Privacy Policy
Introduction
This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and the applicable Italian legislation on the protection of personal data (Legislative Decree 196/2003, as amended).
It describes the methods and purposes of processing the personal data of users who visit and interact with the InPasta website and with the related digital services, including the Augmented Reality tutorial web app "The Secret Fold."
The website and services are operated by InPasta di Romagnoli Carlo Alberto, a sole proprietorship based in Italy.
This Privacy Policy applies exclusively to data collected through:
- the website inpasta23.com
- contact and information request forms
- booking and participation in in-person cooking classes
- purchase of and access to digital AR tutorials ("The Secret Fold")
Data Controller
InPasta di Romagnoli Carlo Alberto
Registered office: Via Sinistra Guerro 24/C, 41014 - Castelvetro di Modena (MO), Italy
Contact email: info@inpasta23.com
Categories of Personal Data Collected
Data provided voluntarily by the user
We may collect personal data provided directly by the user, such as:
- first and last name
- email address
- phone number
- information included in messages or direct communications
Such data is collected through:
- contact forms
- requests to book in-person classes
- direct email communications
Data related to in-person classes
In the case of registration for or participation in in-person cooking classes, we may process:
- identification and contact details
- information necessary for class organization
- data required for issuing fiscal documents
Data related to "The Secret Fold" (web AR tutorial)
For access to the Augmented Reality tutorials:
- no user accounts are created
- no passwords are required
- no personal data is collected during use of the AR tutorial
During the purchase or issuance of an access code, the following data may be processed:
- email address
- transaction identifier
- associated access code
The access code is used solely to enable access to the digital content.
Payment data
Payments are processed through secure third-party platforms (e.g. PayPal Business or equivalent providers).
- InPasta does not store credit card or payment instrument details
- Only essential information is retained for administrative and accounting purposes (transaction ID, amount, email)
Browsing and technical data
While browsing the website, the following data may be collected automatically:
- IP address
- browser and device type
- pages visited
- date and time of access
Such data is collected through cookies and system logs and is not used to directly identify the user.
Purposes of Processing and Legal Bases
| Purpose | Legal basis |
|---|---|
| Responding to contact requests | Consent / pre-contractual measures |
| Management of in-person classes | Performance of a contract |
| Providing access to "The Secret Fold" | Performance of a contract |
| Fiscal and accounting obligations | Legal obligation |
| Website usage statistics | Consent (cookies) |
| Security and abuse prevention | Legitimate interest |
(Article 6 GDPR)
Cookies and Tracking Tools
The website uses:
- technical cookies (necessary for proper operation)
- analytics cookies (subject to consent), including Google Analytics (with IP anonymization)
- marketing cookies (subject to consent), including Meta Pixel (Facebook / Instagram)
Cookies are activated only after explicit user consent via a banner. Users may manage or withdraw their consent at any time.
Data Retention
Personal data is retained only for as long as necessary:
- contact requests: up to 12 months
- data related to classes and purchases: as required by law (up to 10 years)
- marketing data: until consent is withdrawn
- analytics data: according to provider settings (e.g. 14 months for Google Analytics)
No permanent user profiles are created.
Processing of Minors' Data
The services offered are not intended for individuals under the age of 16. InPasta does not knowingly collect personal data from minors without verifiable parental consent. If such data is inadvertently collected, it will be deleted immediately.
Transfer of Data Outside the EU
Some service providers (Google, Meta, PayPal) may process data outside the European Union.
In such cases, data transfers are carried out in compliance with the GDPR through:
- Standard Contractual Clauses (SCCs)
- EU-US Data Privacy Framework (where applicable)
- additional security measures (e.g. encryption)
Data Subject Rights
Users may exercise at any time the rights provided under Articles 15-22 GDPR, including:
- access
- rectification
- erasure
- restriction
- objection
- withdrawal of consent
Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
To exercise your rights, email: info@inpasta23.com
Subject line: "Privacy Request"
Changes to the Privacy Policy
This privacy notice may be updated over time. Significant changes will be communicated through the website or other appropriate channels.