Privacy Policy

Privacy Policy — insightadv.it / insightadv.uk / insightadv.ltd.uk / insightadv.eu / booking.insightadv.it

Compliant with EU Regulation 2016/679 (GDPR) and the UK GDPR (Data Protection Act 2018)

Last updated: September 2026

The protection of personal data is a matter of trust, and your trust matters to us. So that you can feel at ease using our web pages, we adhere strictly to the requirements of the General Data Protection Regulation (EU GDPR 2016/679) when processing your personal data and, for users resident in the United Kingdom, to the UK GDPR as incorporated into the Data Protection Act 2018.

In this notice you will find all the information on what data we collect, why we collect it and how we use it. For any questions, you can contact us at: This email address is being protected from spambots. You need JavaScript enabled to view it..

1. Data Controller

Insight Adv Ltd acts as Data Controller under the EU GDPR 2016/679 in respect of users resident in the European Union, and under the UK GDPR / Data Protection Act 2018 in respect of users resident in the United Kingdom. No Data Protection Officer (DPO) has been appointed, as the mandatory conditions under Article 37 GDPR do not apply; for any privacy-related matter, the Controller may be contacted directly.

Under Article 3(2) GDPR, the Controller is subject to the Regulation even in the absence of an establishment within the European Union, in relation to processing activities that involve offering services to data subjects in the Union or monitoring their behaviour — including the tracking of opens and clicks in email communications.

2. Personal Data Processed

Personal data means information relating to an identified or identifiable natural person. Insight Adv Ltd collects only the data that users provide voluntarily and the browsing data automatically generated while using the Site.

No personal data need be provided to browse the public part of the Site. Data is collected in the following cases: site registration, completion of an order, submission of contact forms, requests for a quote, applications to collaborate, appointment bookings and newsletter sign-up.

2.1 Legal Basis for Processing

The Controller processes Users' personal data on the basis of one of the following legal grounds (Article 6 EU GDPR; Article 6 UK GDPR):

• User consent (Article 6(1)(a) EU GDPR; Article 6 UK GDPR; Article 122 of the Italian Data Protection Code — Legislative Decree 196/2003 — for EU users; Regulation 6 PECR 2003 for UK users): for marketing purposes, newsletters, non-essential cookies, and tracking technologies embedded in email communications (tracking pixels and tracked links — see Sect. 3.3 and Sect. 4.14).
• Performance of a contract (Article 6(1)(b)): for order fulfilment and the provision of requested services.
• Legal obligation (Article 6(1)(c)): for tax, accounting and regulatory compliance.
• Legitimate interest (Article 6(1)(f)): for site security, fraud prevention and the management of disputes.

Users may at any time ask the Controller to specify the legal basis for a particular processing activity.

2.2 Categories of Data Collected

Personal data collected, whether directly or via third parties, includes: cookies, usage and browsing data, personal details, billing and shipping data, contact form content, quote requests, collaboration applications and payment data.

2.3 User Profile

A password-protected User Profile is created for every user who registers via the 'Create an account' function. The data required for registration are: email address, first name, surname, date of birth, password and consent to the processing of personal data.

2.4 Billing and Shipping Data

Only upon completion of an order is the data required for fulfilment requested: first name, surname, company name, address (street, house number, city, province/county, postcode, country), email, landline number, mobile number, tax code, VAT number, any alternative delivery addresses, and consent to the Terms and Conditions of Sale.

2.5 Contact Form

The contact form collects: first name, surname, company, email, landline number, mobile number, message and consent to processing. This data is not stored in the Site's database but is transmitted by email to the Controller in order to respond to the enquiry.

2.6 Quote Requests

The quote request form collects the personal and business details necessary to prepare a commercial offer. This data is not stored in the Site's database but is transmitted by email to the Controller.

2.7 Collaboration Enquiries

The 'Work With Us' form collects personal, professional and skills-related information for the purposes of collaborative assessment. This data is not stored in the Site's database but is transmitted by email to the Controller. Any printed data is kept in a locked filing cabinet at the Controller's premises.

2.8 Appointment Booking (TidyCal)

Appointment bookings are handled via the TidyCal platform, accessible at booking.insightadv.it. The data provided during booking (name, email, any message) is processed by TidyCal both as processor on behalf of Insight Adv Ltd and as an independent controller for its own operational purposes. Please refer to TidyCal's Privacy Policy: https://tidycal.com/privacy.

2.9 Payment Processing

Payments are handled via PayPal (PayPal Europe S.à r.l. et Cie, S.C.A.), Stripe or Mollie, or by bank transfer. Payment card and account details are collected directly by the relevant payment provider and are not processed or stored by the Site. Please refer to Sections 4.10, 4.11 and 4.12 below for details of each provider.

