IP address, date and time of the request, requested page, referring page, browser and device type, operating system, technical identifiers, request status, and logs relating to errors, access attempts or potentially abusive activity.
Data submitted through forms
Forms available on the website may collect:
- the selected service or type of enquiry;
- name;
- email address;
- optional telephone number or WhatsApp contact;
- optional URL of an existing website;
- preferred or approximate project start date;
- a description of the project, requirement or issue;
- any additional information voluntarily provided by the user.
The selected service may be pre-filled according to the button used to access the Contact page.
The forms are built using Fluent Forms. Submitted enquiries are stored in the website’s WordPress database and forwarded to the Data Controller’s email address. The system may also associate technical information with the submission, including the user’s IP address, browser, device and referring page.
Users are requested not to submit special categories of personal data within the meaning of Article 9 GDPR, passwords, access credentials, confidential information or any other information that is not necessary for the enquiry.
Data provided by email or WhatsApp
When a user chooses to contact WPixo by email or WhatsApp, WPixo processes the contact details used, the content of the communication, any attachments and any additional information voluntarily provided.
Pre-contractual and contractual data
When a user requests a quotation or engages WPixo to provide a service, WPixo may process identification and contact details, tax and billing information, communications, quotations, contracts, information concerning the client’s business, materials supplied by the client and any other information necessary to assess, prepare or perform the agreed services.
Technical data relating to client websites
In order to build, redesign, review, maintain or manage a WordPress website, WPixo may receive access credentials, dedicated user accounts, configuration information, hosting information, technical logs and access to website content or databases, strictly to the extent required to perform the agreed services.
Administrative and payment data
WPixo processes the information required for invoicing purposes, together with information contained in bank transfers or administrative records.
WPixo does not directly collect or store the client’s full payment-card or payment-instrument details.
Analytics data
Subject to the user’s consent, Google Analytics 4 may collect online identifiers and information concerning the use of the website, including visited pages, interaction events, visit duration, browser and device type and approximate geographic information.
3. Purposes and Lawful Bases for Processing
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries, understanding a prospective client’s requirements and preparing a quotation | Steps taken at the request of the data subject prior to entering into a contract – Article 6(1)(b) GDPR |
| Performing a contract and providing the agreed services | Performance of a contract – Article 6(1)(b) GDPR |
| Managing communications, support and requests relating to an engagement | Performance of a contract or pre-contractual measures – Article 6(1)(b) GDPR |
| Issuing and retaining invoices and administrative documentation | Compliance with a legal obligation – Article 6(1)(c) GDPR |
| Ensuring website operation and security, preventing abuse and protecting the infrastructure | Legitimate interests of the Data Controller – Article 6(1)(f) GDPR |
| Establishing, exercising or defending legal claims | Legitimate interests of the Data Controller – Article 6(1)(f) GDPR |
| Loading font resources required for the visual presentation of the website | Legitimate interest in ensuring the proper presentation of the website – Article 6(1)(f) GDPR |
| Producing website usage statistics through Google Analytics | Consent – Article 6(1)(a) GDPR and Article 122 of the Italian Data Protection Code |
WPixo does not use personal data collected through the website for newsletters, personalised advertising or unsolicited promotional communications.
4. Providing Personal Data
Fields marked as mandatory in website forms must be completed in order for WPixo to review and respond to an enquiry.
Telephone or WhatsApp details, the URL of an existing website and the preferred project start date are optional unless they subsequently become necessary for the specific service requested.
The checkbox associated with this Privacy Policy confirms that the user has had the opportunity to read the notice. It does not constitute consent to receive marketing communications and does not replace the lawful bases described in this Policy.
Information required for invoicing and for the performance of an engagement must be provided where necessary to establish and manage the contractual relationship.
Consent to analytics cookies is optional. Refusing or withdrawing consent does not prevent users from browsing the website or contacting WPixo.
5. How We Process and Protect Personal Data
Personal data is processed primarily by electronic means and in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation.
WPixo applies technical and organisational measures proportionate to the level of risk, including access protection, software updates, backups, security tools and restrictions designed to ensure that personal data is accessible only to authorised persons.
Credentials provided for work on client websites are used exclusively for the agreed activities. Wherever possible, clients are encouraged to create individual, dedicated user accounts with only the permissions necessary for the relevant work and to revoke them when access is no longer required.
Use of artificial intelligence tools
WPixo may use artificial intelligence tools to support activities such as research, organisation, drafting and optimisation.
Where such tools are used, the information provided is limited to what is necessary and, wherever reasonably possible, anonymised or de-identified.
