Privacy Policy

1. Data controller

The controller of personal data processing is Davide Cosmai, who can be reached at the email address d.cosmai@gmail.com.

2. Data collected and purposes

2.1 Contact form

Through the form on this site we collect the following personal data: first and last name, city, phone number, email address, website and Instagram and Facebook profiles (optional), objective, channels already used, monthly advertising spend range, project description. This data is processed solely to respond to the consulting request and isn't used for marketing purposes without additional explicit consent. If you have given consent to marketing cookies, on submission your name, email address and phone number are also transmitted to OpenAI in encrypted form (SHA-256 hash, not reversible), from the browser and from our server: see section 2.4. Under the same consent, your email address and phone number are also transmitted in encrypted form to TikTok from our server: see section 2.5. All three platforms are also sent a figure in euro, not encrypted, derived from the spend range you indicated: it is how they tell a large request from a small one.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

2.2 Free course access form

To request access to the free courses we collect: name, email address, mobile number (optional), professional role, city, a description of the business and the audience it serves, monthly advertising spend range, and a free-text description of the problem, along with the course requested and the address of the page the request was sent from. This data is processed to assess the access request, decide whether the course suits the person asking, and communicate the outcome. It is not shared with third parties for commercial purposes. If you have given consent to marketing cookies, on submission your name, email address and phone number are transmitted to Meta in encrypted form (SHA-256 hash, not reversible) together with the course requested and the spend range indicated, in order to measure the effectiveness of advertising campaigns. Under the same consent, on submission the same data is also transmitted in encrypted form to OpenAI, from the browser and from our server: see section 2.4, and to TikTok from our server, where the email address, phone number and browser identifier travel in encrypted form: the name does not leave here, while the course requested can be read in the page address, which travels with the event. See section 2.5. Without that consent nothing is transmitted to any of them.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The separate consent to receive new courses and content by email is optional and can be withdrawn at any time by writing to the controller.

2.3 Cookies and tracking (Meta Pixel)

Subject to the user's explicit consent, this site uses the Meta Pixel (provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) to measure the effectiveness of advertising campaigns and, if enabled by the user in Meta's settings, to show personalized ads on Facebook and Instagram.

The Meta Pixel collects behavioral data relating to browsing on the site (pages visited, actions taken) and can correlate that data with the user's Meta profile if they're logged in to Meta services.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The Pixel is activated only after consent has been obtained through the cookie banner on the site.

2.4 Cookies and tracking (ChatGPT Ads pixel)

Subject to the user's explicit consent, this site uses the ChatGPT Ads measurement pixel, provided by OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland), which is the data controller for people residing in the European Economic Area. It measures how many visits and requests come from ads shown inside ChatGPT. The pixel records pages viewed and actions taken, keeps in its own cookies the click reference OpenAI appends to the landing address (__oppref) and its own browser identifier (__obref), and transmits the page address and the time of the event to OpenAI.

Automatic advanced matching is enabled on this pixel, which OpenAI turns on by default. When you submit a form, the pixel detects the filled fields on its own: first name, last name, email address and phone number are turned into an encrypted fingerprint (SHA-256 hash, not reversible) inside your browser before being transmitted, so OpenAI does not receive those values in the clear; any country, city, region and postal code are instead provided in the clear. The option is governed from OpenAI's advertising panel, not from these pages. Under the same consent the conversion is also sent to OpenAI from our server (Conversions API): it leaves after the form is submitted and carries the same encrypted identifiers, plus IP address and browser, so that a blocked pixel does not make a conversion disappear.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The pixel is activated only after consent given through the cookie banner; on withdrawal it is told to stop, deletes its own cookies and sends no further events.

2.5 Cookies and tracking (TikTok pixel)

Subject to the user's explicit consent, this site uses the TikTok pixel to measure how many visits and how many requests come from ads published on TikTok. The pixel sends the page view and, if you submit a form, the request sent, together with the page address, the IP address and browser information. Our code passes no contact details to the pixel, but the pixel takes them itself: on this pixel TikTok keeps automatic advanced matching switched on, which recognises the form fields and, when you submit, transmits the email address and phone number turned into an encrypted fingerprint (SHA-256 hash, not reversible) inside your browser, so TikTok does not receive those values in the clear. Measured on this site. The option is governed from TikTok's advertising panel, not from these pages. TikTok may also use this data to create audiences and choose who sees the ads, to personalise ads and other content, and to match the encrypted contact details to the corresponding TikTok accounts: clause 3.1 of its advertising product data terms lists all of it.

