Privacy Policy

1. Data controller

The controller of personal data processing is Davide Cosmai, who can be reached at the email address d.cosmai@gmail.com.

2. Data collected and purposes

2.1 Contact form

Through the form on this site we collect the following personal data: first and last name, phone number, email address, website (optional), project description. This data is processed solely to respond to the consulting request and isn't used for marketing purposes without additional explicit consent.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

2.2 Free course access form

To request access to the free courses we collect: name, email address, mobile number (optional), professional role, a description of the business and the audience it serves, monthly advertising spend range, and a free-text description of the problem, along with the course requested and the address of the page the request was sent from. This data is processed to assess the access request, decide whether the course suits the person asking, and communicate the outcome. It is not shared with third parties for commercial purposes. If you have given consent to marketing cookies, on submission your name, email address and phone number are transmitted to Meta in encrypted form (SHA-256 hash, not reversible) together with the course requested and the spend range indicated, in order to measure the effectiveness of advertising campaigns. Without that consent nothing is transmitted.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The separate consent to receive new courses and content by email is optional and can be withdrawn at any time by writing to the controller.

2.3 Cookies and tracking (Meta Pixel)

Subject to the user's explicit consent, this site uses the Meta Pixel (provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) to measure the effectiveness of advertising campaigns and, if enabled by the user in Meta's settings, to show personalized ads on Facebook and Instagram.

The Meta Pixel collects behavioral data relating to browsing on the site (pages visited, actions taken) and can correlate that data with the user's Meta profile if they're logged in to Meta services.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The Pixel is activated only after consent has been obtained through the cookie banner on the site.

3. Data processors (third parties)

4. Data transfers outside the EU

Some of the providers listed above (Netlify) are based in the United States. The transfer takes place in compliance with the safeguards provided for by the GDPR, in particular through Standard Contractual Clauses (SCC) approved by the European Commission. Meta Platforms Ireland is based in the EU and processes data in compliance with the European GDPR.

5. Data retention

Data submitted through the contact form is retained for as long as necessary to handle the request and, in the absence of a subsequent contractual relationship, for a maximum of 12 months from receipt.

Data submitted through the course access form is kept for as long as needed to assess the request and manage course access and, absent further requests, for a maximum of 24 months from receipt. Where consent to receive new content by email is given, contact details are kept until that consent is withdrawn.

Data collected through the Meta Pixel is subject to Meta Platforms' retention policy. For detailed information see Meta's privacy policy.

6. Rights of the data subject

Under Articles 15-22 of the GDPR, you have the right to:

• Access — obtain confirmation that data concerning you exists and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request the deletion of your data ("right to be forgotten").
• Restriction — request the restriction of processing in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing for marketing or profiling purposes.
• Withdrawal of consent — withdraw the consent given at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal.

To exercise your rights write to d.cosmai@gmail.com. You also have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali, the Italian data protection authority (garanteprivacy.it).

7. Changes to this policy

This policy may be updated at any time. Substantial changes will be communicated through a prominent notice on the site. The "last updated" date at the top of the page indicates the version in force.