Last updated: 14 October 2026

This notice explains how VLS Agency processes the personal data of visitors to vlsagency.com and of people who send us a request, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Data controller

VLS AGENCY SRL, Via delle Industrie 25/4, 30175 Venezia (VE), Italy. VAT IT04623120278, REA VE-434267. Email: info@vlsagency.com.

What data we process

  • Request data: name, email, phone, contact preference, free notes, and service details (dates, times, pick-up and drop-off places, hotel, flight or train, number of guests and suitcases).
  • Request source data: the page you write from, landing page, referring site, campaign parameters (utm) and the Google Ads click identifier (gclid), if you arrive from an ad.
  • Technical data: your IP address is used for security and to prevent form abuse, and is stored only as a keyed hash, never in clear. Our servers log the technical browsing data needed to run the site.
  • Scans of our QR codes (business cards, printed material): we count scans without cookies. Of your IP address we keep only an encrypted fingerprint valid for one day, used to estimate unique visitors, which cannot recognise you on later days; scans are deleted after 24 months.
  • Proof of consent: date and time you accepted this notice and its version, and your cookie choice when you sent the request (accepted, declined or no choice). We need it to show the basis on which we process your data, including towards Google Ads (Article 7 GDPR).

Why we process it and on what legal basis

  • Replying to your request and preparing a quote, then organising the service if you confirm: pre-contractual steps and contract (Art. 6.1.b GDPR).
  • Site security and spam prevention: legitimate interest (Art. 6.1.f).
  • Measuring which ads bring requests, using the request source data: legitimate interest (Art. 6.1.f). You can object at any time by writing to us.
  • Google Analytics and Google Ads cookies in your browser, and sending the email and phone number of your request to Google Ads in encrypted form (hash) to attribute it to the ad you came from: only with your consent to cookies (see the cookie policy). Without consent your request is sent and handled as usual.
  • Legal obligations, such as tax and accounting for services purchased: legal obligation (Art. 6.1.c).

Your name, email and phone are needed to reply; without them we cannot handle the request.

How we protect your data

Name, email, phone and notes are stored encrypted in our database with modern algorithms; the keys are not kept in the database. Access to our back office is restricted to authorised staff, password-protected, and every view or export of a request is logged.

How long we keep it

  • Requests that do not become a service: 24 months, after which personal data is deleted (anonymised).
  • Requests flagged as spam: 30 days.
  • Confirmed services: for the period required by tax and accounting law.

Who we share it with

  • Our hosting provider, which stores data on our behalf as a processor.
  • Google (Google Workspace) for the email we use to receive and answer requests and, only with your consent, Google Analytics for site statistics and Google Ads for ad measurement.
  • Partners who deliver the service (for example yacht, flight, hotel or guide operators), only with the data needed and only when you confirm a service that involves them.
  • Authorities, when required by law.

We do not sell your data and we do not send you newsletters without your specific consent.

Transfers outside the European Union

Some Google services may involve transfers to the United States. These rely on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

Your rights

You can ask at any time to access, correct or delete your data, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest (Articles 15-22 GDPR). Where you gave consent, you can withdraw it at any time, without affecting processing already carried out. Write to info@vlsagency.com: we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or the authority of your country.

Changes

If we change this notice we update the date at the top. Requests already sent stay linked to the version you accepted.