Privacy Policy

1. Data Controller

The data controller is Praxis 3 S.r.L., registered office at Via Nomentana, 251, 00161 Rome, Italy. VAT / Tax No.: 01434870661. Country of establishment: Italy (European Union).

For any request regarding the processing of personal data or to exercise the rights provided under applicable law, data subjects may contact the Controller at:

• Email: privacy@praxis3.it
• PEC (certified email): prx3@legalmail.it

EU Representative: Not applicable, as the Controller is established within the European Union.

Data Protection Officer (DPO): Not appointed, unless otherwise communicated by the Controller.

2. Types of Data Processed

During the use of the site, the following categories of personal data may be processed:

• Technical access data: HTTP method, request URL (without query string), response status code, server response time. The visitor's IP address is not recorded in the application logs.
• Contact form data: name, email address, subject and message text, voluntarily provided by the user.
• Comment data: name (nickname) and comment text, voluntarily provided. The comment form does not collect the commenter's email address and does not record IP addresses.
• Newsletter data: email address, date and time of subscription, subscription status (active/inactive).
• Cookie consent preferences: the user's choices on technical, analytics and advertising cookies, stored in localStorage (key icdf_cookie_consent) together with the consent version and date/time of the choice.

The site does not use third-party analytics cookies or advertising cookies. Google Analytics 4 and Google AdSense are technically configured but not operational: no data is transmitted to Google from user browsing.

3. Purposes and Legal Basis

3a. Technical browsing and server logs

The server automatically records technical access data (HTTP method, URL without query string, status code, response time) solely to ensure the correct functioning, security and maintenance of the site. Logs do not contain the visitor's IP address, request body or other personal data. Logs are retained for approximately 7 days.

• Data processed: HTTP method, URL (without query string), status code, response time.
• Legal basis: Legitimate interest of the Controller in the security and operation of the site (Art. 6(1)(f) GDPR).
• Retention: approximately 7 days (Replit automatic retention).

3b. Contact form

Messages sent via the contact form (name, email, subject and text) are transmitted by email to the Controller via the Resend service. Data is not stored in a separate database: it transits through Resend and is received in the Controller's business email inbox. It is accessible solely to authorised staff and retained for the time necessary to manage the request, and in any case no longer than 12 months from closure of the request, unless required by law.

• Data processed: name, email address, subject, message text, date and time of submission.
• Legal basis: performance of pre-contractual measures at the data subject's request, or legitimate interest of the Controller in managing received communications (Art. 6(1)(b) and (f) GDPR).
• Recipients: authorised Praxis 3 S.r.L. staff; Resend (email provider, processor); business email provider.
• Withdrawal/objection: request to privacy@praxis3.it.

3c. Comments

Users may leave comments on articles and recipes. The form collects only the name (nickname) and comment text. No email address is collected. No IP address is recorded. Comments are subject to manual approval by authorised staff before publication. Once approved, the name and comment text are publicly visible. Comments are retained until a deletion request is received or for the duration of the associated content's publication.

• Data processed: name (nickname), comment text, date and time of submission. No email, no IP.
• Legal basis: consent of the data subject, expressed by voluntary submission of the comment (Art. 6(1)(a) GDPR).
• Publicly visible after approval: name (nickname) and comment text.
• Moderation: every comment is manually approved before publication. Unapproved comments are visible only to authorised staff.
• Recipients: authorised Praxis 3 S.r.L. staff for moderation; hosting infrastructure (Replit).
• Withdrawal/deletion: request to privacy@praxis3.it.

3d. Newsletter

Those who subscribe to the newsletter provide their email address to receive periodic editorial communications (recipes, guides, site updates). Subscription is through a dedicated form. The Il Circolo del Forno newsletter is editorial in nature and does not constitute commercial or third-party advertising.

• Data processed: email address, subscription date and time, subscription status (active/inactive), email send logs.
• Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).
• Recipients: authorised Praxis 3 S.r.L. staff; Resend (email send provider, processor).
• Retention: until consent is withdrawn/unsubscription. In case of prolonged inactivity, data may be deleted after notice.
• Withdrawal: consent may be withdrawn at any time by replying to any received email with the subject "Cancella iscrizione" (Unsubscribe), or by sending a request to privacy@praxis3.it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3e. Cookie and consent preferences (localStorage)

The user's cookie and tracking choices are stored in the browser via the device's localStorage function (key: icdf_cookie_consent). This is a first-party technical storage: data remains solely on the user's device and is not transmitted to external servers. Storage does not expire automatically; preferences remain stored until the user manually deletes browser data or modifies preferences via the cookie panel.

• Data stored in the browser: choice for technical cookies (necessary), analytics (analytics), advertising (advertising), consent version (consentVersion), date and time of choice (timestamp).
• Legal basis: legitimate interest in the correct functioning of the consent mechanism (technical); user's consent for optional categories.
• Modification or withdrawal: via the "Your Privacy Choices" link in the site footer or the cookie panel accessible from any page.