2.10 Browsing Data

Our computer systems automatically collect certain browsing data: IP addresses, browser type, operating system, URIs of the resources requested, request times and server response codes. This data is used solely for anonymous statistical purposes and for site security.

2.11 Minors

Insight Adv Ltd does not sell products or provide services to anyone under the age of 18. If you are under 18, you may only use the Services with the involvement of a parent or legal guardian.

3. Purposes of Processing

3.1 Contractual Purposes

Processing is necessary for the provision of requested services, order fulfilment, invoicing and legally mandated tax compliance. Without the necessary data, we will not be able to provide the requested services.

3.2 Marketing Purposes

With the user's consent, data may be used to: improve the browsing and purchasing experience, communicate about products and offers, and send personalised recommendations for services of interest. Users may object at any time to the use of their data for direct marketing purposes, at no additional cost, by sending a written request to This email address is being protected from spambots. You need JavaScript enabled to view it..

3.3 Newsletter

The newsletter is sent exclusively to users who have given explicit consent at the time of sign-up. Email communications may contain tracking pixels and tracked links — technologies that detect when a message has been opened and which links within it have been clicked, collecting data such as IP address, date and time, device type and email client used. This data is processed for statistical purposes and to improve content and communications; the Controller does not use it to take decisions based solely on automated processing that produce legal effects concerning the user.

Users may at any time:

• withdraw consent in full, stopping all communications, via the unsubscribe link included in every email;
• request that open-tracking alone be switched off, while continuing to receive the newsletter, by writing to This email address is being protected from spambots. You need JavaScript enabled to view it.. The request will be actioned within the timeframes required by applicable law.

The newsletter is delivered via SendFox, provided by AppSumo, LLC. For details of the processing carried out by this provider, see Sect. 4.14.

4. Third-Party Services

4.1 Google Analytics 4 and Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: Statistical analysis of website traffic (GA4, Measurement ID: G-PWE7K9L4DG). Centralised management of tracking tags (GTM, Container ID: GTM-TPLLNVP) with Consent Mode v2.

Legal basis: Consent (analytics_storage) for GA4; legitimate interest for GTM.

Data collected: Cookies, usage and browsing data.

Data transfer: EU–US under the EU-US Data Privacy Framework; UK–US under the UK Extension to the EU-US DPF.

Privacy Policy: https://policies.google.com/privacy

GA4 opt-out: https://tools.google.com/dlpage/gaoptout

4.2 Meta Pixel (Facebook/Instagram)

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Purpose: Conversion tracking and retargeting for Meta Ads campaigns. Pixel ID: 1144704630544790.

Legal basis: Consent (ad_storage).

Data collected: Cookies (_fbp, _fbc) and usage data.

Data transfer: EU–US under the EU-US Data Privacy Framework; UK–US under the UK Extension.

Privacy Policy: https://www.facebook.com/privacy/policy/

Opt-out: https://www.facebook.com/ads/preferences

4.3 LinkedIn Insight Tag

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Purpose: Conversion tracking, retargeting and visitor demographic data for LinkedIn Ads campaigns. Partner ID: 9165433.

Legal basis: Consent (ad_storage).

Data collected: Cookies (li_fat_id, UserMatchHistory, AnalyticsSyncHistory) and usage data.

Data transfer: EU–US under the EU-US Data Privacy Framework; UK–US under the UK Extension.

Privacy Policy: https://www.linkedin.com/legal/privacy-policy

Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

4.4 Cloudflare

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. European office: 6th Floor, Riverside Building, County Hall, London SE1 7PB.

Purpose: Web security, DDoS and bot protection, CDN and performance optimisation.

Legal basis: Legitimate interest (security and service continuity).

Data collected: IP address, browser, timestamp, traffic data. Essential cookies: __cf_bm, _cfuvid, cf_clearance.

Data transfer: EU–US and UK–US under the respective Data Privacy Frameworks.

Privacy Policy: https://www.cloudflare.com/privacypolicy/

4.5 Google reCAPTCHA

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: Protection of forms against spam and automated abuse.

Legal basis: Legitimate interest (security and abuse prevention).

Privacy Policy: https://policies.google.com/privacy

4.6 YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: Display of video content embedded in the Site via the AllVideoShare component.

Method: YouTube videos are loaded only after the user's explicit consent via an interactive consent placeholder. YouTube cookies are installed only if the user chooses to start playback, thereby expressing specific consent for that content.

Legal basis: Consent.

