Registered office: 30 N Gould St Ste R, Sheridan, WY 82801, USA
Wyoming Entity ID: 2026-001391187
Email: info@skalo.agency
2. EU Representative (Art. 27 GDPR)
In accordance with Art. 27 of Regulation (EU) 2016/679, Skalo Agency LLC has designated a Representative in the European Union:
Name: Annamatilde Baiano
Address: Via Conte Roncone, 7 — 00020 Ciciliano (RM), Italy
Email: info@skalo.agency
Phone: +39 347 939 7971
The Representative serves as the point of contact for supervisory authorities and data subjects who wish to exercise their data protection rights.
3. Data Collected
We collect the following types of personal data, organized by category:
a) Data collected through the website
Data voluntarily provided through the contact form: name, email address, phone number, message and optional website or social profile. This data is used to handle the specific request and contact the user. The same email is used for the newsletter only when the user selects the separate optional choice.
Browsing data: IP address (anonymized), browser type, operating system, pages visited, access times. This data is collected automatically through hosting systems.
Statistical usage data, collected through Google Analytics 4 ONLY after your explicit consent: pages viewed, navigation path, traffic source, device type and approximate country. Measurement uses a random browser identifier, not your name; advertising signals and sharing with other Google products are turned off. If you do not consent, Google's script is not loaded and no data leaves your browser. Details and withdrawal: Cookie Policy.
If you choose the ad campaigns category and click Book on one of the campaign pages, we retain the available click identifiers and campaign labels, the page path and your consent choice with its date and version. Only a random reference is sent in the calendar URL, without names, email addresses, answers or Google click identifiers. The reference connects the observed journey to a received booking; it does not verify the person’s identity or independently authorize a Google Ads upload.
b) Data processed for B2B commercial outreach
Name and surname of the business owner or manager
Business email address
Business phone number
Job title
Company name, office address, public digital presence data (review ratings, social media posting frequency)
c) Data processed for client service delivery
Name, surname, email, phone number of the business contact
Client company data and billing information
Access credentials for social/review profiles (managed by the client)
d) Data collected through call recording
Voice and content of the telephone conversation
Phone number, date and time of the call
e) Data acquired through connected platforms (Google Business Profile)
Reviews received, responses published, and profile performance metrics, acquired through the Google Business Profile API with the client's OAuth 2.0 authorization
This data is used exclusively for the contracted reputation management service and is never sold, aggregated, or used for any other purpose
Data is retained for the duration of the contract. Cached data is deleted within 30 days, in compliance with Google Business Profile API policies
f) Data acquired through connected platforms (eBay)
Seller feedback received, responses published, and seller reputation metrics, acquired through the eBay Trading API with the client's OAuth 2.0 authorization
This data is used exclusively for the contracted reputation management service and is never sold, aggregated, or used for any other purpose
Data is retained for the duration of the contract and deleted within 30 days of service termination
g) Data processed through the WhatsApp Business API integration
Phone numbers of tenants' end users (message recipients)
Content of WhatsApp messages sent and received (Meta-approved templates and free-form conversations within the session window)
Any attachments and media transmitted via WhatsApp
Delivery metadata: send/receive timestamps, read status, WhatsApp Business Account (WABA) identifier of the tenant
4. Purpose and Legal Basis for Processing
Personal data is processed for the following purposes, each with its own legal basis:
Handling contact form requests and contacting the user — Legal basis: steps taken at the request of the data subject prior to entering into a contract (Art. 6, par. 1, let. b, GDPR)
Sending the Skalo newsletter — Legal basis: the user's optional consent (Art. 6, par. 1, let. a, GDPR), withdrawable at any time through the unsubscribe link in each email
Ensuring website security and operation — Legal basis: legitimate interest of the controller (Art. 6, par. 1, let. f, GDPR)
