Privacy Policy
Notice on the processing of personal data
Provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended.
Last updated: 6 August 2026
1. Data Controller
Attanasio Flaminia — Via Monticello 21, 00069 Trevignano Romano (RM), Italy — VAT no. 18353231006 (the “Controller”).
Email for privacy requests and to exercise your rights: flaminia.attanasio.rea@gmail.com.
No Data Protection Officer has been appointed, as the conditions of Art. 37 GDPR do not apply.
2. Scope
This notice covers processing carried out through this website and in the course of the image consulting services provided by the Controller. It does not extend to third-party websites reachable through links, which have their own notices.
3. Data processed
3.1 Browsing data
The systems running this website automatically collect data whose transmission is inherent to Internet protocols: IP address, date and time of the request, requested URLs, response status code, browser type and operating system. They are used to deliver the service, for aggregate statistics and for infrastructure security.
3.2 Data provided voluntarily
Identification and contact data (name, email, phone where provided), the subject and content of messages sent through the contact form or via email, WhatsApp and social media; data needed to book and deliver the services and to issue tax documents.
3.3 Consultation data
During consultations, photographs, measurements, physical characteristics and personal preferences may be shared. They are processed solely to deliver the requested service, are never disseminated and are not published without separate, specific and revocable consent.
3.4 Cookies and similar technologies
The website uses technical cookies and, subject to consent, preference, statistics and marketing cookies. Details are in the Cookie Policy.
4. Purposes, legal bases and retention
- Replying to enquiries — pre-contractual measures (Art. 6.1.b GDPR). Retention: 24 months from the last contact.
- Delivering consulting services — performance of a contract (Art. 6.1.b GDPR). Retention: duration of the relationship plus 24 months.
- Tax, accounting and legal obligations — legal obligation (Art. 6.1.c GDPR). Retention: 10 years.
- Website usage statistics — consent given through the cookie banner (Art. 6.1.a GDPR). Retention: up to 14 months or until withdrawal.
- Marketing, remarketing and campaign measurement — consent (Art. 6.1.a GDPR). Retention: until withdrawal and no longer than 24 months.
- Newsletter and promotional communications — consent (Art. 6.1.a GDPR), revocable at any time. Retention: until unsubscribe.
- Security, abuse prevention and technical logs — legitimate interest in protecting the website (Art. 6.1.f GDPR). Retention: up to 12 months.
Providing the data marked as required in the contact form is necessary to receive a reply; without it the request cannot be handled. Providing data for statistics and marketing is always optional.
5. Recipients and processors
Data may be processed by service providers appointed as processors under Art. 28 GDPR:
- website hosting and infrastructure provider;
- database and storage provider for contact form messages;
- booking and appointment management platform;
- email and messaging providers (email, WhatsApp) used for direct contact;
- analytics and advertising providers, if enabled with your consent;
- tax and accounting advisors, for statutory obligations.
Data is never disseminated or sold to third parties for their own purposes. It may be disclosed to competent authorities where required by law.
6. Transfers outside the EU
Some providers may process data outside the European Economic Area. In that case transfers rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified providers) or on Standard Contractual Clauses, supplemented by additional measures where needed. You may request a copy of the safeguards in place by writing to the Controller.
7. Your rights
Under Articles 15-22 GDPR you have the right to:
- access your data and obtain a copy;
- request rectification or erasure;
- request restriction of processing;
- object to processing based on legitimate interest and to direct marketing;
- receive your data in a structured format and transmit it to another controller (portability);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests can be sent to flaminia.attanasio.rea@gmail.com; the Controller replies within one month, extendable by two further months in complex cases.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or with the supervisory authority of your country of residence.
8. Automated decision-making and minors
No automated decision-making or profiling with legal effects is carried out. The website and services are not directed at children under 16: their data is processed only with the consent of a person holding parental responsibility.
9. Security
The Controller adopts appropriate technical and organisational measures (encrypted connections, limited and authenticated access, backups) to protect data against unauthorised access, loss or disclosure.
10. Changes
This notice may be updated; the version in force is always published on this page together with its last update date.