For people in the European Economic Area, the United Kingdom and Switzerland, the data collected by this pixel is processed by TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) together with TikTok Information Technologies UK Limited. For this processing TikTok is a joint controller with us, not merely a supplier: it is set by clause 3.1 of Part B of TikTok's jurisdiction specific terms, and clause 4.4 of the same part is the one that assigns it the rights below. It means TikTok answers directly for the rights under Articles 15-21 GDPR over the data it processes, and that the legal bases it relies on are its own: you will find them in TikTok's privacy policy for the European Economic Area.

Under the same consent the conversion is also sent to TikTok from our server (Events API): it leaves after a form is submitted and carries the email address and phone number turned into an encrypted fingerprint (SHA-256 hash, not reversible) before leaving here, so TikTok does not receive those values in the clear, together with the IP address, the browser and the identifiers the pixel wrote. It travels with the same event identifier as the one sent from the browser, so TikTok recognises it as the same fact and does not count it twice.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The pixel is activated only after consent is given through the cookie banner; on withdrawal it is told to stop and to stop using cookies, and the cookies it wrote on this domain are deleted; if the pixel script was still on its way, the deletion is repeated shortly after.

2.6 Newsletter sign-up

From the form on the blog pages you can sign up to the newsletter. In that case we collect your full name, email address, phone number, city and, if you choose to say, what you do for a living: the job is optional, the rest is not. We also collect the address of the page the sign-up came from, which is what reconstructs where and when you gave consent; as with every other form on the site, Netlify also records the IP address the submission comes from. City and job stay in our own records and are not passed on to the service I send the emails with; for the city, though, see the note on the pixels below. A sign-up is not an advertising conversion: no event leaves our server towards Meta, OpenAI or TikTok, and no advertising identifier leaves that form. If you have consented to marketing cookies, however, the automatic advanced matching of the OpenAI and TikTok pixels stays on, and those pixels recognise the filled fields by themselves: in that case the name, the email address and the phone number may be transmitted to them as an encrypted fingerprint (SHA-256 hash, not reversible) straight from your browser, while the city is among the fields those pixels expect in the clear. It happens without our code handing anything over. See sections 2.4 and 2.5. Without that consent the pixels are not even loaded. The address goes into the contact list we keep on Brevo, the service I send the emails with (see section 3), and is used only to send you the new blog posts.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The form serves the newsletter alone and says so inside the box, under the button, so submitting it is the consent. You can withdraw it at any time from the link at the bottom of every email, or by writing to the controller.

2.6 bis The “Have your say” page (live event)

From the live-event page, which you reach only through the link I send by email, you can tell me which city you would set out from for a day in person, what interests you about that day, on which topics and, if you like, a line in your own words. We collect the answers, city included, tied to the email address you used to request a course, and the address of the page the submission came from; as with every other form on the site, Netlify also records the IP address. The answers serve only to choose the city and the programme of the event. It is not an advertising conversion: no event leaves our server towards the advertising platforms, and no advertising identifier leaves that form. If you have consented to marketing cookies, however, the automatic advanced matching of the OpenAI and TikTok pixels stays on, and those pixels recognise the filled fields by themselves: in that case the email address may be transmitted to them as an encrypted fingerprint (SHA-256 hash, not reversible) straight from your browser, while the city is among the fields those pixels expect in the clear. See sections 2.4 and 2.5. Without that consent the pixels are not even loaded.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The form serves only to organise the day and says so under the button, so submitting it is the consent. You can withdraw it at any time by writing to the controller.

2.7 Cookies and tracking (Google Analytics 4 and Google Ads)

Subject to the user's explicit consent, this site uses Google Analytics 4, a statistics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It counts visits and shows which pages are read and where people come from. The script records page views, scrolling, clicks to other sites, file downloads and, on forms, the start of filling and the submission, not the data entered; it transmits to Google the page address, the time, browser information and the IP address: for visitors from the European Union, Switzerland or the United Kingdom, Google states it uses it to derive an approximate location and discards it right after, without storing it; from other areas it may also use it to detect automated traffic and route requests. To recognise the same browser from one visit to the next it writes two cookies on this domain (_ga and _ga_8GLCLNM0ZT).