Privacy Policy: https://policies.google.com/privacy

4.7 TidyCal — Booking Page (booking.insightadv.it)

4.8 Social Media Interaction

The Site incorporates social sharing buttons and widgets (Facebook, LinkedIn, Twitter/X, Pinterest, YouTube). Where a social network interaction service is installed, it is possible that, even if users do not actively use the service, it may still collect traffic data relating to the pages on which it is installed. Interactions are subject to each user's privacy settings on the relevant social network.

Facebook/Meta: Meta Platforms Ireland Limited — https://www.facebook.com/privacy/policy/

LinkedIn: LinkedIn Ireland Unlimited Company — https://www.linkedin.com/legal/privacy-policy

Twitter/X: X Corp., 1355 Market St, San Francisco, CA 94103, USA — https://twitter.com/privacy

Pinterest: Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland — https://policy.pinterest.com/privacy-policy

4.9 Google Maps

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: Display of maps embedded within the Site's pages.

Legal basis: Consent.

Privacy Policy: https://policies.google.com/privacy

4.10 PayPal

Provider: PayPal Europe S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

Purpose: Online payment processing.

Legal basis: Performance of a contract.

Privacy Policy: https://www.paypal.com/privacy

4.11 Stripe

Provider: Stripe Payments UK, Ltd, 7th Floor, The Bower Warehouse, 211 Old Street, London EC1V 9NR, United Kingdom.

Purpose: Online payment processing (card and other supported payment methods).

Legal basis: Performance of a contract.

Data collected: Payment card and transaction data, collected directly by Stripe; the Site does not receive or store full card details.

Privacy Policy: https://stripe.com/gb/privacy

4.12 Mollie

Provider: Mollie UK Ltd, 8 Bishopsgate, London EC2N 4BQ, United Kingdom.

Purpose: Online payment processing (card and other supported payment methods).

Legal basis: Performance of a contract.

Data collected: Payment and transaction data, collected directly by Mollie; the Site does not receive or store full card details.

Privacy Policy: https://www.mollie.com/gb/privacy

4.13 Aruba Business Srl — Hosting

Provider: Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy.

Purpose: Hosting, data storage and backups on secure servers located in Italy.

Legal basis: Performance of a contract and legitimate interest.

Privacy Policy: https://business.aruba.it/informativa_arubabusiness.pdf

4.14 SendFox — Newsletter Delivery Service

Provider: AppSumo, LLC, Austin, Texas, USA.

Purpose: Management of newsletter sign-up, delivery of communications, and detection of opens and clicks via tracking pixels and tracked links (see Sect. 3.3).

Legal basis: Consent (Article 6(1)(a) GDPR; Article 122 of the Italian Data Protection Code; Regulation 6 PECR 2003 for UK users).

Data collected: First name, surname, email address, and, via pixels and tracked links, open and click data (IP address, date and time, device type, email client).

Data transfer: EU/UK–US. SendFox does not currently participate in the Data Privacy Framework; transfers are made on the basis of the Standard Contractual Clauses set out in the relevant Data Processing Agreement.

Privacy Policy: https://sendfox.com/privacy — DPA: https://sendfox.com/dpa

5. Google Consent Mode v2 and Consent Management

This Site uses Google Consent Mode v2, implemented via Google Tag Manager, in combination with StoreJextension's GDPR component. The system controls the following consent categories:

• analytics_storage: controls activation of Google Analytics GA4.
• ad_storage: controls activation of Meta Pixel and LinkedIn Insight Tag.
• ad_user_data: controls the sending of user data for advertising purposes.
• ad_personalization: controls ad personalisation.

In the absence of consent, marketing and analytics tags are not loaded. Consent Mode may operate in aggregated modelling mode for Google without collecting individual-level data.

6. Retention of Personal Data

6.1 Location of Storage

Data is processed at the Controller's operating premises and on Aruba Business Srl servers located in Italy. Data may be transferred to third countries (e.g. the USA) only where adequate safeguards exist under the EU GDPR (Articles 44-49) and the UK GDPR, such as the EU-US Data Privacy Framework and its UK Extension, where applicable, or the Standard Contractual Clauses.

6.2 Retention Period

• Contractual data: retained for the duration of the contract and for a further 10 years for tax purposes (Presidential Decree 600/1973 and the equivalent UK legislation).
• Marketing and newsletter data: retained until consent is withdrawn.
• Open and click data collected via tracking pixels: retained in individual form for a maximum of 12 months; after that period, or immediately where used only in aggregated form, the data is anonymised.
• Browsing data and logs: a maximum of 12 months, save where required for security or legal disputes.
• Cookies: as set out in the Cookie Policy.
• Collaboration applications: a maximum of 24 months from receipt, unless otherwise agreed.

At the end of the retention period, personal data will be securely deleted or anonymised.

