Privacy policy

Last updated: 7 September 2026

This page explains what personal data I collect through the alessiazitoli.it website, why I collect it and what you can ask me to do with it. It is written pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Who processes your data

The data controller is Benedetto Zitoli, VAT number 03793090725, based at Via Umberto 230, 76125 Trani (BT).

• Email: info@alessiazitoli.it
• Phone: +39 0883 588902

No data protection officer has been appointed, as the cases provided for under Article 37 of the GDPR do not apply.

What data I collect

The data you send me through the form

When you fill in the enquiry form I collect: name, phone number, email address, the service you are interested in, the expected date of the birth, the ceremony or the party, what stage you are at, and the text of your message.

This is the data I need to give you a useful reply. The expected date and where you are with things help me understand what window of time we are working with: for a newborn session, it makes all the difference whether the baby has not been born yet or is already three weeks old.

The expected due date field may reveal information about a pregnancy, which the GDPR treats as a special category of data. I process it solely to organise the photography session, on the basis of the consent you give by sending the form, and I do not share it with anyone.

Data collected automatically

The server that hosts the site records, as any web server does, the IP address of whoever connects, the date and time of the request, the page requested and the browser type. These are used to make the site work and to detect misuse, and are kept for as long as necessary for these purposes.

What stays in your browser

The site saves an entry called lsz-consensi, in your browser's local storage, which remembers the choice made on the consent banner. It is not a profiling cookie, it does not travel to me and it does not identify anyone. You can find the detail in the cookie policy.

Why I process it, and on what legal basis

Purpose	Legal basis
Responding to your enquiry and preparing a quote for you	Steps taken at your request before entering into a contract (Art. 6.1.b GDPR)
Processing the expected due date and information about the pregnancy	Your explicit consent (Art. 9.2.a GDPR), which you can withdraw at any time
Carrying out the photography session, if you decide to book it	Performance of the contract (Art. 6.1.b GDPR)
Fulfilling tax and accounting obligations	Legal obligation (Art. 6.1.c GDPR)
Running the site and protecting it against misuse	Legitimate interest (Art. 6.1.f GDPR)
Publishing your photos on the site or on social media	Your written consent, separate and always revocable

Photographs, and especially those of children

The photographs I take during a session are personal data belonging to you and to whoever is pictured. I use them to deliver the finished work to you and for administrative obligations.

I never publish a photograph without written consent, and consent to publication is always separate from the contract: you can book a session and say no to publication, and nothing about it changes. For images depicting minors, the consent of both parents or of whoever holds parental responsibility is required.

Consent to publication can be withdrawn at any time by writing to info@alessiazitoli.it. Once withdrawn, I remove the images from the site and from the social media profiles I manage. Over copies already downloaded or shared by third parties I have no control, and it is only fair that you know this beforehand.

Who I share your data with

I do not sell or transfer your data to anyone. Only the following know it:

• the provider that hosts the site and the mailbox, appointed as data processor pursuant to Article 28 of the GDPR;
• the accountant and the consultants who handle tax matters, once you become a client;
• the printing labs, limited to the images required, if you order albums or prints;
• the authorities, if a law requires it of me.

Transfers outside the European Union

The data from the form stays on the European servers of the hosting provider.

If you give consent to third party content, the pages may load elements provided by companies based in the United States (for example, Instagram posts). In that case the transfer takes place on the basis of the European Commission's adequacy decisions or standard contractual clauses. Without your consent that content is not loaded and no data leaves at all.

How long I keep it

• Enquiries that do not turn into a booking: up to twenty four months from the last contact, then I delete them.
• Contractual and tax data: ten years, as required by law.
• Delivered photographs: I keep them for as long as needed to be able to redo a delivery, and in any case no longer than what was agreed with you. You can ask me to delete them sooner.
• Server logs: the technical time needed for security.

What you can ask me

At any time you can ask to access your data, to correct it, to delete it, to restrict its processing, to object to processing based on legitimate interest, and to receive the data in a machine readable format (portability). Where processing is based on consent, you can withdraw it whenever you like, without this affecting the validity of what was done before.

Write to info@alessiazitoli.it. I reply within one month.

If you believe that I am processing your data incorrectly you can lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it) or turn to the courts.

Is providing this data mandatory?

No, but without a name, a contact and a line about what you need I cannot reply to you. You can leave blank the fields not marked as mandatory: they only help me understand your situation better.

Automated decision making

I do not use any. I read and assess every enquiry myself.

Changes to this notice

If I change anything, I update the date at the top of the page. If the change concerns consent, the banner reappears and asks you to choose again.