Privacy Policy - Fansapper

Version 1.1 – Last updated: 1 October 2026

This Privacy Policy explains how Phoenix Web Srl processes personal data when you visit https://www.fansapper.com (the “Website“), buy our social media marketing services on X (Twitter), join our affiliate program or contact us. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR“).

1. Data controller

Phoenix Web Srl
Via Pietro del Pezzo 34, 84128 Salerno (SA), Italy
VAT IT05956650658
Companies Register (REA) number: SA-486693
Share capital: EUR 10,000
PEC (certified email): phoenixwebsrl@pec.it
Email for privacy matters: support@fansapper.com

We have not appointed a Data Protection Officer because we are not required to.

2. What data we process, why, and on what legal basis

#	Purpose	Personal data	Legal basis (GDPR)	Retention
1	Creating and managing your customer account	username, email, password (stored in hashed form), account settings	Art. 6(1)(b) – performance of a contract / steps at your request	until you delete the account, or 24 months after your last login; then deleted
2	Processing orders and delivering the service: onboarding, carrying out the promotion, daily reports, account management	name, email, phone (if given), billing details, order details, your X handle and profile URL, content and links you send us (texts, images, videos, URLs), messages exchanged with your account manager, and, for Account Management, the delegated access you grant	Art. 6(1)(b) – performance of a contract	for the duration of the order and 24 months after it ends; publications stay online as agreed
3	Payments	order amount, currency, transaction ID, payment method type, payment status. Card data are collected directly by our third-party payment service providers, not by us	Art. 6(1)(b) – contract; Art. 6(1)(c) – legal obligation (accounting)	10 years (accounting and tax records, Article 2220 of the Italian Civil Code)
4	Invoicing, accounting and tax obligations	name or company name, address, VAT/tax number, invoices	Art. 6(1)(c) – legal obligation	10 years (Article 2220 of the Italian Civil Code)
5	Customer support and complaints, by email, contact form, Telegram, WhatsApp or X	name, email or handle, content of messages	Art. 6(1)(b) – contract (for customers); Art. 6(1)(f) – our legitimate interest in answering requests (for others)	24 months after the request is closed
6	Fraud prevention, payment security and sanctions screening (see our Anti-Fraud & Customer Screening Policy)	name, billing country, email, IP address, order and payment data, results of sanctions-list checks	Art. 6(1)(f) – legitimate interest in preventing fraud and chargebacks; Art. 6(1)(c) – legal obligation to comply with EU sanctions	24 months after the order; longer only if needed for a pending dispute
7	Defending our rights in disputes, chargebacks and legal claims	data relevant to the dispute	Art. 6(1)(f) – legitimate interest	until the dispute is closed and limitation periods have expired
8	Affiliate program (commissions are credited as store credit only; no cash payouts)	affiliate’s name, email, referral links, referred orders (order ID, amount, date), store-credit balance	Art. 6(1)(b) – contract with the affiliate; Art. 6(1)(c) – accounting obligations	for the duration of participation and 10 years for accounting records
9	Website statistics with Google Analytics 4 (loaded only after consent through our consent-management tool, Complianz)	pseudonymous identifiers, pages visited, device and browser data, approximate location. IP addresses are not stored by GA4	Art. 6(1)(a) – consent, collected through our cookie banner (Art. 5(3) Directive 2002/58/EC)	14 months (GA4 retention setting)
10	Technical operation and security of the Website	IP address, server logs, strictly necessary cookies	Art. 6(1)(f) – legitimate interest in running a secure website	server logs: kept for up to 30 days
11	Service emails about your order (confirmation, reminders, reports)	email, order data	Art. 6(1)(b) – contract	as for purpose 2
12	Newsletter / marketing emails – only if you opt in	email, name	Art. 6(1)(a) – consent; you can withdraw it at any time via the unsubscribe link	until you unsubscribe

We do not sell personal data and do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

3. Where we get the data from

We receive most data directly from you. We also receive:

payment status and fraud-prevention signals from the payment service provider that processes your payment;
statistical data through Google Analytics, only if you consent;
if you are a referred customer and have accepted marketing cookies, the identifier of the affiliate who referred you, through the AffiliateWP referral cookie (see our Cookie Policy);
public information on your X profile (handle, profile URL, follower count), which we look at to set up your campaign (Art. 14 GDPR).

