This translation is provided for convenience only: in case of any difference, the Italian version prevails.
Data controller
evenue srls
Via Fino, 7
65013 Città Sant’Angelo (PE), Italy
VAT No. IT02387950682 - Tax Code 02387950682
REA PE-427271 - Share capital € 2,000.00 fully paid up
PEC (certified email): evenue@pec.it
Data protection contact: dpo@dgcard.it
• anyone who visits the dgcard.it site and writes through the contact form;
• customers and contact persons who create an account and use the dgCard service;
• anyone who opens a card (Visitors);
• persons whose data is published in the cards (Card persons).
Data of the Card persons. The data published in the cards (name, role, photo, contacts, etc.) is entered by the customer, who is its controller and decides on its publication; evenue srls processes it on the customer’s behalf as processor (art. 28 GDPR), according to the Agreement in Annex A of the Terms and Conditions. To exercise their rights over this data, data subjects must therefore contact the company of the card; requests we receive are forwarded to the customer immediately.
Registration and account management
Data: email (verified with a code), password (stored in non-reversible encrypted form), first name, surname and telephone of the contact person, company name, address, country, company telephone and email, domain, VAT number, tax code, PEC and SDI code, chosen plan and add-ons, language, IP address at registration, date and time of logins to the panel.
Legal basis: performance of the contract and of pre-contractual measures (art. 6.1.b GDPR).
Retention: for the whole life of the account; after closure (refund), the end of the FREE trial without payment or the expiry of the plan without renewal, 365 days without public access (to allow reactivation), then automatic deletion. Before deleting an expired account we send a notice by email.
Orders, invoicing and legal obligations
Data: billing details, number and amount of orders, payment date, PayPal transaction or received bank transfer reference, record of acceptance of the Terms (date, time, version, IP address).
Legal basis: legal obligation (art. 6.1.c GDPR) and protection of the Controller’s rights (art. 6.1.f GDPR).
Retention: 10 years (art. 2220 Italian Civil Code and tax rules).
Payments
PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)
Payment takes place on the PayPal platform, which acts as an independent controller: dgcard.it neither receives nor stores card data. We receive the amount, order number, outcome, transaction identifier and email of the PayPal account used.
Legal basis: performance of the contract (art. 6.1.b GDPR).
Service communications
Data: account email. We send order confirmations, reminders of trial and plan expiry, security notices and notices of changes to the terms. We do not send newsletters or advertising.
Legal basis: performance of the contract (art. 6.1.b GDPR).
Retention: for the life of the account.
Prevention of trial and refund abuse
To prevent the FREE trial and the refund being used more than once by the same company, we keep non-reversible encrypted fingerprints (keyed hashes with a secret key) of email, VAT number, tax code, telephone numbers, contact person’s name, domain, company name, IP address at registration and PayPal account used. The fingerprints cannot be traced back to the original data. At registration an automatic check compares the new fingerprints with existing ones: if the trial or the refund has already been used, the account is created without a trial. This check has no legal effects other than access to the trial; you can always request a review by a person by writing to ordini@dgcard.it.
Legal basis: legitimate interest of the Controller in preventing abuse and fraud (art. 6.1.f GDPR).
Retention: for the life of the account and, after its closure, for 2 years; then the fingerprints are deleted automatically.
Site security
Data: IP address and date and time of login attempts and form requests, to limit repeated attempts and block bots; log of the operations carried out by the administrator in the accounts.
Legal basis: legitimate interest in the security of the service (art. 6.1.f GDPR).
Retention: for the time strictly necessary to protect the service and in any case no longer than the life of the account.
Requests from the contact form and WhatsApp
Data: type of request, name, email, telephone, message text and any order number. The message reaches us by email and the sender receives a confirmation; if you contact us on WhatsApp we will process your number and messages (WhatsApp, owned by Meta, processes the data as an independent controller according to its own privacy notice).
Legal basis: answering requests and pre-contractual measures (art. 6.1.b GDPR) and legitimate interest in replying (art. 6.1.f GDPR).
Retention: for the time needed to handle the request and any resulting relationship, and in any case no longer than 24 months if no contract follows.
Card visit statistics
DB-IP database on our server (Germany, EU)
When a Visitor opens a card we record the date, time and approximate location (city, region, country), derived from the IP address directly on our server with a local database, without sending the IP to third parties (IP Geolocation by DB-IP, CC BY 4.0 licence). The IP is used to count the same person only once and to exclude bots and server networks: in the database we do not store the IP but only a non-reversible encrypted fingerprint (keyed hash with a secret key). In the panel the customer sees only aggregate data (number of visits, countries and cities), never IP addresses.
Legal basis: legitimate interest in providing the customer with aggregate statistics and in protecting the service (art. 6.1.f GDPR).
Retention: as long as the card exists; the data is deleted with the card or with the account.
