Privacy Policy

Last updated: September 2026

1. Data Controller

The data controller is Andrea Borgia, operating as Accademia Fiorentina di Affresco, based in Florence, Italy. For any privacy-related request, please contact: info@accademiafiorentinadiaffresco.it

2. Data Collected

Through the contact and application forms on this website, we collect the following personal data:

• Contact form: first name, surname, email address, message
• Application form: first name, surname, date and country of birth, nationality, address, document type and number, artistic background, preferred module

3. Purpose and Legal Basis

Personal data is processed exclusively for the following purposes:

• Responding to enquiries submitted via the contact form (legal basis: legitimate interest / consent)
• Processing and managing applications for the fresco course (legal basis: pre-contractual measures / consent)

Data will not be used for commercial, marketing, or profiling purposes, and will not be sold or transferred to third parties for their own purposes. Form submissions are transmitted and stored via our email and hosting provider, Aruba S.p.A., which acts as a data processor on our behalf.

4. Data Retention

Personal data will be retained only for the time strictly necessary to fulfil the purposes for which it was collected: enquiry data for up to 12 months, application data for up to 24 months from the date of submission or course completion.

5. Your Rights

Pursuant to Articles 15–22 of EU Regulation 2016/679, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure of your data (right to be forgotten)
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time, without prejudice to the lawfulness of processing carried out prior to withdrawal

To exercise any of these rights, please write to: info@accademiafiorentinadiaffresco.it

6. Cookies

This website does not use profiling or tracking cookies, and saves nothing in your browser. To know how many pages are viewed, we count visits on our own server without cookies: for each page view we record only the day, the page, the name of the website you came from (not the full address), the language of the page (Italian or English) and whether the device is a mobile or a desktop. The counter never records your IP address or any identifier, and these counts are not shared with third parties.

Server logs. Like any website, the servers of our hosting provider, Aruba S.p.A. (data processor on our behalf), automatically record technical data for each request, including the IP address, date and time, the page or file requested and the browser type. These logs are used only to run the site and protect it from abuse (legitimate interest, art. 6(1)(f) GDPR), are not used for our visit counts, and are kept for the period set by the provider's security procedures, after which they are deleted.

7. Complaints

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it.