4. Is providing data mandatory?

Data marked as required at checkout are needed to conclude and perform the contract and to issue invoices. Without them we cannot process your order. Consent for statistics and marketing is always optional, and refusing it has no effect on your purchase.

5. Content you send us and third parties’ data

If the content you ask us to promote contains personal data of other people, such as people shown in images, you are responsible for having a legal basis and, where needed, their consent, as required by our Terms (section 8). We process such data only in order to carry out the promotion you ordered.

6. Who receives your data

We share personal data only with:

payment service providers (regulated payment institutions, electronic money institutions and banks) that process your payment. They act as independent controllers for the payment transaction and for their own legal obligations, such as anti-money-laundering checks and fraud prevention, under their own privacy notices. Where they process data on our behalf, they act as our processors under a data processing agreement (Art. 28 GDPR). The provider that processes your payment is the one shown at checkout for the payment method you choose. You can ask us at any time, at support@fansapper.com, which payment service providers we currently use;
our hosting provider, Netsons s.r.l. (Italy), as a processor;
Google Ireland Limited (Google Analytics 4), as a processor, only if you consent to statistics cookies;
our email service provider, Netsons s.r.l. (Italy), as a processor;
our accountant / tax advisor, who acts under professional secrecy;
the affiliate who referred you (tracked with AffiliateWP, only if you consent to marketing cookies). The affiliate sees only the order ID, amount and date, never your name or contact details;
X Corp., Telegram, WhatsApp (Meta), only when you choose to contact us or receive reports through those channels. These providers process data as independent controllers under their own privacy policies;
public authorities, courts and law-enforcement bodies, when required by law.

Our processors act only on our documented instructions under a data processing agreement (Art. 28 GDPR).

The promotions you order are, by their nature, published publicly on X.

7. Transfers outside the European Economic Area

Some of our providers, such as analytics, communication-platform and payment service providers (including Google, X Corp., Meta and Telegram), may process data outside the European Economic Area, for example in the United States. Where this happens, the transfer is based on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or on the Standard Contractual Clauses adopted by the European Commission, together with additional safeguards where needed (Art. 45–46 GDPR). You can ask us for information on these safeguards, or a copy of them, at support@fansapper.com.

8. Security

We protect data with appropriate technical and organisational measures: HTTPS encryption, hashed passwords, access limited to the staff who need it, regular updates of the Website software and backups. Payments are handled by our third-party payment service providers on their secure systems, and we never see or store full card numbers.

9. Your rights

Under Articles 15–22 GDPR you have the right to:

access your personal data and obtain a copy;
have inaccurate data rectified;
have your data erased, where the conditions of Art. 17 are met;
restrict processing;
data portability for data you gave us under a contract or consent;
object at any time to processing based on our legitimate interests (Art. 21);
withdraw your consent at any time, without affecting processing carried out before the withdrawal. For cookies, use the “Cookie preferences” button in the footer.

To exercise your rights, write to support@fansapper.com. We reply within one month, which can be extended by two further months for complex requests (Art. 12(3)). We may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. In Italy, where we are established, the supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma – https://www.garanteprivacy.it.

10. Minors

Our services are intended only for people aged 18 or over. We do not knowingly collect data from minors. If we learn that we have, we delete it.

11. Cookies

For information on cookies and similar technologies, and to change your choices, see our Cookie Policy (https://www.fansapper.com/cookie-policy-eu).

12. Changes to this policy

We may update this Privacy Policy. The version number and date at the top show when it last changed. Where changes are significant, we will inform customers by email.

13. Contact

Phoenix Web Srl – Via Pietro del Pezzo 34, 84128 Salerno (SA), Italy – VAT IT05956650658 – support@fansapper.com – https://www.fansapper.com

Privacy Policy 🤩