Skip to main content

Privacy Notice

Last updated: 26 September 2026

This notice explains how Bagai S.r.l. processes the personal data of people who visit bagaitheagency.com or get in touch using the contact details published on the website. It is provided under Articles 12 and 13 of Regulation (EU) 2016/679, the General Data Protection Regulation, and the applicable Italian data protection legislation.

YouTube video: note dated 5 September 2026. The Zagato Giulia SWB project page includes an optional YouTube video. The embedded player loads after you give consent in the video panel or enable the Marketing category in cookie preferences. After you refuse or withdraw consent, reloading the page blocks the player again. The “Watch the film on YouTube” link opens YouTube’s website. For details of how Google processes personal data, see Google’s Privacy Policy.

1. Data controller

The data controller is:

Bagai S.r.l.
Registered office: Via Thomas Alva Edison 12, 20852 Villasanta (MB), Italy
Italian tax code and VAT number: 14590510963
Email: info@bagaitheagency.com
Italian certified email (PEC): bagaisrl@legalmail.it

For questions about the use of personal data or to exercise the rights described in this notice, please write to info@bagaitheagency.com.

2. Scope of this notice

This corporate website presents Bagai’s services, projects and activities. Visitors can enquire about projects and services using the contact form or the email link, which opens their own email application. The website does not currently offer a newsletter, e-commerce features or online payments.

This notice covers processing performed through the website and communications sent to the contact details published on it. Any third-party websites and services reached through external links operate under their own privacy notices, which users should review.

3. Categories of data processed

3.1 Browsing and technical data

During normal browsing, the systems used to provide the website may receive technical data such as:

  • IP address;
  • date and time of the request;
  • requested page or resource;
  • request outcome and timing;
  • browser type and version, operating system and device type;
  • browser language;
  • referring URL, when transmitted by the browser;
  • technical data relating to errors, security and website operation.

These data are normally required to deliver the pages requested, keep the website secure and operational, diagnose faults and prevent abuse. Bagai does not use technical logs to directly identify visitors unless this is necessary to investigate security incidents or abuse, or to establish liability.

3.2 Data provided through the contact form or by email

When someone uses the contact form or writes to Bagai, Bagai may process their name, email address, company or brand, the content of the enquiry, any attachments sent by email and any subsequent information needed to handle it, as well as the project timeframe and indicative budget where provided. Enquiries submitted through the Jetpack form are stored in the website database and forwarded to Bagai by email.

For delivery, security and abuse prevention purposes, the IP address, user agent, and the date and time of submission may also be processed. Because Akismet is active, data needed for spam checking, including the IP address, user agent, email address, website URL and enquiry content, are sent to Automattic’s Akismet service.

Providing these data is optional. Without a contact address and the information needed to understand the enquiry, however, Bagai may be unable to respond. The required checkbox only confirms that the person has read this notice; it does not constitute consent to marketing communications, which are not enabled through the form. Users should not send special categories of data, such as health information, political opinions or religious beliefs, unless this is strictly necessary and an appropriate legal basis applies.

Nostalgear automotive production form The form collects your full name, work email address and company, as well as your phone number if you choose to provide it. On submission, the WordPress website sends the data to Google Apps Script, which records the enquiry in a Google Sheets spreadsheet used by Bagai as a customer relationship management (CRM) tool. An email notification containing contact details and a summary of the enquiry is sent to Bagai.

The record also includes the form page URL, the referring page when supplied by the browser, the form session start time and the time the enquiry was received, the form version, a technical submission identifier, and confirmation that the privacy notice was read together with the time this was recorded. When present in the page URL, the source parameters utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id and click identifiers gclid, fbclid, msclkid are captured to associate the enquiry with its source.

To limit repeated submissions, the WordPress plugin uses the connection’s IP address and stores only a value derived from it in its counter. The data sent to Apps Script and the CRM fields do not include the visitor’s IP address or user agent. The infrastructure’s technical processing described in section 3.1 still applies. Provider information: Google Privacy Policy.

3.3 Language preference

The website uses Polylang to provide its Italian and English versions and to remember the visitor’s selected language through a technical cookie. Bagai does not use the language preference to profile the visitor. The cookie name and duration are listed in the Cookie Policy.

3.4 Analytics and performance data

With the visitor’s consent, the website may use Jetpack Stats and its Bilmur performance measurement component, provided by Automattic, to understand how the website is used through aggregate statistics and assess website performance.

