Privacy Policy

1. Data controller

The data controller is Maria Elena Cutino, graduate in Human Nutrition Sciences (Dottoressa in Scienze della Nutrizione Umana), Via Giuseppe Garibaldi 62, 90040 Isola delle Femmine (PA), Italy, VAT number 07281750823, email: info@culinarynutritionlab.it.

No Data Protection Officer (DPO) has been appointed, as this is not mandatory for the activities carried out.

2. What data we process

• Data you provide through the request form: first name, last name, email and phone (required); address, city, postal code, country and notes (optional); the products and consultations you select.
• Data you provide through the form on the Contact page: full name, email, subject and message text (all required).
• Data you provide by writing to the website's email addresses (info@culinarynutritionlab.it and, for enquiries about the Training courses, formazione@culinarynutritionlab.it): your email address, your name if you give it, and the content of your message. They are processed in the same way as messages from the Contact page.
• Technical browsing data: your IP address and other technical data automatically recorded by the hosting provider's systems for the operation and security of the website.
• An anonymous code used to limit repeated form submissions (spam protection): it is derived from your IP address but does not contain it, changes every day and is deleted after 24 hours.

The website does not ask for health data. Please do not include such data in the notes field or in your message: any specific needs (for example allergies, intolerances or health conditions) will be discussed during the consultation, with a dedicated privacy notice and, where necessary, your explicit consent (Article 9 GDPR).

3. Why we process your data and on what legal basis

• To handle your request and contact you to confirm products or consultations: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• To reply to messages sent through the Contact page: steps taken at your request prior to entering into a contract, where the message concerns our services, or the controller's legitimate interest in replying to communications received (Article 6(1)(b) and (f) GDPR). The same applies to messages sent to the website's email addresses.
• If you write to us selecting the subject "Training", we will also use your email to let you know, once only, when enrolment for the courses opens: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). You will not receive any other communications, and you can ask us at any time not to notify you.
• To perform any resulting contract and comply with tax and accounting obligations: performance of a contract and legal obligation (Article 6(1)(b) and (c) GDPR).
• To protect the website against abuse, spam and cyber attacks: the controller's legitimate interest in the security of the website and its systems (Article 6(1)(f) GDPR).
• To establish, exercise or defend legal claims: the controller's legitimate interest (Article 6(1)(f) GDPR).

Apart from the Training course notice described above, your data are not used to send you promotional communications or newsletters and are not passed on to third parties for their own purposes. We do not carry out profiling or make decisions based solely on automated processing.

4. Required data

First name, last name, email and phone are necessary to handle your request and contact you: without them the request cannot be sent. All other data are optional.

For messages from the Contact page, full name, email, subject and message text are necessary: without them we cannot reply to you.

5. Who we share your data with

Your data are processed by the controller and may be shared with the following providers, who process them on the controller's behalf as processors (Article 28 GDPR) under a data processing agreement:

• Vercel Inc. (United States): website hosting, processing of requests and storage of website images.
• Neon (United States): the database where requests and messages are stored, with servers located in Germany (Frankfurt, European Union).
• Aruba S.p.A. (Italy): management of the domain's email mailboxes (info@culinarynutritionlab.it and formazione@culinarynutritionlab.it).

Data may also be shared with the controller's advisers (for example the accountant) where necessary, and with public authorities where required by law. Your data are not disclosed to the public.

6. Transfers outside the European Union

Vercel and Neon are based in the United States, so some data may be processed in or accessed from the United States. These transfers are based on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for certified companies, and/or on the standard contractual clauses approved by the European Commission (Article 46 GDPR). You can request information about the safeguards in place by writing to the address in section 1.

7. How long we keep your data

• Requests and messages not followed by a contract: up to 24 months from the last contact.
• Requests to be notified about the Training courses: until the notice is sent, and in any case no longer than 24 months from the request.
• Data relating to concluded contracts and tax records: 10 years, as required by law (Article 2220 of the Italian Civil Code).
• Anonymous anti-spam code: 24 hours.
• Technical browsing data recorded by the hosting provider: for the limited period set by the provider.

At the end of these periods, data are deleted or anonymised.

8. Your rights

You can exercise the rights set out in Articles 15-22 GDPR at any time:

• access your data and receive a copy;
• have them corrected or completed;
• have them erased;
• restrict their processing;
• receive the data you provided in a structured, machine-readable format (portability);
• object to processing based on legitimate interest.

To exercise your rights, write to info@culinarynutritionlab.it. We will reply without undue delay and in any case within one month of your request (Article 12 GDPR).

9. Complaints to the supervisory authority

If you believe the processing of your data infringes the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

10. Cookies and other tools on your device

The website only uses technical tools necessary for it to work, which do not require consent (Article 122 of the Italian Privacy Code and the Italian Data Protection Authority's guidelines on cookies and other tracking tools of 10 June 2021):

• browser local storage ("cart"): keeps the products you selected in your cart until you send your request or empty the cart;
• technical session cookie ("admin-session"): used only in the website administrator's private area; it expires after 8 hours.

The website does not use profiling cookies, analytics cookies or third-party cookies. Fonts are served directly by the website, with no connection to external services.

11. Changes to this policy

This policy may be updated, for example when new services are added or the law changes. The date of the last update is shown at the top of the page.