Legal informationPrivacy and Cookie Policy

General information

Personal data collected while browsing the Website is processed in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679, known as the GDPR. This page explains which data the Controller collects, why it is collected and how you can exercise your rights.

This information is provided pursuant to article 13 of the GDPR. For any clarification you can contact the Controller using the details given below.

Data Controller

The Controller of the personal data collected on this website is Caterina Lostia (hereinafter the Controller), with registered office in Via Marco Polo 5, 10129 Turin, Italy, telephone +39 335 6619265 and email address direzione@caterinalostia.com.

Any request concerning personal data should be addressed to the Controller, using the contact details given above.

Data collected while browsing

Personal data may be collected while browsing the Website, when using the contact form or when writing to the email address published on the Website. Providing it is always optional.

Anyone writing to the email addresses published on the Website discloses their own address along with any other data contained in the message.

The personal data provided by the user is recorded and stored on electronic and paper media, protected by appropriate technical and organizational security measures.

The contact form asks for a name and an email address and, optionally, for a few lines about the wedding and how the user heard about the Controller. The message is sent to the Controller by email and is used only to reply to the request.

To protect the form from spam and automated submissions, it uses Cloudflare Turnstile, a verification service provided by Cloudflare, Inc. When the form is displayed and submitted, Cloudflare receives technical information about the browser and the connection, including the IP address, in order to tell people from automated programs. Turnstile does not ask the user to solve puzzles and does not set cookies on the Website.

Some technical information is collected automatically on every visit, as described in the section on browsing data.

Purposes of the processing

Personal data is processed for the purposes listed below.

• To provide the services offered by the Controller through the Website.
• To reply to the requests sent by users.
• To produce aggregated statistics on the use of the Website.
• To improve the content and the ease of use of the Website.

Legal bases for the processing

Every processing activity described in this policy relies on one of the legal bases set out in article 6 of the GDPR.

• To provide the services requested and to handle the requests sent through the contact forms.
• With the user's consent, for cookies other than technical ones, such as the statistics cookies of Google Analytics. Consent is freely given and can be withdrawn at any time: processing carried out before the withdrawal remains lawful.
• For the legitimate interest of the Controller in keeping the Website secure, preventing abuse and understanding how the pages are used.
• To comply with a legal obligation, when a law or a request from the Authorities requires data to be kept or disclosed.

Your rights

At any time the user may exercise the rights set out in articles 15 to 22 of the GDPR.

• Access their own data and know why it is processed, which categories of data are involved and to whom it may be disclosed.
• Know how long the data will be kept, where it comes from if they did not provide it themselves, and whether any automated processing takes place, including profiling.
• Ask for their data to be corrected or erased, the so-called right to be forgotten, or ask for the processing to be restricted.
• Object to the processing on legitimate grounds.
• Receive their data in a readable format and transfer it to another controller.
• Know whether the data is transferred outside the European Union and under which safeguards.
• Receive a copy of their data. For copies after the first one the Controller may charge a contribution towards administrative costs, provided the request does not affect the rights of other people.
• Withdraw consent at any time. Processing carried out before the withdrawal remains lawful.
• Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if they believe the processing breaches the law. The contact details of the Authority are published on www.gpdp.it

To exercise these rights it is enough to write to the Controller at direzione@caterinalostia.com. A reply is provided within one month. If the request is complex the deadline may be extended, and in that case the user is informed.

How long data is kept

Personal data is kept for as long as it is needed to achieve the purposes for which it was collected.

Contact details collected through the forms on the Website are kept for the time needed to handle the request. If the request leads to a contract, the ten-year period required by tax law applies.

Data processed on the basis of consent is kept until that consent is withdrawn.

At the end of the retention period the data is deleted or made anonymous.

Processing of data and consent

Where processing is based on consent, that consent is collected through an explicit choice made by the user, for example by ticking a box or pressing a button.

