Privacy Policy
How we handle your data when you visit the website or contact Panda. Updated: 27 October 2026.
Data controller
The controller is Panda Digital Agency, P.IVA 02106540384, Ferrara. For information and to exercise your rights, contact info@pandadigitalagency.it.
When you contact us
The form collects your name, email and message. Company, phone and service of interest are optional. We use these details to handle your enquiry and reply. The legal basis is taking precontractual steps at your request (GDPR Article 6(1)(b)). Required fields are necessary to handle the enquiry; the others may be left empty.
Messages are transmitted through Obelica Forms and the email provider Bird to Panda's inbox. Confirmation means the email service accepted the submission; it does not mean Panda has already read it. The form works when marketing cookies are refused and does not subscribe you to a newsletter. Please avoid unnecessary sensitive information or data about other people.
When you contact us on WhatsApp, by email or by phone
If you contact us on WhatsApp, we receive your phone number, profile name and the messages and files you send. If you email or call us, we receive the details you share. We use them to reply and handle your enquiry, on the same legal basis as the form: precontractual steps at your request (GDPR Article 6(1)(b)). WhatsApp conversations go through Meta's WhatsApp service, provided in the EU by WhatsApp Ireland Limited, and are read by the Panda team. WhatsApp also processes data on its own account under its privacy policy. The website only opens the chat: you see and send any prefilled text yourself.
Website operation and security
The server receives technical details such as your IP address, browser information and HTTP requests to operate and protect the website and prevent abuse. The legal basis is the legitimate interest in a secure, available service (GDPR Article 6(1)(f)). The technical panda_consent cookie stores your choices for 180 days. Fonts are served by this website, without browser requests to Google Fonts.
Marketing: Meta campaign measurement
With your marketing consent only, Meta Pixel and Conversions API measure visits, service pages viewed, contact clicks, the start of form completion and confirmed form submissions. The legal basis is consent (GDPR Article 6(1)(a)). Events can include page, language, service, button location, time, event ID, IP address, browser information and _fbp or _fbc advertising identifiers. A shared event ID prevents duplicate counting.
Names, email addresses, phone numbers, company names and message contents entered on this website are not sent to Meta. Refusing consent does not prevent browsing or sending an enquiry. Change your choice through Cookie preferences in the footer. Withdrawal stops future events and does not undo processing previously based on consent.
For the collection and transmission of this data through the Pixel and Conversions API, Panda and Meta Platforms Ireland Limited are joint controllers under Meta's Controller Addendum. Panda is responsible for this notice and for your consent; once Meta receives the data, Meta is the controller of its further processing, described in its own privacy policy. You may exercise your rights with Panda or with Meta.
Statistics with Google Analytics and Tag Manager
With your statistics consent only, which is separate from marketing consent, Google Analytics 4 tells us how many people visit the website, which pages they read, where they come from and how they interact (scrolling, clicks to other websites, contacts). We do not use this data for advertising. The legal basis is consent (GDPR Article 6(1)(a)).
Collected data includes pages viewed, referral source, device and browser, approximate location derived from the IP address and the _ga and _ga_* identifiers. No Google script is loaded before consent; withdrawal stops future data and removes Google Analytics cookies on this website's domain.
Google Tag Manager is the tool we use to manage any Google advertising tools, such as Google Ads campaign measurement, and loads only with marketing consent. The provider is Google Ireland Limited.
Providers and external services
Panda and the providers needed to run the service may access data within their respective tasks: Obelica for the website and form, as processor on Panda's behalf, servers in Italy (Aruba) for infrastructure, Bird for email transmission, WhatsApp for conversations, Meta for consented advertising events and Google for consented statistics and advertising tools. Data may be disclosed to authorities when required by law.
International providers may process data outside the European Economic Area. Bird's agreement provides for standard contractual clauses where required. Meta Platforms Inc. and Google LLC, which may receive data in the United States, participate in the EU-US Data Privacy Framework, recognised as adequate by the European Commission; Meta, WhatsApp and Google describe their transfers and safeguards in their privacy policies. Consult the linked documents or ask the controller for information and a copy of the safeguards applicable to your enquiry. Opening WhatsApp, email, Maps, social profiles or another website takes you to an external service with its own terms and privacy policy. The website cannot confirm a message sent in WhatsApp or an email app.
Retention
Enquiries received through the form, by email or on WhatsApp that do not lead to an engagement are kept for 24 months from the last contact and then deleted. If an enquiry becomes an engagement, the data follows the contract and is kept for its duration and for 10 years after it ends, as required by civil and tax law. Technical browsing data is limited to operational and security needs. Cookie preferences last 180 days; _fbp and _fbc last up to 90 days and may be renewed during consented use. Google Analytics cookies _ga and _ga_* last up to 2 years. Providers apply their own retention rules to data already received.
Your rights
You may request access, correction, erasure, restriction and, where applicable, portability; you may object to processing based on legitimate interest and withdraw consent. Contact info@pandadigitalagency.it. You may complain to the Italian Data Protection Authority at www.garanteprivacy.it. The website does not make automated decisions producing legal or similarly significant effects. This policy may change when the services or processing change; its update date appears above.