Our code passes no contact data to Google: from the forms only the fact that a request was sent arrives and, for the consulting request, the amount in euros derived from the spending bracket you indicated, not hashed. Google Signals, i.e. the use of Google account data for advertising, and ad personalisation are switched off by our code, not by a setting in the admin panel. The property is linked to our Google Ads account: requests sent through the forms (consulting and courses) are passed to Google Ads as conversions, to learn which ads generated them. No contact data travels: only the fact that a request was sent and, for consulting, the amount in euros. With consent to the "Targeting and advertising" purpose Google links the request to the ad clicked through the click identifier, kept in the _gcl_aw cookie; without that consent it writes no advertising cookies and the conversion only enters aggregate counts. We build no remarketing audiences: Google Signals and ad personalisation stay off. Google keeps event-level data for 14 months; after that only the aggregated report totals remain.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). The script is loaded only after consent to the "Measurement" purpose in the cookie banner; on withdrawal it is told to stop sending anything and the two cookies are deleted.

3. Data processors (third parties)

One clarification on the TikTok row: it appears in this table because it is a third party that receives data, but it is not a processor. For the data its pixel collects it is a joint controller with us, as explained in section 2.5.

4. Data transfers outside the EU

Some of the providers listed above (Netlify) are based in the United States. The transfer takes place in compliance with the safeguards provided for by the GDPR, in particular through Standard Contractual Clauses (SCC) approved by the European Commission. Meta Platforms Ireland is based in the EU and processes data in compliance with the European GDPR. OpenAI Ireland is also based in the EU, but OpenAI states that it processes data on servers located outside the European Economic Area, including the United States, relying on the European Commission's adequacy decisions and, where these do not apply, on Standard Contractual Clauses. Google Ireland Limited is based in the EU, but Google Analytics data may also be processed by Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. TikTok Technology Limited is also based in the EU, but its terms provide that data may be transferred to other group companies, including TikTok Pte. Ltd. in Singapore and TikTok Inc. in the United States, on the basis of the Standard Contractual Clauses approved by the European Commission.

5. Data retention

Data submitted through the contact form is retained for as long as necessary to handle the request and, in the absence of a subsequent contractual relationship, for a maximum of 12 months from receipt.

Data submitted through the course access form is kept for as long as needed to assess the request and manage course access and, absent further requests, for a maximum of 24 months from receipt. Where consent to receive new content by email is given, contact details are kept until that consent is withdrawn.

The answers left on the live-event page are kept until the city and the date are chosen, and in any case no longer than 12 months from receipt.

Data collected through the Meta Pixel is subject to Meta Platforms' retention policy. For detailed information see Meta's privacy policy.

Data collected through the ChatGPT Ads pixel is subject to OpenAI's retention policy. For detailed information see OpenAI's Europe privacy policy.

TikTok states that it retains the event data collected by the pixel for a maximum of 18 months: it says so in clause 6.2 of its advertising product data terms. The cookie durations given in the cookie policy are instead the ones the pixel actually sets, measured by loading it: TikTok declares longer ones, 13 months from the last date the cookie was used.

The email address left in the newsletter form is kept while consent stands, and in any case no longer than the newsletter itself exists. After withdrawal the address receives nothing further, but it is not deleted: it stays in our archive with consent switched off and on Brevo's suppression list, which is the only way to guarantee that a later import does not put it back in. You can ask for it to be deleted outright by writing to the controller.

6. Rights of the data subject

Under Articles 15-22 of the GDPR, you have the right to:

• Access — obtain confirmation that data concerning you exists and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request the deletion of your data ("right to be forgotten").
• Restriction — request the restriction of processing in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing for marketing or profiling purposes.
• Withdrawal of consent — withdraw the consent given at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal.

To exercise your rights write to d.cosmai@gmail.com. You also have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali, the Italian data protection authority (garanteprivacy.it).

7. Changes to this policy

This policy may be updated at any time. Substantial changes will be communicated through a prominent notice on the site. The "last updated" date at the top of the page indicates the version in force.