7. Security of Personal Data

Insight Adv Ltd adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, in accordance with Article 32 of the EU GDPR and Article 32 of the UK GDPR. The measures adopted include:

• Site protection via Cloudflare (WAF, DDoS protection, SSL/TLS).
• Sectigo PositiveSSL Multi-Domain certificate for all HTTPS connections.
• RSFirewall application firewall installed on the Joomla CMS.
• Aruba Business server with perimeter firewall, restricted access, and daily, weekly and monthly backups.
• Superuser access via 4096-bit asymmetric DH encryption.
• User passwords encrypted with 512-bit SHA-2.
• Antivirus and anti-malware protection kept continuously up to date on all workstations.

In the event of a personal data breach presenting a risk to the rights and freedoms of data subjects, the Controller will notify the competent supervisory authority within 72 hours of becoming aware of it, in accordance with Article 33 of the EU GDPR / Article 33 of the UK GDPR.

8. Disclosure of Data to Third Parties

Personal data is disclosed to third parties only where required by law or necessary for the provision of requested services. Categories of recipients include:

• Technical and operational service providers (ISPs, printers, couriers, logistics) — for order fulfilment.
• Credit institutions and digital payment providers — for the management of payments, collections and refunds.
• External professionals and consultants — for legal, tax and accounting compliance.
• Tax authorities, public bodies and judicial authorities — for legal obligations.
• Persons formally authorised by the data subject (legal representatives, guardians).

The Controller does not transfer personal data to countries outside the EU and the UK without adequate safeguards, save as indicated in the third-party services section (Sect. 4), where transfers take place under the EU-US Data Privacy Framework, the UK Extension, or the Standard Contractual Clauses, depending on the provider.

9. Data Subject Rights

In accordance with Articles 15–22 of the EU GDPR and Articles 15–22 of the UK GDPR, users have the right to:

• Access (Art. 15): obtain confirmation of processing and a copy of their personal data.
• Rectification (Art. 16): request correction of inaccurate data or completion of incomplete data.
• Erasure / Right to be forgotten (Art. 17): request deletion of their data, where the applicable conditions are met.
• Restriction of processing (Art. 18): request suspension of processing in certain circumstances.
• Data portability (Art. 20): receive their data in a structured, machine-readable format and transfer it to another controller.
• Object (Art. 21): object to processing based on legitimate interest or for direct marketing purposes, with no need to provide grounds in the latter case.
• Withdraw consent (Art. 7(3)): withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Complain to a supervisory authority: lodge a complaint with the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it) for EU users, or with the Information Commissioner's Office (www.ico.org.uk) for UK users.

Requests should be addressed to: This email address is being protected from spambots. You need JavaScript enabled to view it. or to Insight Adv Ltd, 128 City Road, London, EC1V 2NX, UK. The Controller will respond as soon as possible and in any event within 30 days of receipt, free of charge to the data subject (Art. 12 GDPR).

10. Details of the Right to Object

Where personal data is processed for direct marketing purposes, users have the right to object at any time, without needing to provide any grounds. Following an objection, the data will no longer be processed for such purposes.

Where processing is based on legitimate interest, users may object on grounds relating to their particular situation. The Controller will assess the request and, unless overriding legitimate grounds apply, will suspend the processing.

11. Cookie Policy

This Website uses cookies and tracking technologies. For detailed information on the types, purposes, duration and management of cookies, and to exercise consent preferences, users may consult the full Cookie Policy available on the Site.

12. Further Information on Processing

12.1 Legal Defence

The user's personal data may be used by the Controller in legal proceedings or in preparation for such proceedings in defence against abuse. The user acknowledges that the Controller may be required to disclose data by order of the competent public authorities.

12.2 System Logs and Maintenance

For operational and maintenance purposes, this Website and the third-party services it uses may collect system logs containing usage data and IP addresses. Such logs are retained for a maximum of 12 months.

12.3 Push Notifications

The Site may send push notifications to users who have explicitly consented to receive them via their browser. Consent may be withdrawn at any time via browser settings.

12.4 Do Not Track

This Website does not respond to 'Do Not Track' (DNT) signals. For information on DNT support by third-party services integrated into the Site, users should consult the relevant privacy policies.

12.5 Changes to this Privacy Policy

The Controller reserves the right to amend this notice at any time, notifying users on this page and, where possible, via available contact details. The date of the last update is shown at the top of this document. Where changes concern consent-based processing, the Controller will collect fresh consent from users where necessary.

13. Contact

For information, requests or complaints regarding privacy:

• Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
• Post: Insight Adv Ltd, 124 City Road, London, United Kingdom EC1V 2NX
• Telephone: +44 20 457 701 28