3f. Usage statistics and advertising

The site does not currently use third-party analytics tools (such as Google Analytics) or third-party advertising technologies (such as Google AdSense, Google Ads, Meta Pixel or remarketing services). No user data is transmitted to external analytics or advertising platforms. Any future analytics or advertising services will only be activated after updating this Privacy Policy, the Cookie Policy and collecting necessary consents, with a new consent version.

3g. Legal obligations

Personal data may be processed to comply with obligations imposed by law, regulations or requests from competent authorities.

• Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. Nature of Data Provision

The technical functioning of the site involves the automatic processing of technical access data (server logs); this processing does not require any voluntary action by the user.

Sending messages via the contact form is optional. Failure to provide the required data makes it impossible to manage the user's request.

Newsletter subscription is optional. Failure to provide an email address prevents subscription and receipt of communications.

Posting comments is optional. Failure to provide a name and text prevents participation in comments.

Consent to any use of third-party analytics or advertising cookies is optional and currently not relevant, as those services are not active. Withholding consent does not in any way prevent browsing the site.

5. Processing Methods

Processing is carried out using IT and electronic tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity and confidentiality. The Controller adopts appropriate technical and organisational measures to protect personal data from unauthorised access, loss, disclosure, alteration or destruction.

6. Recipients of Data

Personal data may be communicated or made accessible, within the limits strictly relevant to the purposes indicated above, to the following categories of recipients:

a) Authorised internal parties — Employees or collaborators of Praxis 3 S.r.L. expressly authorised to process data, for purposes of technical and editorial site management, comment moderation, newsletter management and contact communications.

b) External providers (processors pursuant to Art. 28 GDPR)

c) Google services (not active at the date of this notice) — Google Analytics 4 and Google AdSense are technically configured but not operational: no Google tracking or advertising script is loaded. They will only be declared as recipients upon their actual activation, with simultaneous update of this notice.

d) Public authorities and parties authorised by law — Data may be communicated to judicial, public security or other public authorities only in the cases provided by applicable law, upon formal request and to the extent strictly necessary.

e) Consultants and professionals — Any legal, tax, IT or other professionals engaged by Praxis 3 S.r.L. for the management of regulatory obligations, litigation or technical-organisational requirements, within strictly relevant limits.

The updated list of processors may be requested by writing to privacy@praxis3.it.

7. Transfers Outside the EEA

Some of the technical providers indicated in section 6 are based or have infrastructure in the United States (Replit, Resend, OpenAI, Notion Labs). Transfers of data to these parties take place in accordance with applicable law, in particular via Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46 GDPR, or equivalent legal instruments, where applicable.

Aruba S.p.A. is based in Italy (European Union) and does not involve extra-EEA transfers. Google is not currently a recipient of user personal data from the site (see section 3f).

8. Retention Periods

Personal data are retained for no longer than necessary to achieve the purposes for which they are collected. In particular:

• Server technical logs: approximately 7 days, corresponding to the automatic retention of the hosting infrastructure (Replit). No additional browsing data is retained beyond these logs.
• Contact form data (name, email, subject, message): retained for the time necessary to manage the communication, and in any case no longer than 12 months from closure of the request, unless required by law or necessary for the Controller's defence of rights.
• Comments (name, text): retained for the duration of the associated content's publication, unless a deletion request is received from the data subject or the Controller decides to remove them.
• Newsletter data (email, subscription timestamp): retained until consent is withdrawn or unsubscription. The Controller may delete inactive subscriber data after notice.
• Consent preferences (localStorage): permanently in the user's browser until manual deletion of browser data or modification of preferences via the cookie panel.

9. Rights of Data Subjects

Data subjects may exercise, where provided under Articles 15 et seq. of the GDPR, the right to obtain from the Controller: access to personal data, rectification of inaccurate data, erasure, restriction of processing, data portability, objection to processing, and withdrawal of previously given consent, without prejudice to the lawfulness of processing based on consent before its withdrawal.

Requests may be sent to privacy@praxis3.it.

10. Right to Lodge a Complaint

Data subjects retain the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or to bring proceedings before the competent courts, where provided by applicable law.

11. Cookies and Tracking Technologies

The site uses exclusively technical cookies necessary for operation and consent preference management. No third-party analytics or advertising cookies are installed. Cookie preference storage is via first-party localStorage (key icdf_cookie_consent), which remains on the user's device and does not involve data transmission to third parties.

The consent infrastructure is configured to support potential future analytics or advertising services (Google Analytics 4, Google AdSense), which will only be activated following revision of the Cookie Policy and this notice and a new consent version, ensuring users can express a new informed choice.

Detailed information on cookie categories, purposes and consent management is contained in the Cookie Policy and in the "Your Privacy Choices" panel accessible from the site footer.

12. Changes to This Policy

This Privacy Policy may be updated at any time due to regulatory changes, technical updates to the site or variations in the services used. Users are invited to consult this page periodically.