Passwords, access credentials, databases and confidential client materials are not deliberately submitted to publicly accessible artificial intelligence services.
Where a specific engagement requires personal data to be processed through an external AI service provider, the proposed use will be assessed and, where required, appropriately governed in accordance with the GDPR.
6. Recipients and Service Providers
Personal data may be disclosed or made accessible, to the extent necessary, to the following categories of recipients and service providers:
- Namecheap, Inc., as provider of the hosting and infrastructure used by wpixo.com, including databases, technical logs, domain-related services and infrastructure backup functions;
- Google Ireland Limited and other Google group companies, for communications through Gmail, the delivery of Google Fonts and, only where consent has been provided, Google Analytics 4 statistics connected through Site Kit;
- Defiant, Inc., provider of Wordfence, for firewall services, security scanning, prevention of unauthorised access and the processing of associated technical data;
- WhatsApp Ireland Limited and other Meta group companies, when a user voluntarily chooses to communicate with WPixo through WhatsApp;
- any storage or backup providers configured by the Data Controller, limited to information contained in backup copies;
- banks, accountants and professional advisers subject to confidentiality obligations;
- authorised collaborators or technical professionals, where their involvement is necessary for the performance of an engagement and subject to the applicable confidentiality and data protection obligations;
- public authorities or other entities where disclosure is required by law.
The privacy policies of the main providers are available here:
- Namecheap Privacy Policy;
- Google Privacy Policy;
- Wordfence Privacy Policy;
- WhatsApp Privacy Policy for the European Region.
Fluent Forms, Complianz, Popup Maker, UpdraftPlus, Yoast SEO and Block Visibility are software components installed within the WordPress environment. Their presence does not, in itself, mean that the personal data collected through the website is disclosed to their respective developers.
Any external integrations or remote services activated in the future will be assessed and, where necessary, reflected in this Privacy Policy.
An up-to-date list of Data Processors may be requested from the Data Controller.
7. Processing Performed on Client Websites
This Privacy Policy concerns processing activities for which Valerio Bellone – WPixo acts as Data Controller. It does not replace the privacy policies published by WPixo’s clients on their own websites.
When WPixo processes personal data contained on a client’s website, following that client’s instructions, in connection with website development, Check-up, Care, Care+ or Website Management services, the client will normally act as the Data Controller and WPixo as the Data Processor.
Before processing of this nature begins, the parties will define the relevant roles, instructions, duration of processing, security measures and any authorised sub-processors in a Data Processing Agreement (DPA) in accordance with Article 28 GDPR.
WP Umbrella
For ongoing website management and maintenance services, WPixo may use WP Umbrella, provided by LIVEN STUDIO SAS, for website updates, monitoring, security and backups.
In this context, WP Umbrella does not operate as a service used by visitors to wpixo.com. Instead, it may act as a sub-processor in relation to personal data contained on a client website managed by WPixo.
Its use and the applicable conditions will be identified, where relevant, in the Data Processing Agreement required under Article 28 GDPR.
Further information is available in the WP Umbrella Privacy Policy and Data Processing Agreement.
8. International Data Transfers
Some service providers used by WPixo may process personal data in countries outside the European Economic Area (EEA), including the United States.
Where an international transfer takes place, WPixo relies, as applicable to the relevant provider and processing activity, on an adequacy decision adopted by the European Commission, participation in the EU–US Data Privacy Framework, Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism provided for under Articles 44 et seq. GDPR.
9. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected. In particular:
- contact enquiries and quotations that do not result in a contract: up to 12 months from the last communication;
- form submissions stored in the WordPress database: up to 12 months from submission or from the last communication relating to the enquiry;
- email or WhatsApp communications: for the period necessary to deal with the enquiry and thereafter according to the applicable pre-contractual or contractual retention period;
- contractual, accounting and tax information: 10 years following the end of the contractual relationship, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims;
- project materials, credentials and technical data: for the duration of the project or service and thereafter only for the period strictly necessary for delivery, termination of access or the management of potential disputes;
- technical and security logs: for the period configured in the relevant hosting and security systems and no longer than necessary to protect the website, prevent abuse or investigate security incidents;
- Google Analytics user-level and event data: for the period configured in the relevant Analytics property and in any event no longer than 14 months; aggregated reports that no longer contain identifiers may be retained for longer;
- cookie consent preferences: 12 months, unless the user deletes them earlier or material changes to the relevant processing activities require consent to be requested again;
- backup copies: until they are overwritten or deleted as part of the normal backup rotation process.
Personal data may be retained for longer where necessary to comply with a legal obligation, comply with an order issued by a competent authority, or establish, exercise or defend legal claims.