Depending on the configuration and whether the visitor is logged in to WordPress.com, these tools may process the visitor’s IP address, WordPress.com user ID and username, user agent, page viewed, referring URL, date and time, browser language, country derived from the IP address, page views, outbound link clicks, video plays and resource loading performance data.

Bagai receives aggregate statistics and does not receive the individual visitor’s IP address or WordPress.com username from Jetpack Stats. According to Jetpack’s documentation, Automattic keeps Stats logs containing IP addresses and WordPress.com usernames, where available, for 28 days to provide the service.

Jetpack Stats and Bilmur are classified as optional Analytics tools. They must be loaded only after consent has been given through the cookie panel. Refusing consent does not prevent normal use of the website. Consent can be withdrawn at any time through the Manage cookie preferences command available on the website.

3.5 Google Fonts

Under the current configuration, some font resources are requested from Google Fonts servers. To provide the font files, the browser establishes a connection with Google and sends at least the visitor’s IP address and technical request metadata, such as browser type, date and time. Bagai uses the fonts only to ensure a consistent presentation of the website and does not receive information from Google that identifies an individual visitor.

The provider is Google, which processes data under its own Privacy Policy. Bagai relies on its legitimate interest in presenting the website consistently, securely and reliably under Article 6(1)(f) GDPR. Where Article 21 GDPR applies, the visitor may object to this processing by contacting Bagai.

3.6 Google Analytics 4

Google Analytics 4 measures page visits and interactions with the Nostalgear form, including confirmation of submission. Basic consent mode keeps the tag blocked until consent is given to the Statistics category. Without consent or after refusal, no measurement data is sent to Google Analytics. Consent can be withdrawn through Manage cookies to stop new measurements.

Once consent has been given, Google Analytics 4 may use cookies and technical data about the browser and device. The integration does not send Google Analytics any data entered in forms, such as name, email, telephone number, company or message, CRM enquiry identifiers or parameters in the page URL. Optional Analytics account data sharing, Google Signals and user-provided data collection are disabled; Google Analytics is not linked to Google Ads. Provider information: Google’s Privacy Policy.

For event and user data covered by Google Analytics 4 retention controls, the retention period is set to two months and does not reset when new activity occurs. This setting does not apply to most standard aggregate reports.

Bagai processes personal data for the following purposes:

  1. Providing and operating the website, delivering the pages requested, managing the selected language, preventing abuse, protecting systems and data and troubleshooting technical faults. The legal basis is Bagai’s legitimate interest in providing a secure and operational website under Article 6(1)(f) GDPR.
  2. Responding to enquiries and communications submitted through the contact form or by email, preparing proposals or taking pre-contractual steps requested by the data subject. The legal basis is Article 6(1)(b) GDPR. For general enquiries that are not directed towards a contractual relationship, the basis is Bagai’s legitimate interest in properly managing correspondence and professional relationships.
  3. Complying with legal obligations relating to an enquiry or any subsequent professional relationship. The legal basis is Article 6(1)(c) GDPR.
  4. Establishing, exercising or defending legal claims, preventing fraud and retaining evidence in the event of a dispute. The legal basis is Bagai’s legitimate interest in protecting its rights under Article 6(1)(f) GDPR.
  5. Producing aggregate traffic statistics and measuring performance through Jetpack Stats and Bilmur. The legal basis is consent under Article 6(1)(a) GDPR. Consent is optional and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
  6. Loading remote font resources under the configuration described in section 3.5. The legal basis is the legitimate interest explained in that section.

Where Bagai relies on legitimate interests, it assesses whether the processing is necessary and proportionate in view of the data subject’s rights and freedoms. Further information about this assessment may be requested, and the data subject may object to processing, by contacting Bagai.

5. Processing methods and security measures

Data are processed electronically and, where necessary, through organisational procedures appropriate to the nature and risk of the processing. Bagai takes reasonable steps to limit access to data, protect administrative accounts, keep the website and its components up to date, prevent unauthorised access and manage backups and incidents.

No online system can guarantee absolute security. Bagai periodically reviews providers, configurations and permissions and limits processing to data relevant to the purposes set out in this notice.

6. Providers, recipients and authorised persons

For the purposes described in this notice and within the scope of their responsibilities, personal data may be processed by:

  • persons authorised by Bagai who need to manage the website, security or communications;
  • technical and professional providers supporting maintenance, hosting, content delivery, analytics, email, security or support;
  • legal, tax or insurance advisers, where necessary;
  • public authorities or other parties where disclosure is required by law or needed to protect a right.

