Privacy Policy
Last updated: 2026-08-26
Data controller
Echo S.r.l. — Via Lelio e Fausto Socini 32/B, 42122 Reggio Emilia (Italy), VAT 03135740359. Privacy contact: info@echowebagency.it.
Data we process
Account data (full name, email, phone, encrypted password); billing data (Italian tax code and, for VAT holders, SDI code or certified email); transaction references (full card data is processed by Stripe only and never reaches our systems); usage data (course progress, certificates, forum posts and comments, profile); for founders, application data and — with a signed release — photo and professional role; technical data (logs, technical cookies and the campaign attribution cookie). We do not process minors' data: registration is restricted to adults. If you turn on app notifications, your browser generates a delivery address and two encryption keys, which we store alongside your profile. If you ask for live reminders, we store the phone number you give us.
Purposes and legal bases
Service delivery, account management and support: performance of the contract (art. 6.1.b GDPR). Invoicing and tax obligations: legal obligation (art. 6.1.c). Service communications (confirmations, renewal notices, contract changes): performance of the contract. WhatsApp group, publication of photo, name and role of founders and consenting members, newsletters (if any): consent (art. 6.1.a), always optional and revocable. Platform security and abuse prevention: legitimate interest (art. 6.1.f). App notifications (new courses and a reminder before live sessions) and WhatsApp reminders for live sessions: consent (art. 6.1.a), optional and withdrawable at any time from your account area.
Visibility to other users
Your name and profile are visible to other members in the internal directory; forum content is visible to other members with the author's name; founders' pages show photo, name and role of those who signed the release. The course certificate page (name, course, date) is publicly reachable via link so you can share it: it can be disabled on request at info@echowebagency.it.
Recipients
Data is processed by providers appointed as processors or acting as independent controllers for their services: Supabase (database and authentication), Vercel (hosting and aggregate visit statistics), Stripe (payments), TeamSystem/Fatture in Cloud (e-invoicing) and, only for those who join the group, WhatsApp/Meta. Some providers are based in the USA: transfers rely on the Data Privacy Framework or Standard Contractual Clauses (arts. 45-46 GDPR). Data is never sold or shared with third parties for commercial purposes. App notifications are delivered through the services of your browser vendor (Google, Apple, Mozilla), which receive the encrypted message and not its content. We use no third-party notification service.
Retention
Account and usage data: for the life of the account, then deleted or anonymised. Billing and tax data: 10 years (art. 2220 Italian Civil Code). Unsuccessful founder applications: 12 months from the outcome. Technical logs: 90 days. Consent records: for the duration of processing and legal defence. Notification subscription and reminder phone number: until consent is withdrawn or the app is uninstalled.
Your rights
You can exercise the rights under arts. 15-22 GDPR at any time (access, rectification, erasure, restriction, objection, portability) and withdraw any consent by writing to info@echowebagency.it. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Security and automated decisions
We adopt appropriate technical and organisational measures (encrypted passwords, HTTPS, access control). We do not carry out profiling or fully automated decisions with legal effects. In case of a data breach posing a risk to individuals we will notify as required by arts. 33-34 GDPR.