ALEXFANTINI.COM · INFORMAZIONI SUL SITO

Privacy notice

Last updated: 24 October 2026. This notice describes personal data processing through AlexFantini.com, AF System, the XStrike information catalogue and the Academy with its member area. The optional analytics described below operate only after activation and user consent.

1. Controller and contacts

The data controller is Alessandro Fantini, an individual, whose contact address is Via Guglielmo Marconi 18, Comacchio (FE), Italy. For personal data enquiries and to exercise your rights, write to privacy@alexfantini.com.

For general enquiries: info@alexfantini.com. To propose new workshops: workshops@alexfantini.com. For press and editorial projects: press@alexfantini.com. For technical support: webmaster@alexfantini.com.

2. What data we process and why

Browsing and security

Systems running the site may process the IP address, request date and time, requested page or resource, browser and device technical information, and operation outcomes. These serve to deliver pages, protect the site, diagnose errors and prevent abuse. The legal basis is the legitimate interest in service operation and security under Article 6(1)(f) GDPR, respecting users’ rights.

Email enquiries

We process your email address, name if provided and information you choose to send to answer enquiries, assess workshop proposals, manage press contacts and provide support. The legal basis is taking pre-contractual steps or providing the requested service where applicable (Article 6(1)(b)); for other professional or information enquiries, the legitimate interest in managing and following up correspondence (Article 6(1)(f)). These emails are not used for automatic newsletter subscriptions or promotional messages.

XStrike reservations without online payment

For XStrike reservations we process first name, surname, email, optional phone number, products, quantities, variants, delivery preference and optional notes. The request is linked to the account and a WooCommerce record; authorised staff handle it and may send service messages to the checkout email, even if it differs from the account email. We do not collect online payments. The legal basis is taking requested pre-contractual steps (GDPR Art. 6(1)(b)); security and abuse prevention rely on legitimate interests (Art. 6(1)(f)). Do not include special-category data or third parties' data in the notes.

Accounts, courses and progress

For authorised users we process account data, credentials protected by WordPress systems, course permissions and learning progress. These enable personal access, delivery of restricted content and resuming lessons. The legal basis is the requested service (Article 6(1)(b)), together with the legitimate interest in its security (Article 6(1)(f)). New registrations and online purchases are currently closed; existing accounts can log in according to their permissions.

Temporary page guestbook

If you use the guestbook, the pseudonym and message you send are intended for publication and can be read by page visitors. Submission is optional and at your request, after the public-visibility warning. Processing is based on the requested publication service (Article 6(1)(b)); anti-abuse checks and associated technical data are processed for security (Article 6(1)(f)). Do not include others’ personal data, confidential information or irrelevant content. You can request removal at privacy@alexfantini.com.

Usage analytics

With your consent we use Google Analytics 4 to measure page views, sections visited, traffic sources, general device characteristics, scrolling, time with the page visible, clicks to contacts and content, catalogue and course viewing, and video interactions. For internal search we measure use and result counts, without sending the free text entered.

These data include pseudonymous cookie identifiers, events and technical information; this does not automatically make them anonymous. The IP address is used to communicate with Google services as described by the provider. We do not send personal emails, passwords, names entered in forms or message content to Google Analytics. Login and account management pages and staff activities are excluded from the configured measurement. We do not enable Google Signals, User-ID identifiers, personalised advertising or screen session recordings.

The legal basis is consent (Article 6(1)(a)). Before consent, or if refused, the configured Analytics tag does not load. You may withdraw or change your choice at any time through Cookie preferences, at the bottom of each page. Withdrawal applies going forward and does not affect processing already lawfully carried out.

Storing privacy choices

A technical cookie stores independent choices for analytics and external videos. We also record a pseudonymous choice reference, notice version, decision and date. This dedicated record contains no IP address, email, user agent or Google Analytics identifier. The legal basis is compliance with consent and accountability obligations (Article 6(1)(c)). To prevent abusive requests, a temporary technical counter uses a reference derived from the IP through a keyed cryptographic function; it is not used to analyse browsing.