In particular, the website uses:

  • WordPress.com, Automattic, Jetpack and Akismet for hosting and platform services, security, content delivery, managing and delivering enquiries submitted through the contact form, spam protection and, subject to consent, analytics and performance measurement. Images and some static assets may be delivered through the WordPress.com CDN from domains such as i0.wp.com, i1.wp.com or i2.wp.com. See the Automattic Privacy Notice for Visitors to Users’ Sites and the Jetpack Privacy Center.
  • Google Fonts to deliver remote font resources under the configuration described in section 3.5. See the Google Privacy Policy.
  • Complianz to collect and remember preferences for optional technologies and block non-essential tools until the visitor makes a choice.
  • Polylang to provide the different language versions and remember the selected language.

Depending on the service and processing activity, providers act as processors on Bagai’s behalf or as independent controllers for processing activities whose purposes and means they determine. Bagai does not sell visitors’ personal data.

7. Transfers outside the European Economic Area

Automattic and Google operate internationally. Their services may involve technical data being processed or accessed in countries outside the European Economic Area, including the United States.

Where required under the GDPR, transfers are based on an adequacy decision under Article 45 GDPR, including the EU-U.S. Data Privacy Framework for participating recipients, or on Standard Contractual Clauses approved by the European Commission under Article 46 GDPR and, where necessary, supplementary safeguards.

Automattic provides WordPress.com site owners with a Data Processing Agreement that includes Standard Contractual Clauses. More information is available on the WordPress.com Data Processing Agreements page.

Data subjects may contact Bagai for more information about the transfer mechanism that applies or for a copy of the relevant safeguards, subject to the protection of confidential information and third-party rights.

8. Retention periods

Bagai keeps personal data only for as long as needed for the purposes for which they were collected, using the following periods or criteria:

  • Technical, security and operational logs: for as long as is technically necessary to deliver and protect the website and in accordance with the provider’s retention cycles. Data may be kept longer where required to investigate an incident, prevent abuse or comply with the law.
  • Jetpack Stats and Bilmur: according to the provider’s documentation, Automattic keeps Jetpack Stats logs containing IP addresses and WordPress.com usernames, where available, for 28 days. Aggregate statistics may remain available while the service is used and within normal technical backup cycles.
  • Ordinary enquiries submitted through the contact form or by email that do not lead to a professional relationship: normally up to 12 months after the enquiry is closed.
  • Unsuccessful negotiations or commercial enquiries: normally up to 24 months after the last meaningful contact, unless longer retention is needed for a dispute or legal obligation.
  • Data relating to a contractual relationship: for the duration of the relationship and then for the period required under civil, tax and accounting laws, normally up to 10 years, subject to a longer period where a dispute is ongoing.
  • Cookie preferences and evidence of consent: for the periods stated in the Cookie Policy and for as long as needed to demonstrate the choice made.
  • Data processed by Google Fonts: according to the periods and criteria described by Google in its privacy information. Bagai does not have access to the raw logs produced by font requests.

At the end of the relevant period, data are deleted, anonymised or made unavailable through ordinary procedures and technical backup cycles, unless further retention is required by law or an ongoing dispute.

9. Data subject rights

Where the GDPR applies, data subjects may ask Bagai to:

  • confirm whether their personal data are being processed and obtain access to them;
  • correct inaccurate data and complete incomplete data;
  • erase personal data;
  • restrict processing;
  • receive data they provided in a portable format where processing is based on consent or contract and carried out by automated means;
  • object, on grounds relating to their particular situation, to processing based on legitimate interests;
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
  • receive information about safeguards used for international transfers.

Requests may be sent to info@bagaitheagency.com. Bagai may request information strictly necessary to verify the requester’s identity and will respond within the time limits set by the GDPR.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali, or with the competent supervisory authority in their Member State. Information is available on the Garante’s Data subject rights page.

10. Automated decision-making

Bagai does not use data collected through this website for decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject. The website does not carry out commercial profiling.

11. Cookies and preference management

For detailed information about cookies and similar technologies, providers, purposes, duration and available choices, please read the Cookie Policy.

Preferences for optional tools can be changed at any time through the Manage cookie preferences command available on the website. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

12. Changes to this notice

Bagai may update this notice when the website, the services used or the applicable law changes. The date of the latest revision appears at the beginning of the page. If a change is material, Bagai will use a proportionate method to communicate it and, where required, will request consent again.