Aggregate visit counting through Vercel Web Analytics, with no cookies and no persistent identifiers: no profile, no recognition between one visit and the next, no data traceable to a person — Legal basis: legitimate interest of the controller in knowing the traffic volume of its own website (Art. 6, par. 1, let. f, GDPR)
Measuring website usage in statistical form, to understand which content is useful and improve it — Legal basis: user consent (Art. 6, par. 1, let. a, GDPR), collected through the cookie banner and withdrawable at any time
Measuring advertising campaign performance, i.e. which ads lead to an enquiry — Legal basis: user consent (Art. 6, par. 1, let. a, GDPR), collected as a separate category in the cookie banner and withdrawable at any time
B2B commercial outreach: proactive contact with companies (corporations, partnerships — never sole proprietorships) to propose Skalo Agency services — Legal basis: legitimate interest (Art. 6, par. 1, let. f, GDPR), documented in a Legitimate Interest Assessment (LIA) available upon request
Delivery of contracted services to clients — Legal basis: performance of a contract (Art. 6, par. 1, let. b, GDPR)
Recording of telephone calls for service improvement and documentation — Legal basis: informed consent, obtained via IVR message prior to recording
Compliance with legal and tax obligations — Legal basis: legal obligation (Art. 6, par. 1, let. c, GDPR)
Delivery of WhatsApp Business messaging services to tenants and management of communications with their end users — Legal basis: performance of a contract with the tenant (Art. 6, par. 1, let. b, GDPR); legitimate interest of Skalo Agency for end-user data (Art. 6, par. 1, let. f, GDPR)
Bookings and optional campaign measurement
You can book without advertising consent. Details entered in the calendar are processed by Koalendar and Skalo to arrange and manage your call and request. The optional “Misurazione Google Ads” checkbox does not subscribe you to a newsletter or authorize promotional messages or ad personalization.
If you accept the advertising campaigns category on the website and select the checkbox in the calendar, we can connect the booking to its advertising journey using a random reference. The browser tab retains this reference for up to one hour to match the journey when you return. The return URL contains no name, email, answers or identifiers. A link or an email match alone does not prove consent.
The consent purpose is to measure Google Ads campaign performance. With both choices granted and after technical checks, we may send Google the advertising click identifier, a technical conversion ID, the booking date and the consent status. We do not send names, email addresses, phone numbers or form answers, and we do not assign a monetary value to the booking. The recipient is Google, under the notice linked below. We do not send bookings to OpenAI.
We retain the dates and versions of the choices, journey reference and booking evidence for up to 30 days from reference creation, plus the next hourly cleanup cycle. Unlinked references expire after one hour. Withdrawal removes attribution data without deleting the operational contact or the call; a blocking identifier is retained for up to 30 days to prevent delayed requests from restoring the data. Withdraw using the button below, the return page or by disabling the campaigns category in cookie preferences. If you deleted cookies or used another device, email info@skalo.agency and identify the relevant booking. Withdrawal does not affect the lawfulness of prior processing.
When we prepare a conversion for Google, we keep a separate technical record to handle duplicates, errors, withdrawals and adjustments: booking and transaction codes, dates, outcomes and operation references. We do not copy click identifiers, contact details or calendar answers into this record. It is deleted within 60 days of its creation, plus the next hourly cleanup cycle; later attempts do not extend this period. After withdrawal, any minimum information still needed is used only to handle and document the block and any adjustments, not for new advertising uploads. Withdrawal on this website does not by itself prove erasure of data already received by Google: we separately handle verification and applicable requests.
Withdrawal covers references from this browser. If you booked on another device or deleted your cookies, request removal by emailing info@skalo.agency.
5. B2B Commercial Outreach
Skalo Agency conducts proactive commercial outreach to businesses (never to consumers or sole proprietorships) through the following channels: email, LinkedIn, SMS, phone, and WhatsApp.
The data used for outreach is exclusively professional and publicly available, collected from sources such as Google Maps, LinkedIn, business websites, and data enrichment services (Clay.com, Apollo, Lusha, Hunter.io).
