Privacy policy

1. Data controller

The data controller is Roberta Napoli (the “Controller”), [address], Italian VAT no. 13477710019, email info@italianoinside.it.

This policy is provided under arts. 13 and 14 of EU Regulation 2016/679 (“GDPR”) and covers the personal data of users of the website italianoinside.it (the “Website”).

2. Data processed

• Account data: email address, name, language and time zone.
• Google or Facebook sign-in data: the account identifier at the provider and the email address. The Controller never receives the password or any other profile data.
• Signed-in device data: browser and operating system type, approximate city and country derived from the IP address (which is not stored), date of sign-in and of last use, and whether the user chose to stay signed in.
• Billing data: first name, last name, address, state or region and country; Italian tax code for residents of Italy; VAT number for business or professional buyers.
• Lesson and order data: bookings, rescheduling, purchases, credits and, in the “Invite a friend” programme, the user who sent the invitation, if any.
• Payment data: processed directly by Stripe and PayPal. The Controller has no access to payment card details and does not store them.
• Contact form data: name, email, topic, Italian level (optional) and message text. These are forwarded to the Controller by email and are not stored on the Website.
• Correspondence: the content of messages sent to the Controller by email.
• Technical data: data needed for the Website to work and stay secure, including data collected by Cloudflare Turnstile to tell real users apart from automated programs.

3. Purposes and legal bases

Purpose	Legal basis
Creating and managing the account; managing bookings, lessons and workshops	Performance of a contract (art. 6(1)(b) GDPR)
Signing in to the personal area, including through Google or Facebook, and listing signed-in devices	Performance of a contract (art. 6(1)(b) GDPR)
Sending confirmations, reminders and notices about purchased services	Performance of a contract (art. 6(1)(b) GDPR)
Replying to requests sent through the contact form or by email	Pre-contractual steps at the data subject’s request (art. 6(1)(b) GDPR)
Issuing invoices and meeting accounting and tax obligations	Legal obligation (art. 6(1)(c) GDPR)
Website security and abuse prevention	Legitimate interest of the Controller (art. 6(1)(f) GDPR)

Data is not used for marketing or profiling purposes and is not sold to third parties.

4. Whether providing data is required

Account and billing data, and the name and email in the contact form, are required to provide the services requested or to reply: without them it is not possible to proceed. Providing other data is optional.

5. How data is processed

Data is processed electronically, with technical and organisational measures appropriate to ensure its security and confidentiality. No automated decision-making takes place.

6. Recipients

Data may be disclosed to the following providers, who process it on behalf of the Controller as data processors (art. 28 GDPR):

• Cloudflare (Website hosting, database, protection against automated programs, cookie-free statistics, email forwarding)
• Resend (sending emails)
• Stripe and PayPal (payment processing)
• Google (sign-in with Google, calendar and Google Meet to hold lessons, Google Drive for backups)
• Meta Platforms Ireland (sign-in with Facebook)
• Fiscozen (issuing invoices)

Data may also be disclosed to the competent authorities where required by law.

7. Transfers outside the European Union

Some providers are based outside the European Economic Area. In such cases, transfers are based on the EU–US Data Privacy Framework or on the standard contractual clauses approved by the European Commission (arts. 45 and 46 GDPR).

8. Retention period

• Billing and order data: 10 years, as required by Italian tax law.
• Account and booking data: for as long as the account exists and for up to 2 years afterwards. [To be confirmed]
• Signed-in device data: until the session expires (at most 30 days) or until the user ends it.
• Messages received through the contact form or by email: for as long as needed to handle the request. [To be confirmed]
• Backups: copies older than [12 months] are deleted. [To be confirmed]

9. Data deletion

To request the deletion of the account and related data, including data received through Google or Facebook, simply write to info@italianoinside.it from the account’s email address. Deletion takes place within 30 days, except for data the Controller must keep by law (section 8). Users can also revoke the Website’s access at any time from their Google or Facebook account settings.

10. Data subject rights

Data subjects may exercise at any time the rights set out in arts. 15–22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection to processing. Requests should be sent to info@italianoinside.it. Data the Controller is legally required to keep, such as invoice data, cannot be erased before the required period ends.

Data subjects also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (art. 77 GDPR).

11. Changes

The Controller may update this policy. The version in force is always published on this page, with the date of the last update.