Saving the card to the phone or Wallet
The button to save the contact creates a vCard file that is downloaded to the Visitor’s device: we record nothing about who downloads it. If the Visitor chooses Apple Wallet, the pass file is created by our server and saved by their device; if they choose Google Wallet, the card data needed for the pass is sent to Google, which processes it according to its own privacy notice. Saving takes place only at the Visitor’s request.
Content from external platforms
YouTube (Google Ireland Ltd.) in “privacy-enhanced mode” (youtube-nocookie.com)
The video on the home page is loaded only when the user presses “Watch the video”: before that moment no data is sent to YouTube. Fonts are loaded from our server, not from external services.
Cookie banner
Hu-manity.co (United States)
The dgcard.it pages (not the cards and not the panel) load the cookie choice banner from the servers of Hu-manity.co, which receives the IP address and the technical browser data needed to show it and to record the user’s choice.
Legal basis: legal obligation to collect consent and legitimate interest in proving it (art. 6.1.c and 6.1.f GDPR).
Retention: for the duration chosen by the user in the banner.
Protection of forms against spam
Google reCAPTCHA (Google Ireland Ltd.)
On the pages with the contact form and the registration, reCAPTCHA analyses the IP address, the technical data of the browser and device and the interaction with the page, to distinguish people from automated programs. It shows no boxes to tick: when the form is sent, Google returns a score, which we use only to accept or reject the request and do not store.
Legal basis: legitimate interest in protecting the site and the forms from spam and abuse (art. 6.1.f GDPR).
Retention: dgcard.it does not store reCAPTCHA data; Google processes it according to its own privacy policy.
The data requested in the registration form is necessary to create the account, provide the service and issue the invoice: without it registration is not possible. The data in the contact form is necessary to reply. The service is reserved for persons of legal age.
The data is processed by authorised staff of evenue srls, bound by confidentiality, and by suppliers acting as processors: Shellrent S.r.l. (Italy, EU), from which we rent the server, located in the data centre of Hetzner Online GmbH (Germany, EU): this is where the site, the database and outgoing mail are located; Hu-manity.co (United States) for the cookie banner of the dgcard.it pages; tax and administrative consultants for accounting. The following receive data as independent controllers: PayPal for payments and Google for the Google Wallet passes requested by Visitors and for reCAPTCHA on the site’s forms. The data may be disclosed to the authorities when required by law. We do not sell or transfer data to third parties for commercial purposes. The updated list of processors can be requested from dpo@dgcard.it.
The server and the database are located in the European Union (Germany). The IP addresses of card visits stay on our server. Google Wallet pass data, reCAPTCHA data and cookie banner data may be processed in the United States by Google and by Hu-manity.co: these transfers take place on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) for certified companies or of the standard contractual clauses approved by the Commission (arts. 45 and 46 GDPR). A copy of the safeguards can be requested from dpo@dgcard.it.
The Controller adopts appropriate technical and organisational measures to prevent unauthorised access, disclosure, modification or destruction of data: encrypted connections (HTTPS), passwords encrypted in a non-reversible way, fingerprints with a secret key stored outside the site, restricted and protected server access, limitation of login attempts, periodic backups and software updates. In the event of a data breach the Controller informs the supervisory authority and, where required, the data subjects (arts. 33 and 34 GDPR).
You may at any time exercise the rights provided for by arts. 15-22 GDPR:
Access: know whether we process your data and receive a copy.
Rectification: correct or update the data (much of it can be changed directly from the panel).
Erasure: obtain the deletion of the data, except data the law requires us to keep (e.g. invoices).
Restriction: ask for the data only to be stored, in the cases provided for by art. 18 GDPR.
Portability: receive the data you provided in a structured, commonly used format and transmit it to another controller.
Objection: object to processing based on legitimate interest, on grounds relating to your particular situation.
Complaint: lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the country where you live or work, or take legal action.
Requests should be sent to dpo@dgcard.it or by PEC to evenue@pec.it. They are free of charge and are answered within one month (extendable by two months in complex cases, with notice). We may ask the sender to confirm their identity. For the data of Card persons, the request must be made to the company of the card (see above).
We do not carry out profiling. The only automatic check is the fingerprint check at registration, described above, which only decides whether to grant the FREE trial; you can request a review by a person.
dgcard.it uses only technical cookies, necessary for operation, and does not use third-party profiling or statistics cookies. The dgcard.it pages show a banner (Hu-manity.co) to choose the level of access to data; the choice is remembered with a technical cookie. The contact and registration forms are protected by Google reCAPTCHA. For details see the Cookie Policy.
The Controller may update this notice, for example due to changes in the service or in the law. The date of the last change is shown at the top and at the bottom of the page; important changes are notified to customers by email.
Notice drawn up pursuant to arts. 13 and 14 of Regulation (EU) 2016/679 and Italian Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code), as amended by Italian Legislative Decree 101/2018.
This notice covers the dgcard.it site, the dgCard service and the cards published on customers’ domains.
Last updated: 23 October 2026
evenue srls
