This document describes the processing of personal data of users (hereinafter referred to as "Data Subjects") in the context of the use of this/these website/s or app/s (https://www.nipoitalian.com), in accordance with the provisions of Article 13 of Regulation (EU) No 2016/679 (hereinafter referred to as "Regulation") and the relevant legal provisions. The data will be processed following the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, integrity, and confidentiality. What is described in this document does not include cookies and other navigation tracking tools, for which please refer to the cookie policy.

Data Controller

The Data Controller is NIPO di Nicole Casadio, with its registered office at Via Fiumazzo, 857, Lugo (RA) - 48022, Tax ID/VAT IT02828060398 (hereinafter referred to as "Data Controller" or "Controller"). Data Subjects may contact the Data Controller or the Data Protection Officer (hereinafter referred to as DPO), if appointed, at the contact details provided in the "Contacts" section.

Purposes of Processing, Legal Basis, Nature of Provision, Consequences of Non-Provision, and Retention Period of Personal Data

The Controller processes the data provided by the Data Subjects for the purposes listed below.

Purposes of Processing	Appointment reminders
Description	The processing of data is necessary to receive the reminder for the completed booking.
Legal Basis	Consent of the data subject (art. 6 par. 1 lett. a)
Nature of Provision	The provision of data is optional
Consequences of Missing Consent	Failure to provide the data will result in the inability to send the reminder.
Retention Period	Until the withdrawal of consent.

Purposes of Processing	Request or schedule an appointment
Description	The processing of data is necessary to make the reservation request.
Legal Basis	Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
Nature of Provision	Providing the data is necessary for the conclusion of a contract.
Consequences of Missing Consent	Failure to provide the data may result in total or partial inability to respond to the submitted request.
Retention Period	6 months

Purposes of Processing	Return request
Description	The processing of data is necessary to manage the return request for purchased products or services.
Legal Basis	Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
Nature of Provision	Providing the data is necessary to fulfill a contractual obligation.
Consequences of Missing Consent	Failure to provide the data may result in total or partial inability to proceed with the return.
Retention Period	10 years

Purposes of Processing	Reviews/comments
Description	The processing is necessary to publish the review/comment
Legal Basis	Consent of the data subject (art. 6 par. 1 lett. a)
Nature of Provision	The provision of data is optional
Consequences of Missing Consent	The failure to provide data will only result in the inability to publish the review/comment
Retention Period	N.A.

Purposes of Processing	Download free material
Description	The processing is necessary to complete the download of the requested material.
Legal Basis	Performance of a contract or pre-contractual measures requested by the data subject (art. 6 par. 1 lett. b)
Nature of Provision	The provision of data is optional
Consequences of Missing Consent	Failure to provide the data will result in the inability to download the requested material.
Retention Period	N.A.

Processing Methods

The processing is carried out through manual and/or automated methods, including the use of IT and telematic technologies (e.g., CRM, management software, and mailing list services), after applying appropriate technical and organizational security measures to ensure the safety, integrity, and confidentiality of personal data, thereby minimizing the risks of destruction, loss, unauthorized access, modification, and unauthorized disclosure.

Any profiling via cookies is carried out only with the user's specific consent: more information is available in the cookie policy and/or the informational banner upon first access. User profiling carried out with tools other than cookies is described in the paragraph referring to the purposes of processing, where applicable.

Transfer of Personal Data outside the EU/EEA

The transfer of personal data to countries outside the European Union is carried out in full compliance with Articles 44 et seq. of Regulation (EU) 2016/679 (GDPR), ensuring the adoption of appropriate legal instruments, such as the existence of an adequacy decision by the European Commission, the signing of standard contractual clauses, or other appropriate safeguards provided for by applicable legislation.

Vendors

Vendor name	Description	Vendor Privacy Policy
Stripe		https://stripe.com/privacy/
Google Fonts		https://policies.google.com/privacy
Supabase	Autenticazione degli utenti e archiviazione dei dati dell'account e dei progressi di studio.	https://supabase.com/privacy
Anthropic	Elaborazione del testo inserito dall'utente nell'assistente "Ask Nipo" per generare risposte a fini didattici.	https://www.anthropic.com/legal/privacy
Creem	Gestione dei pagamenti per l'acquisto dell'app in qualità di Merchant of Record.	https://www.creem.io/privacy
Cal.com	Gestione delle prenotazioni delle lezioni e invio di conferme e promemoria.	https://cal.com/privacy

Data Subject Rights

At any time, the Data Subject may access their information and request its rectification, deletion, or integration, restriction of processing, or object to its processing where there are legitimate reasons, as well as data portability to another Data Controller (where applicable). They may also object in whole or in part to the processing and have the right not to be subject to automated decision-making processes concerning natural persons, including profiling. To exercise the rights set out in Articles 15-22 of the GDPR, the Data Subject may contact the Data Controller using the contact details provided in the "Contacts" section. The Data Controller is obliged to respond to the request within 1 month or communicate any delay in response in case of numerous and/or complex requests (the extension cannot exceed 2 months). In any case, the Data Subject always has the right to file a complaint with the competent Supervisory Authority (Data Protection Authority) if they believe that the processing of their personal data is contrary to the current legislation.

Contacts

To exercise the rights provided by the law and for more information about the processing of personal data, you can contact the Data Controller at their office or by email at: ciao@nipoitalian.com.