Pursuant to EU Regulation 2016/679 (GDPR). Last updated: July 2026.
1. Data Controller
ECM di Tacchi Alessandro, Via Yuri Gagarin 169, 61122 Pesaro (PU), Italy. VAT IT02646670410.
Email: info@ecmweb.it. Phone: +39 0721 581919 (Mon-Fri 8:00-17:00).
2. Data collected
Contact and billing data provided at purchase (name or company, email, VAT number if any, address, SDI/PEC code).
Read-only access you authorize us to connect for the analysis (Google Analytics 4, Search Console, Google Ads, Meta Ads, Microsoft Clarity, PrestaShop WebService key).
Payment data: handled exclusively by Stripe and PayPal (certified providers); we never store card data.
3. Purposes and legal basis
Provision of the analysis service and delivery of the report (art. 6.1.b GDPR); tax and legal obligations (art. 6.1.c); transactional communications about your order. Marketing only with explicit, revocable consent (art. 6.1.a).
4. E-commerce data (processor role)
When connecting PrestaShop and the analytics services, ECM acts as
data processor (art. 28 GDPR) on your behalf. Your business data is used only to produce the analysis, never transferred to third parties or used for other purposes. Data Processing Agreement available on request.
5. Third-party integrations and access revocation
Google (OAuth 2.0, read-only scopes: analytics.readonly, webmasters.readonly, adwords): revocable anytime at myaccount.google.com/permissions.
PrestaShop (WebService key, read-only), Meta Ads (OAuth), Microsoft Clarity (project token), Google PageSpeed (public API).
Compliant with the
Google API Services User Data Policy, including Limited Use: data obtained via Google APIs is used only to provide and improve user-facing features.
6. Sub-processors
Stripe Inc. and PayPal (payments); Anthropic PBC (AI processing via API, USA, Standard Contractual Clauses); EU hosting provider. The analysis runs on the NothingSell platform, owned by ECM.
7. Security
Encryption in transit (TLS/HTTPS) and at rest (AES-256 for tokens and credentials). Least-privilege access, EU-hosted servers, database isolation, read-only processing with no third-party transfers.
8. Retention
Access and credentials: deleted at the end of the analysis or on your request. Contact data: for the duration of the relationship plus 12 months. Tax data: for the period required by law. Early deletion by writing to info@ecmweb.it.
9. Your rights
Access, rectification, erasure, portability, restriction and objection, by writing to info@ecmweb.it (reply within 30 days). You may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
10. Cookies
The site uses only necessary technical cookies and, with your consent, analytical cookies. No advertising/profiling cookies. Details in the Cookie Policy.
11. Changes
We may update this policy; substantial changes are notified by email 30 days in advance.