10. Cookies and Similar Technologies
Cookies are small text files or similar pieces of information that a website may store on a user’s device.
wpixo.com uses strictly necessary cookies and, only with the user’s consent, analytics cookies.
Strictly necessary cookies
Strictly necessary cookies are used for website operation and security, to manage user preferences and to record choices made through the cookie banner.
They do not require the user’s consent.
| Cookie or group | Purpose | Approximate duration |
|---|---|---|
cmplz_*, including cookies relating to banner status, selected categories, permitted services and Policy version | Store preferences expressed through Complianz | 12 months |
wordpress_test_cookie | Checks whether cookies are supported on the WordPress login page | Session |
wordpress_logged_in_* and wordpress_sec_* | Authentication and security for users authorised to access WordPress | Session or duration of login |
wp-settings-* and wp-settings-time-* | Store interface preferences for authenticated WordPress users | Up to 12 months |
Wordfence technical cookies such as wfwaf-authcookie-*, wf_loginalerted_*, wfls-remembered-* or wfCBLBypass | Security, authorised-user recognition, two-factor authentication or other enabled security features | Session or up to 30 days depending on the function |
Some of these cookies apply exclusively to the Data Controller, administrators or other authorised users and are not normally placed during ordinary public browsing of the website.
Google Analytics 4 cookies
Google Analytics 4 is used to understand how visitors use the website and to improve its content, structure and overall user experience.
Analytics cookies and associated measurement technologies are activated only after the user has provided consent.
| Cookie | Purpose | Approximate duration |
|---|---|---|
_ga | Distinguishes visitors using a pseudonymous identifier | Up to 2 years |
_ga_<ID> | Stores information relating to the session and measurement | Up to 2 years |
WPixo uses Google Analytics for statistical purposes and not for personalised advertising.
Further information is available in Google’s documentation on Google Analytics cookies.
Advertising and profiling cookies
As of the date of the latest update to this Policy, wpixo.com does not use cookies for behavioural advertising, remarketing or commercial profiling.
11. Managing Cookie Preferences
On the user’s first visit to the website, analytics cookies can be accepted or rejected through the cookie banner managed by Complianz.
Non-essential cookies remain disabled by default until the user has expressed their choice.
Cookie preferences may be changed or consent withdrawn at any time through the Manage Consent control available in the website footer.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Users may also delete or block cookies through their browser settings. Blocking strictly necessary cookies may affect some website functions.
12. Google Fonts
The website uses typefaces provided through Google Fonts.
When a page is loaded, the user’s device may connect to Google’s servers to retrieve the font files required to display the website. This connection may result in the transmission of the user’s IP address and technical information relating to the request.
WPixo does not use Google Fonts for advertising purposes.
Further information is available in Google’s Privacy and Data Collection information for Google Fonts and in the Google Privacy Policy.
13. External Links and WhatsApp
The website contains links to external websites, WPixo portfolio websites and WhatsApp.
Simply visiting wpixo.com does not result in WPixo sending the user’s personal data to WhatsApp. A connection with WhatsApp takes place only when the user chooses to open the relevant link or service.
From that point onward, processing carried out by the external platform is governed by that platform’s own privacy policy and terms.
WPixo does not control the cookies, tracking technologies or data-processing practices used by external websites accessed through links on wpixo.com.
14. Data Protection Rights
Where applicable under the GDPR, individuals may exercise the rights provided for under Articles 15–22 GDPR, including the right to:
- obtain confirmation as to whether personal data concerning them is being processed and obtain access to that data;
- request the rectification or updating of inaccurate personal data;
- request the deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive personal data in a structured, commonly used and machine-readable format and request data portability, where applicable;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before consent was withdrawn.
Requests may be submitted to info.wpixo@gmail.com.
The Data Controller will respond within the time limits established by applicable data protection law and may request information reasonably necessary to verify the identity of the person making the request.
Individuals also have the right to lodge a complaint with the Italian Data Protection Authority – Garante per la protezione dei dati personali or, where applicable, with the competent supervisory authority in the country in which they live or work, or where they believe an infringement of applicable data protection law has occurred.
Where mandatory data protection legislation in another jurisdiction grants additional rights, those rights remain unaffected.
15. Automated Decision-Making
WPixo does not make decisions based solely on automated processing that produce legal effects concerning individuals or similarly significantly affect them.
16. Changes to this Privacy & Cookie Policy
This Privacy & Cookie Policy may be updated from time to time to reflect changes to WPixo’s services, forms, service providers, cookies, technical infrastructure or applicable law.
The current version is the version published on this page together with its Last updated date.