Should the data be needed in future for purposes not described in this policy, the Controller will ask for a new, specific consent.

Where data is processed

The processing of data connected with the services provided through this Website takes place at the Controller's premises and on the server that hosts the Website, managed by Escamotages s.r.l.

Data is processed within the European Union. Some providers used by the Controller, namely Google for email (Google Workspace) and for the statistics of Google Analytics, and Cloudflare for the Turnstile anti-spam verification, may process data outside the European Union, in particular in the United States: in that case the transfer takes place under the EU-U.S. Data Privacy Framework or on the basis of the Standard Contractual Clauses approved by the European Commission.

Sharing and disclosure of data

Data is processed by the Controller or by authorised collaborators bound by confidentiality, pursuant to article 28 of the GDPR.

Where strictly necessary, data may be made available to third parties acting as processors, and used by them for the sole purpose of providing the services requested by the user: in particular Escamotages s.r.l., which manages the server hosting the Website, Google Ireland Limited, which provides the email service (Google Workspace) and Google Analytics, and Cloudflare, Inc., which provides the Turnstile anti-spam verification used by the contact forms.

At the request of the Authorities, data may be made available to the judiciary or to the police in order to establish liability in the event of computer crimes against the Website or offences committed through the Website.

Types of data processed

In order to reply to requests and to provide the services offered through its Website, the Controller may process certain types of personal data.

Personal data is any information that makes a person identifiable, such as first name and surname, address, tax code, email address and telephone number.

Browsing data

The computer systems and the software procedures behind this Website acquire, during their normal operation, certain personal data whose transmission is implicit in the way the Internet protocols work.

Every time the user visits this Website and every time a piece of content is requested, the access data may be recorded.

The data recorded may include the website the page was requested from, the user's IP address, the date and time of the request, the browser used with its technical characteristics, the operating system, the request sent by the browser or another client in the form of URI (Uniform Resource Identifier) addresses, the technical code of the HTTP response returned by the server and the amount of data transmitted.

This data is used by the Controller for the sole purpose of checking that the Website works properly and keeping it secure. The server logs that contain it are kept for about five weeks and then deleted.

Links to other websites

The Website contains links to other websites and to third-party services, such as Google Calendar to book a call and WhatsApp to send a message. When the user follows these links, any data provided is processed by those providers under their own privacy policy.

The Controller is not responsible for the content and the privacy practices of third-party websites.

What cookies are

A cookie is a small text file that websites save on the visitor's computer or mobile device.

Thanks to cookies, a website remembers the visitor's actions and preferences, for example login, language, font size and other display settings.

Technical cookies

Technical cookies are those used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or strictly necessary for the provider of an information society service explicitly requested by the user to deliver that service, pursuant to article 122, paragraph 1, of the Italian Privacy Code.

They are not used for any further purpose and are normally installed directly by the Controller or by the website manager.

Technical cookies can be divided into browsing or session cookies, analytics cookies treated as technical cookies where they are used directly by the website manager to collect information in aggregate form, and functionality cookies, which let the user browse according to selected criteria in order to improve the service provided.

Profiling cookies

Profiling cookies are used to track the user's browsing across the network and to build profiles of their tastes, habits, choices and preferences.

Through these cookies, advertising messages in line with the preferences shown by the user while browsing online may be delivered to their device.

The technologies actually present on this Website, with their purpose and duration, are listed in the table below.

Cookies used on this website

The cookies present on the website are listed in the following table:

Strictly necessary

Analytics

Managing cookies

Cookies other than technical ones are installed only after the user has given consent.

Cookie preferences can be changed or withdrawn at any time through the Cookie preferences link at the bottom of every page of the Website.

Change cookie preferences

Cookies can also be blocked or deleted from the browser settings.

Blocking technical cookies limits some features of the Website.

Changes to this policy

The Controller may update this policy to reflect changes in the law or in the services offered through the Website.

The version published on this page is always the one in force.