Processing is based on legitimate interest (Art. 6, par. 1, let. f, GDPR) and is documented in a Legitimate Interest Assessment (LIA) compliant with EDPB and ICO guidelines. A copy of the LIA is available upon request by writing to info@skalo.agency.
Safeguards adopted:
Every communication contains a functioning and immediate opt-out link
Maximum 3 contact attempts per recipient (1 initial email + max 2 follow-ups)
The sender (Skalo Agency) is always clearly identified
Data of unconverted leads is deleted within 12 months of collection
Sole proprietorships and freelancers are explicitly excluded, in compliance with Art. 130 of the Italian Privacy Code
Phone numbers and consent data (opt-in/opt-out) are never shared, sold, or transferred to third parties for promotional or marketing purposes
6. Call Recording
Phone calls with clients and prospective clients may be recorded for the purposes of service improvement, training, and documentation of commercial interactions.
Recording occurs only with the informed consent of the caller, obtained via an IVR (Interactive Voice Response) message prior to the start of recording. The telephone system used is Messagenet (Italian provider).
Recordings are retained for a maximum of 6 months, after which they are automatically deleted.
7. Data Sharing
Personal data is never sold to third parties. It may be shared with the following service providers, each within the scope of their respective functions:
Vercel Inc. — website hosting and Vercel Web Analytics, aggregate visit counting with no cookies and no persistent identifiers
Koalendar Inc. — appointment booking through an embedded calendar or an external link: receives the details you enter to arrange the call and, with campaign consent, an optional random journey reference
Resend — transactional email delivery from the website
Brevo (Sendinblue SAS) — newsletter list management and delivery, only after the user's optional consent
Google Workspace — email and document management
Google Ireland Limited — Google Analytics 4, website usage statistics. Enabled only after consent; no data is sent to Google until consent is given
Google Ireland Limited — Google Ads, advertising campaign measurement. Enabled only after consent to the campaign category, and only on campaign landing pages
OpenAI — measurement of advertising campaigns shown inside ChatGPT, active only on the campaign landing page. In the browser the pixel loads only after consent to the campaigns category. We do not send Koalendar bookings or invitee email addresses to OpenAI. Any transfer of minimal booking data to Google follows the conditions described in the booking section; email addresses remain excluded.
Google Business Profile API — review and reputation management (client-authorized access via OAuth 2.0)
eBay Trading API — seller feedback and reputation management (client-authorized access via OAuth 2.0)
Messagenet — VoIP telephony and call recording system
Twilio Inc. — WhatsApp Business and SMS messaging for B2B commercial communications and post-call follow-ups
Meta Platforms, Inc. (WhatsApp) — WhatsApp Cloud API infrastructure for tenant messaging. Acts as data processor for messages sent through the WhatsApp Business integration. US data transfer via Standard Contractual Clauses. Meta Privacy Policy applies (facebook.com/privacy/policy)
Supabase Inc. — CRM database, authentication and file storage
OpenAI, L.L.C. — automatic transcription of call recordings
OpenRouter / Anthropic PBC — AI-assisted generation of commercial copy
Slack Technologies (Salesforce, Inc.) — internal coordination of client work
All third-party providers comply with GDPR or adhere to equivalent data protection safeguards (Standard Contractual Clauses or EU-US Data Privacy Framework).
8. International Data Transfers
Some of our service providers (Vercel, Google Workspace, Google Analytics, Stripe, Clay.com, Instantly.ai, Expandi.io, Twilio, Meta Platforms Inc., Supabase, OpenAI, Anthropic/OpenRouter, Slack) are based in the United States. Data transfers comply with GDPR safeguards through:
Standard Contractual Clauses (SCCs) approved by the European Commission
EU-US Data Privacy Framework (DPF), where applicable
Messagenet is an Italian provider and call recording data is not transferred outside the EU.
