Privacy & Cookie Policy

Last updated: 4 September 2026

1. Data controller

The controller of personal data collected through piccoliricordi.com, its subdomains and the linked online shop is:

Valentina Cassano, self-employed professional
VAT number: 07691700962
Business address: Viale Lombardia 28D • 20089 • Rozzano (MI)
Email: info@piccoliricordi.com
Telephone: +39 338 819 6851

The Controller determines the purposes and means of processing personal data in accordance with EU Regulation 2016/679 (“GDPR”) and applicable Italian law.

2. Scope of this policy

This policy covers data processed when:

you browse the website;
you send enquiries through contact forms, email or telephone;
you book photography services;
you purchase services, packages or vouchers;
orders and payments are managed;
you access private photo galleries;
you subscribe to the newsletter;
cookies and other tracking technologies are used.

3. Types of data processed

Browsing data

Computer systems may automatically collect your IP address, device and browser type, operating system, pages visited, visit date and time, connection source and other technical data needed for the website’s operation and security.

Data you provide

We may process your first and last name, email address, telephone number, billing address, tax code, VAT number, booking details, service preferences and the contents of your communications.

Order and payment data

We process the information needed to manage orders, bookings, invoicing and payments.

Full payment card details are processed directly by the payment service providers used by the online shop. The Controller normally receives only confirmation, the outcome and technical references for the transaction.

Photographs and images

Providing photography services involves creating and processing photographs and, where agreed, audiovisual recordings of clients and other session participants, including any minors.

The processing needed to produce, select, edit and deliver the requested service is based on performance of the contract.

Publishing images on the website, social networks, in a portfolio, promotional materials or photography competitions requires separate, specific and optional authorisation. Refusing permission to publish images does not prevent you from purchasing or receiving the photography service.

For images of minors, authorisation must be given by a person with parental responsibility or otherwise legally entitled to do so.

4. Purposes and legal bases

Personal data may be processed to:

respond to information or quotation requests and take pre-contractual steps requested by the data subject;
manage bookings, orders, payments, vouchers and private galleries;
produce, edit and deliver purchased photography services;
provide support and service-related communications;
comply with tax, accounting and administrative obligations;
prevent fraud, misuse and unauthorised access;
protect the Controller’s rights in and out of court;
send newsletters and promotional communications with prior consent;
publish photographs for promotional or portfolio purposes only with separate authorisation;
compile website usage statistics using tools enabled only after the user’s consent.

The legal bases are performance of a contract or pre-contractual steps, compliance with legal obligations, the data subject’s consent and, where permitted, the Controller’s legitimate interest in security and protecting their rights.

5. Providing your data

You must provide the data needed to handle an enquiry, booking, order or payment. Without it, we may be unable to enter into or perform the contract.

Consent to newsletters, non-essential cookies and the publication of photographs is optional and may be withdrawn.

6. Processing methods and security

Data is processed electronically and, when necessary, on paper. Organisational and technical measures appropriate to the risk are adopted to prevent unauthorised access, loss, disclosure, alteration or unlawful use.

Access to photographs and private galleries is restricted through private links, credentials or other safeguards available in the system used.

7. Data recipients

Where necessary, data may be shared with:

hosting and technical maintenance providers;
e-commerce platform providers;
booking system and photo gallery providers;
payment service providers;
tax, accounting, legal and insurance advisers;
email and newsletter providers;
statistical analytics providers;
public authorities, where required by law.

Providers processing data on the Controller’s behalf are appointed as processors where required by Article 28 GDPR.

8. Transfers outside the European Economic Area

Some technology providers may process data in countries outside the European Economic Area.

Where applicable, transfers are based on a European Commission adequacy decision, standard contractual clauses or another safeguard provided for in Articles 44 et seq. GDPR.

9. Retention

Data is retained only for as long as necessary for the purposes for which it was collected.

In particular:

order, invoice and payment data is retained for the periods required by tax, accounting and civil law, normally up to ten years;
pre-contractual communications are retained for the time needed to handle the enquiry and any subsequent relationship;
photographs and galleries are retained for the time needed for editing, delivery, copy management and protection of contractual rights;
newsletter data is retained until consent is withdrawn or deletion is requested;
image authorisations are retained until withdrawn and for the time needed to document the processing carried out;
data needed to handle disputes is retained until the relevant limitation periods expire.

The future availability of photographic files is not guaranteed beyond the delivery or storage period communicated to the client. Clients are therefore advised to keep backup copies of the files received.

10. Cookies and tracking technologies

The website uses essential technical cookies and, only with prior consent, analytics or functional tools.

Technical cookies

These are necessary for website operation, security, session management, the basket, orders and preferences. They do not require prior consent.

They include the cookie that remembers preferences selected in the cookie panel, retained for a maximum of 180 days. Technical records of consent may be retained for 365 days so that the Controller can demonstrate compliance with the user’s choices.

Google Analytics

Google Analytics is used to obtain website usage statistics. It is enabled only after the user consents to the “Analytics” category.

The service may process device, browsing, IP address and page interaction data. Google Analytics cookies may have an indicative maximum lifespan of 24 months, subject to provider changes or earlier deletion by the user.

Google Fonts and functional services

The website may use Google Fonts or other external services needed to display fonts and content. Where these resources connect to third-party servers, they are enabled only after consent to the relevant category.

The connection may involve transmitting the IP address and technical device information.

Managing preferences

On their first visit, users may:

accept all cookies;
reject non-essential cookies;
choose individual categories;
continue with the default technical settings.

Preferences may be changed or withdrawn at any time through the cookie management control available on the website.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Newsletter

The newsletter is sent only to users who have given their consent.

Users may withdraw consent at any time using the unsubscribe link in the communications or by writing to info@piccoliricordi.com.

12. Your rights

Data subjects may request:

access to their data;
correction of inaccurate data;
erasure, where the conditions are met;
restriction of processing;
data portability;
the right to object to processing;
withdrawal of consent;
information about recipients and international transfers.

Requests may be sent to info@piccoliricordi.com.

Data subjects may also lodge a complaint with the Italian Data Protection Authority using the contact details available at garanteprivacy.it.

13. Automated decision-making

The Controller does not make decisions producing legal effects on users based solely on automated processing, except where necessary for payment providers’ technical payment management or fraud prevention.

14. Changes

This policy may be updated to reflect legal, technical or organisational changes. The updated version will be published on the website with its revision date.