Privacy Policy
This Privacy Policy explains which personal data may be processed when you use this website, for what purposes, on what legal basis, and what your rights are under Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller of your personal data is:
Giovanni Ceroni
For any question or request about privacy and the processing of your personal data, you can write via the Contact page.
2. What data we process
When you simply browse, the website does not ask for data that directly identifies you, except for the technical data strictly necessary to provide, protect and maintain the service, such as data generated when connecting to the hosting infrastructure.
Other personal data are collected only when you provide them voluntarily through the forms on the website.
Depending on the form used, the following data may be processed:
- first name and last name;
- email address;
- phone or WhatsApp number;
- information you voluntarily include in your messages or requests;
- preferences relating to a coaching request;
- rating and content of a review.
In particular, the website may use the following forms:
Newsletter — Name, if you choose to provide it, and email address, to send you news, content and communications about Giovanni Ceroni's books, articles and activities.
Free ebook — Name and email address, to handle your request and send you the ebook or free content you requested.
Video call booking — First name, last name, phone, email address and the topic you wish to discuss, to handle and organise the video call you requested.
Coaching request — First name, last name, phone, email, the type of coaching path you are interested in and any additional notes, to assess your request, contact you and, where appropriate, propose a path suited to your needs.
Contact form — First name, last name, email, mobile, WhatsApp and the content of your message, depending on the data you choose to provide, to reply to your request.
Reviews — Name, email, rating and the text of the experience you choose to share. The email address is never published. Your name, rating and review may be published only after review and only if you have expressly authorised their publication.
3. Purposes and legal bases of processing
Your data are processed only for the purposes connected with the action you requested. The legal bases may vary depending on the service used.
Newsletter — Purpose: sending you news and communications about the website's content, books and activities. Legal basis: your consent, under Article 6(1)(a) GDPR. You can withdraw this consent at any time.
Free ebook — Purpose: handling your request and sending you the requested content. Legal basis: your consent, Article 6(1)(a) GDPR, where expressly requested through the form.
Video call booking — Purpose: handling your request, contacting you and organising the video call. Legal basis: steps taken at your request prior to a possible contract, under Article 6(1)(b) GDPR.
Coaching request — Purpose: assessing your request, contacting you and, where appropriate, proposing a possible coaching path. Legal basis: pre-contractual steps requested by you, under Article 6(1)(b) GDPR.
Contact requests — Purpose: replying to and handling the communication you started. Legal basis: depending on the nature of the request, steps taken at your request (Article 6(1)(b) GDPR) or the controller's legitimate interest in replying to communications received (Article 6(1)(f) GDPR).
Reviews — Purpose: receiving, handling and, if you have expressly authorised it, publishing the review you chose to share. Legal basis for publication: your consent, under Article 6(1)(a) GDPR. Authorisation to publish is requested specifically and separately.
4. Mandatory and optional data
Fields marked as mandatory in each form are needed to handle the relevant request correctly. If you do not provide them, we may not be able to provide the requested service or reply properly. Fields not marked as mandatory are optional.
We recommend not entering in free-text fields any personal information that is not needed for the purpose of your request.
5. Providers and recipients of data
To provide certain technical services, some data may be processed by providers acting on behalf of the controller or involved in delivering the service.
Netlify — The website is hosted using services of Netlify, Inc. and uses Netlify features for the technical handling of certain forms. When acting on behalf of the controller, Netlify processes data as a processor under the applicable contractual terms.
Google Analytics — If you consent to analytics cookies, the website uses Google Analytics to obtain statistics on how the website is used. For users located in the European Economic Area, the services are provided under the applicable contractual framework by Google group companies, including Google Ireland Limited. Google Analytics is not loaded for analytics purposes until you have given the relevant consent.
We do not sell or rent your personal data and do not pass them on to third parties for their own advertising purposes.
6. Cookies and analytics tools
The website uses Google Analytics only after you have given your consent through the cookie banner. Until you accept analytics cookies, Google Analytics is not activated for this purpose.
You can accept or refuse analytics cookies from the banner shown on your first visit and change your choice later through the “Cookie preferences” link on the website. For detailed information on the cookies and similar technologies used, see the Cookie Policy.
7. How long we keep data
Personal data are kept for as long as needed to achieve the purpose for which they were collected. In particular:
- data relating to contact, video call or coaching requests are kept for as long as needed to handle the request and then for the period needed to comply with any legal obligations or to protect the controller's rights;
- data used for consent-based communications are kept until you withdraw your consent or ask for deletion;
- data relating to published reviews may be kept while the review remains published, unless consent is withdrawn where consent is the legal basis, or unless another legal basis justifies keeping them.
At the end of the applicable periods, data are deleted or, where appropriate, anonymised.
8. Transfers of data outside the European Economic Area
Some of the providers used by the website belong to groups established, or with infrastructure located, also outside the European Economic Area.
Netlify — The website is hosted using services provided by Netlify, Inc., a company based in the United States, which may process technical data and data submitted through the website's forms as part of its hosting and form-handling services.
Netlify, Inc. states that it is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), established by the U.S. Department of Commerce as a recognised mechanism for certain transfers of personal data from the European Economic Area to the United States.
For transfers not covered by an adequacy decision or by the Data Privacy Framework, Netlify also states that it uses, where necessary, further safeguards provided by applicable law, including the Standard Contractual Clauses approved by the European Commission.
Up-to-date information on the mechanisms Netlify uses for international transfers is available in its privacy statement and in the provider's official documentation.
Netlify's certification under the EU-U.S. Data Privacy Framework concerns only the legal framework applicable to certain international transfers of personal data. That certification does not, in itself, entail or demonstrate the website's overall compliance with the GDPR. The compliance of processing carried out through the website depends on all the measures adopted by the controller, the purposes pursued, the legal bases used, the relationships with providers, the technical and organisational measures adopted and compliance with the other obligations under applicable law.
Google — If the user consents to the use of analytics tools, the website may use services provided by the Google group, including Google Analytics. For users located in the European Economic Area, the services are generally provided under the applicable contractual framework by Google Ireland Limited.
Where data are transferred to countries outside the European Economic Area, Google states that it uses the mechanisms provided by applicable law, including, where necessary, adequacy decisions, standard contractual clauses and other instruments recognised by the GDPR.
Google Analytics is activated only after the user has given consent through the cookie preference management system. Up-to-date information on international transfers and the safeguards adopted by Google is available in its privacy and contractual documentation.
9. Your rights
Under Articles 15 to 22 GDPR, you may exercise, where applicable, the following rights:
- access to your personal data;
- rectification of inaccurate or incomplete data;
- erasure of your data;
- restriction of processing;
- objection to processing;
- portability of your data, where applicable.
Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
To exercise your rights or ask for information about the processing of your data, you can use the Contact page. We may ask for additional information where needed to reasonably verify the identity of the person exercising the right.
10. Right to lodge a complaint
If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with a supervisory authority. In Italy you can contact the Garante per la Protezione dei Dati Personali. If you live in another EU Member State, you can also contact the competent data protection authority in your country.
11. Data security
Reasonable and proportionate technical and organisational measures are adopted to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. However, no system connected to the Internet can guarantee absolute security.
12. Changes to this Policy
This Privacy Policy may be updated when the website's features, the services used or applicable law change. The date of the last update is shown at the top of this page.