This notice explains how personal data provided through the booking service available on giuliomarinelli.com is processed and is provided pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR").
For information concerning website browsing, cookies, similar technologies, analytics and measurement tools, please see the Privacy and Cookie Policy.
1. Data Controller
The Data Controller is:
Giulio Marinelli
VAT No. 03198070306
Website: giuliomarinelli.com
Email: privacy@giuliomarinelli.com
Requests concerning personal data processing or the exercise of data protection rights may be sent to the email address above.
2. Scope of this Notice
This notice applies to personal data processed in order to allow users to:
- view available appointment times;
- request a call booking;
- choose between Microsoft Teams and a telephone call;
- receive communications necessary to manage the appointment;
- modify or cancel the booking, where applicable;
- attend the requested call.
The booking service is intended to provide an initial contact concerning the professional services presented on the website.
3. Personal Data Processed
The booking service processes only the information necessary to manage the request.
3.1 Information provided by the user
The following information is processed:
- first name;
- email address;
- selected contact method;
- selected date and time;
- telephone number and international dialling code, only where a telephone call is selected.
The booking form does not request, unless subsequently required for another purpose:
- surname;
- company or organisation;
- professional role;
- information about the user's business;
- detailed descriptions of the user's needs;
- special categories of personal data within the meaning of Article 9 GDPR.
3.2 Information generated by the system
The booking system may additionally process:
- booking identifier;
- booking status;
- selected language;
- date and time at which the request was created or modified;
- version of the privacy notice presented to the user;
- date and time at which the notice was acknowledged.
The technical infrastructure may also process information strictly necessary to receive the request, secure the service and prevent abuse, including IP addresses, HTTP request information and technical signals concerning the connection or device.
4. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Checking availability and registering the booking | Steps taken at the data subject's request prior to entering into a contract — Article 6(1)(b) GDPR |
| Communicating with the user about the booking | Steps taken at the data subject's request prior to entering into a contract — Article 6(1)(b) GDPR |
| Arranging and conducting the call through the selected method | Steps taken at the data subject's request prior to entering into a contract — Article 6(1)(b) GDPR |
| Managing changes, cancellations or booking-related issues | Steps taken at the data subject's request prior to entering into a contract — Article 6(1)(b) GDPR |
| Protecting the service against abuse, automated requests or unlawful use | Controller's legitimate interest in securing the service — Article 6(1)(f) GDPR |
| Compliance with applicable legal obligations | Legal obligation — Article 6(1)(c) GDPR |
Information collected through the booking form is not used to send unsolicited newsletters or marketing communications.
5. Provision of Personal Data
Requesting a call is optional.
However, the following information is required in order to complete a booking:
- first name;
- email address;
- contact method;
- selected date and time.
A telephone number is required only where a telephone call is selected.
Failure to provide the required information makes it technically impossible to complete the booking.
Acknowledging this Privacy Notice records that information about the processing has been made available to the user. It does not constitute consent to the processing required to manage the booking, which is based on Article 6(1)(b) GDPR.
6. Processing and Recipients
Personal data is processed through electronic and IT systems and is used only to the extent required to manage the booking and related communications.
Within the limits of their respective functions, information may be processed by technical service providers including:
- Cloudflare, Inc., for web infrastructure, server-side functions, databases, queues, security, Cloudflare Turnstile and application services;
- Resend, for sending email messages necessary to confirm and manage the booking;
- Microsoft, where Microsoft Teams is selected for the call.
Information may also be disclosed to public authorities or other entities where required by law.
Personal data is not sold to third parties.
Cloudflare Turnstile
The booking page uses Cloudflare Turnstile to distinguish legitimate requests from automated traffic and prevent spam and abuse.
Turnstile may process technical signals relating to the browser, device and connection in order to perform this verification. This information is used for security purposes and is not used by the Controller for advertising or commercial profiling.
Further information:
Cloudflare Data Processing Addendum
Microsoft Teams
Where Microsoft Teams is selected, information strictly necessary to arrange the meeting may be used to prepare and communicate the meeting link.
Subsequent use of Microsoft Teams is also subject to Microsoft's applicable terms and privacy information.
Microsoft Privacy Statement:
https://www.microsoft.com/privacy/privacystatement
Email delivery
Booking-related email messages are processed through a technical email delivery service.
These communications may contain the information necessary to identify and manage the appointment, including the user's name, email address, selected contact method, appointment date and time and, where necessary, telephone number.
Information about Resend's processing:
https://resend.com/legal/privacy-policy
7. International Data Transfers
Some service providers belong to international groups and may process personal data outside the European Economic Area.
Where applicable, such transfers are carried out using the mechanisms provided for under Chapter V GDPR, including adequacy decisions, frameworks recognised by the European Union, Standard Contractual Clauses approved by the European Commission and any additional safeguards required by applicable law.
Further information about the mechanisms used by individual providers is available in their respective privacy notices and data processing terms.
8. Retention
Information relating to a booking and directly related communications is retained for as long as necessary to:
- arrange and conduct the call;
- manage subsequent communications directly connected with the request;
- appropriately document the management of the appointment.
Where no subsequent contractual relationship is established, such information is normally retained for no longer than 12 months after the last meaningful contact.
Where the call results in a contractual or professional relationship, information required to manage that relationship may be retained for a longer period in accordance with the legal bases and retention requirements applicable to the new purpose.
Information may also be retained for a longer period where required to comply with a legal obligation or to establish, exercise or defend legal claims.
9. Analytics, Google Ads and Booking Data
The booking service does not depend on consent to analytics or measurement tools.
Where the user has separately consented to analytics and measurement through the cookie banner, the website may record events relating to the booking journey, including successful completion of a booking, through Cloudflare Zaraz, Google Analytics 4 and Google Ads measurement tools configured on the website.
These events are not configured to transmit the user's name, email address, telephone number, booking code or form contents.
Refusing or subsequently withdrawing consent to analytics does not affect the ability to book or attend a call.
For more information, see the Privacy and Cookie Policy.
10. Automated Decision-Making and Profiling
Information submitted through the booking service is not used to make solely automated decisions producing legal or similarly significant effects on the user.
The information entered in the booking form is not used for profiling.
Automated controls may be used solely for technical, security and abuse-prevention purposes.
11. Data Subject Rights
Where provided for under the GDPR, data subjects may exercise their rights under Articles 15–22, including the right to:
- obtain confirmation as to whether their personal data is being processed;
- access their personal data;
- request rectification;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests where the applicable requirements are met;
- exercise the right to data portability where applicable.
Requests may be sent to:
Data subjects also have the right to lodge a complaint with the competent supervisory authority. In Italy, the supervisory authority is the Garante per la protezione dei dati personali:
https://www.garanteprivacy.it/
12. Changes to this Notice
This Notice may be updated where the booking service, the information requested, the service providers used or applicable legal requirements change.
The date of the latest update is shown at the beginning of this document.