Participants’ photographs, video and voice

The site may show workshop images and recordings and teaching content, including editorial adaptations of original materials. Publication and use in the restricted course follow the information and permissions for each use. Merely attending an event does not replace those permissions. Image-related requests may be sent to the privacy contact; the controller will assess the case and applicable legal basis, including consent where required and other rights involved.

3. Providing data

Normal browsing requires technical data needed for the site to work. Sending email or guestbook contributions is optional; without the necessary data we may be unable to respond. Restricted content requires an authorised account. Analytics consent is optional and refusing it does not prevent viewing available content.

To submit an XStrike reservation, first name, surname, email and a delivery preference are required; phone and notes are optional. We cannot handle the request without the required information.

4. Recipients and providers

The controller and people assigned technical management, support and activity organisation may access data as needed and within their authorisations. We use hosting, email, backup and maintenance providers, including Aruba S.p.A., as well as analytics services provided by Google Ireland Limited and the Google entities involved in providing Analytics. Providers’ roles and obligations follow the applicable contracts and agreements.

WordPress, WooCommerce and Tutor LMS manage their respective site functions: their presence alone does not mean all user data are sent to their developers. Technical and maintenance providers may process data necessary for their assigned work. We do not sell personal data. Information may be disclosed to authorities or advisers where required by law or necessary to protect rights.

5. External services and international transfers

Links to YouTube and other external sites lead to services with their own notices. On the temporary page, the YouTube player and thumbnails load only after separate consent to the category External videos · YouTube. Loading sends technical data such as IP, browser and referring page to provide the content; the service may use cookies or local storage under its own rules. The legal basis for this optional integration is consent (Article 6(1)(a)). You can withdraw it in preferences and can always open the channel through a normal link. More in the Google/YouTube privacy policy.

Google Analytics and YouTube may involve processing outside the European Economic Area, including the United States. Google describes using the Data Privacy Framework for covered entities and processing, and standard contractual clauses where applicable. You can consult the transfer mechanisms declared by Google and the data processing terms. Account configuration and applicable agreements must remain consistent with the actual use of the service.

6. Retention

• Ordinary correspondence: for handling the enquiry and generally no longer than 24 months after closure, unless a relationship is ongoing, legal obligations apply or rights need protection.
• Prenotazioni XStrike: XStrike reservation data are kept to handle the request and any subsequent agreements. Requests closed without an agreement normally follow the general correspondence retention criterion (up to 24 months after closure), unless legal obligations or documented needs to protect rights require otherwise.
• Accounts and progress: for the duration of the service and authorised account; the controller periodically reviews retention needs and handles deletion requests, subject to applicable obligations.
• Guestbook: while the contribution remains relevant to the page and publication purpose, or until removal following an acceptable request.
• Cookie choice: six months, unless changed conditions require a new choice or the browser deletes it earlier.
• Consent record: 365 days from recording, with periodic automatic deletion. Technical anti-abuse counters last 10 minutes.
• Analytics: user- and event-level retention is set to 14 months, renewing the user-data period on new activity; Analytics cookies are limited to 12 months from their first issue by the tag configuration. Aggregated statistics may follow different retention rules. Collection is active only for those who consented to analytics.
• Images and recordings: according to authorised uses and while the editorial or teaching purpose remains current, with review of requests concerning individual materials.
• Technical data, security and backups: as needed for operation, incident management and recovery, according to the rotation cycles and terms of the technical services used. Backups are not used to resume promotional or analytics activities after deletion.

7. Rights and requests

Where GDPR provides, you may request access, rectification, erasure, restriction, portability and objection to processing, and withdraw consent. Write to privacy@alexfantini.com, identifying your request and the service concerned. We may ask for proportionate information to verify identity, without collecting unnecessary documents. We respond within statutory time limits.

You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or contact the competent court. We do not make solely automated decisions producing legal or similarly significant effects on a person.

8. Updates

This notice will be updated when relevant services, purposes or methods change. Changes requiring new consent are not authorised by previous choices. Cookie and preference details are in the Cookie Policy linked at the bottom of pages.