Your Data. Protected, transparent & secure.

1. Data Controller

A formal Data Protection Officer (DPO) is not legally required as the thresholds under Art. 37(1) GDPR are not met.

2. Principles and Legal Bases

We process personal data strictly in compliance with Regulation (EU) 2016/679 (GDPR), the Italian Legislative Decree 196/2003 as amended, and applicable ePrivacy provisions.

Our data processing relies on the following legal bases:

• Art. 6(1)(a) GDPR (Consent): You have granted us explicit consent for a specific purpose (such as streaming external media previews).
• Art. 6(1)(b) GDPR (Contract / Pre-contractual): Processing is necessary to perform a contract or take steps at your request prior to entering into a contract (such as responding to your contact inquiry).
• Art. 6(1)(c) GDPR (Legal Obligation): Processing is necessary for compliance with a legal or statutory obligation (e.g., tax record retention).
• Art. 6(1)(f) GDPR (Legitimate Interests): Processing is necessary for the purposes of our legitimate interests, except where overridden by your fundamental rights (e.g., maintaining IT security, DDoS defense, and reliable site delivery).

3. Website Delivery and Server Log Files (Hosting)

When you visit our website, your browser automatically transmits technical information to our hosting infrastructure. This information is temporarily stored in server logs.

The following data is processed automatically:

• IP address of the requesting device (anonymized/truncated)
• Date and time of the request
• Name and URL of the requested resource
• Volume of data transferred and HTTP status code
• Referrer URL (the website from which you reached us)
• Browser type, operating system, and Internet Service Provider

Hosting Provider: This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare operates a global Content Delivery Network (CDN) to ensure fast, secure, and resilient delivery. Data transfers to the US are protected by standard contractual clauses (SCC) and Cloudflare’s certification under the EU-U.S. Data Privacy Framework.

Legal Basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical delivery, security, and stability of our website.

4. Contact Enquiries (Web3Forms)

When you submit an enquiry via our contact form, we process the information you provide (first and last name, business email address, company name, topic of interest, budget range, project description, and technical campaign parameters such as utm_source, utm_campaign, and referrer).

Processor Web3Forms: For encrypted form delivery, we utilize the API service Web3Forms (Surge Digital Inc., USA). When you submit the form, your entries are transmitted via HTTPS directly to api.web3forms.com and forwarded as an email notification to our inbox. Web3Forms operates as a data processor under Art. 28 GDPR on the basis of standard contractual clauses.

Legal Basis: Art. 6(1)(b) GDPR (pre-contractual communication) and Art. 6(1)(f) GDPR (legitimate interest in prompt and reliable client communication).

Retention Period: We retain your enquiry only as long as necessary to process your request, maintain documentation of business correspondence, or comply with statutory retention periods (e.g., 10 years pursuant to Art. 2220 Italian Civil Code).

5. External Media (Supabase Storage Video Previews)

Our homepage and design showcase feature moving video previews of our work. These MP4 video assets are delivered via the Supabase cloud infrastructure (Supabase Inc., Singapore / USA, hosted on AWS).

Consent & Technical Enforcement: By default, on your initial visit, no external video streams are loaded from Supabase. Instead, locally hosted WebP images are displayed from our own server. Only when you consent to the “External Media” category in our Consent Management modal are the video streams loaded from Supabase.

When videos are retrieved, your IP address is transmitted to Supabase servers to facilitate media streaming.

Legal Basis: Art. 6(1)(a) GDPR (consent via the Consent Manager).

6. Web Typography (Google Fonts)

This website incorporates typefaces provided by Google Fonts (Google Ireland Limited, Dublin, Ireland / Google LLC, Mountain View, CA, USA). When fonts are fetched, your browser connects to Google servers, transmitting your IP address.

Google is certified under the EU-U.S. Data Privacy Framework. External font loading is linked to our consent preferences.

Legal Basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR where fonts are locally cached.

7. Cookies and Local Browser Storage (Consent Management)

We do not use advertising, profiling, or cross-site tracking cookies. To record and enforce your consent decisions in a legally compliant manner, we employ a single first-party storage element:

For more details, please see our dedicated Cookie Policy.

Update Privacy Preferences ⚙

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights at any time:

• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation and information regarding your personal data processed by us.
• Right to Rectification (Art. 16 GDPR): You have the right to request the prompt correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17 GDPR): You may request the deletion of your personal data, provided no statutory retention duties prevent erasure.
• Right to Restriction (Art. 18 GDPR): You have the right to demand the restriction of the processing of your data under statutory conditions.
• Right to Data Portability (Art. 20 GDPR): You may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your data based on legitimate interests (Art. 6(1)(f) GDPR).
• Right to Withdraw Consent (Art. 7(3) GDPR): You may revoke any previously granted consent at any time with effect for the future.

To exercise any of your rights, simply send an email to: info@vdf-solutions.com.

9. Right to Lodge a Complaint with a Supervisory Authority

If you believe that our processing of your personal data infringes data protection legislation, you have the right to lodge a formal complaint with a competent supervisory authority (Art. 77 GDPR).

The primary supervisory authority responsible for VDF Solutions (based in Meran, South Tyrol, Italy) is:

You may also contact the supervisory authority in your country of habitual residence or workplace within the European Union.

10. Updates to this Privacy Policy

This privacy notice is currently effective as of September 2026. As our services evolve or legal requirements change, we will update this document accordingly.