9. Data Retention
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected:
Contact form data: maximum 12 months from the request
Newsletter data: until consent is withdrawn or the user unsubscribes; the minimum proof of withdrawal is retained as needed to prevent further messages
B2B outreach data (unconverted leads): maximum 12 months from collection, then automatically deleted
Active client data: duration of the contract + 24 months post-termination for legal and accounting obligations
Call recordings: maximum 6 months from the recording
Google Analytics 4 statistical data: 14 months from collection, then automatically deleted by Google
Google Ads _gcl_au cookie: 90 days. Booking references and the separate technical record follow the 30-day and 60-day periods described in the booking section
Collaborator and contractor data: duration of the relationship + 10 years for tax obligations
Google Business Profile data (API cache): maximum 30 days, in compliance with Google policies
eBay data (API cache): maximum 30 days from service termination
WhatsApp Business data (message logs, conversation metadata, tenant WABA configurations): duration of the contract with the tenant + 12 months, then automatic deletion
10. User Rights
In accordance with GDPR (Articles 15-22), you have the right to:
Access your personal data (Art. 15)
Request rectification of inaccurate data (Art. 16)
Request erasure of data (Art. 17 — "right to be forgotten")
Restrict data processing (Art. 18)
Request data portability (Art. 20)
Object to processing, including commercial outreach based on legitimate interest (Art. 21)
Withdraw consent at any time, without affecting the lawfulness of processing based on consent given prior to withdrawal
To exercise your rights, you can contact us at info@skalo.agency or write to the EU Representative. We will respond within 30 days of receiving the request.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it) or any other competent supervisory authority.
11. How to Opt Out of Commercial Outreach
If you have received a commercial communication from Skalo Agency and wish to no longer be contacted:
Click the unsubscribe link included in every email — removal is automatic within 24 hours
Or write to info@skalo.agency with your request — your data will be removed from all our records within 72 hours
12. Security
We adopt appropriate technical and organizational measures to protect personal data from unauthorized access, loss, or destruction, including: HTTPS encryption for all communications, multi-factor authentication (MFA) for system access, access limited to authorized personnel only, regular backups, and secure storage.
13. Cookies
This website uses technical cookies and, only with your consent, the statistical cookies of Google Analytics 4. On your first visit a panel appears with two equally weighted choices: if you do not answer it counts as a refusal and nothing is installed. You can change your mind at any time from the icon at the bottom right. The full list of cookies, with durations and purposes, is in our Cookie Policy. Cookie Policy
14. Policy Changes
We reserve the right to update this Privacy Policy at any time. Changes will be published on this page with the date of last update.
15. Contact
For any questions regarding this Privacy Policy or the processing of your personal data:
Data Controller: Skalo Agency LLC — info@skalo.agency
By using our platform (Skalo AI Hub) to connect your WhatsApp Business account, you authorize the transfer and processing of data through the infrastructure of Meta Platforms, Inc., which acts as data processor for messages sent via WhatsApp Cloud API. The legal basis for processing end-user data of individuals interacting with tenants via WhatsApp is performance of a contract with the tenant (Art. 6, par. 1, let. b, GDPR) and legitimate interest of Skalo Agency (Art. 6, par. 1, let. f, GDPR). The Meta Privacy Policy (facebook.com/privacy/policy) also applies to data transiting Meta's infrastructure. You can revoke this authorization at any time by disconnecting your WhatsApp account from our dashboard. To request complete deletion of your data and WhatsApp configurations, contact us at info@skalo.agency.
Data transferred to Meta: recipient phone numbers, message content (templates and free text), any attachments, delivery metadata (timestamps, read status).
Data is encrypted during transit to the Meta API.
Skalo Agency does not use WhatsApp conversation data for advertising, profiling, or sale to third parties.
Conversation data is retained for the duration of the contract with the tenant + 12 months from termination, then automatically deleted.
End users of tenants who wish to exercise their GDPR rights (access, rectification, erasure) regarding WhatsApp messages may write to info@skalo.agency; we will respond within 30 days.