Privacy policy.
Last updated: 12 August 2026
Data controller
This policy describes how personal data is processed on this site, under Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 as amended.
The data controller is VADATO DIGITAL, 61 rue de Lyon, 75012 Paris, France. For any question about your data: hello@vadato.io.
Data collected and purposes
We collect only the data you send us voluntarily and what is strictly necessary to run and secure the site. No data is used for advertising profiling.
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Contact formReplying to your message. | First name, last name, email address, message content. | Legitimate interest | Held in our mailbox for as long as needed to handle the request, then archived. |
| Publication downloadsSending you the requested document, then keeping you informed about our services and publications. | First name, last name, email address, telephone number, consent. | Consent | Three years from your last contact. |
| Form protectionPreventing bulk and automated submissions. | IP address, held only as a non-nominative counter. | Legitimate interest | One hour. |
| Audience measurementMeasuring site traffic in aggregate. | Pages viewed, referrer, device type. | Legitimate interest | Aggregate statistics, with no individual identification. |
| Online paymentProcessing payments made from the Italian-language Guida page. | Email address and payment details, collected and processed directly by Stripe. | Performance of a contract | As set by Stripe and by applicable accounting obligations. |
Recipients and processors
Your data is never sold, rented or passed to third parties for commercial purposes. It is accessible to the Vadato team and to the following technical providers, acting as processors on our instructions:
| Provider | Role | Country | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting, delivery and audience measurement | États-Unis | EU-US Data Privacy Framework / clauses contractuelles types |
| Upstash, Inc. | Database (publication requests, security counters) | États-Unis | Clauses contractuelles types |
| Resend, Inc. | Delivery of notification emails | États-Unis | Clauses contractuelles types |
| Stripe Payments Europe, Ltd. | Payment processing | Irlande | Processed within the European Union |
Transfers outside the European Union rely on the safeguards listed above; a copy is available on request.
Your rights
In respect of data concerning you, you have the following rights:
- Access — confirmation that data concerning you is processed, and a copy of it.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — deletion of your data, within the limits set by the regulation.
- Restriction — temporary suspension of a processing operation.
- Objection — to processing based on legitimate interest, and in particular to direct marketing.
- Portability — receipt of your data in a structured, machine-readable format.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand.
You may exercise these rights by email to hello@vadato.io, or by post to the registered office address. We may ask for proof of identity where there is reasonable doubt. We reply within one month.
You may also lodge a complaint with Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — https://www.cnil.fr, or with the supervisory authority where you live.
Cookies and audience measurement
This site sets no advertising cookies and uses no third-party trackers for targeting. Audience measurement runs on Vercel Analytics and Vercel Speed Insights, which work without cookies or persistent identifiers: the data is aggregated and cannot identify you. Two strictly necessary cookies are used: one remembering your language choice and, for administrators only, the management area session. These cookies are exempt from consent.
Security
The site is served over HTTPS only, with strict security headers. Data submitted through forms is validated server-side and rate-limited per IP address. Access to stored requests is protected by authentication.
Changes
This policy may be updated to reflect changes to the site or to applicable regulation. The date of the last update appears at the top of the page.