Privacy policy

This notice is provided pursuant to Regulation (EU) 2016/679 ("GDPR") by Gaetano Livornese (hereinafter also the "Controller"), as the controller of the personal data collected through the website gl-ripetizioni.com.

1. Data controller

Gaetano Livornese, private tutor. Email: glripetizioni@gmail.com.

2. Data collected

We collect the following categories of personal data, solely when you actively provide them:

• Registration data: first name, surname, email, password (hashed), to create the account in the personal area.
• Contact data: telephone number and email address, for operational communications.
• Lesson data: topics covered, exercises uploaded, progress recorded, materials shared.
• Technical data: IP address, user agent, access timestamps, security logs generated automatically by the infrastructure.

3. Purposes of processing

• Provision of the tutoring service (performance of a contract — Art. 6(1)(b) GDPR).
• Management of the personal area, the lesson calendar, materials and progress tracking.
• Accounting and tax obligations (legal obligation — Art. 6(1)(c) GDPR).
• Sending service communications (confirmations, reminders, post-lesson notes) by email.
• Security, abuse prevention and technical diagnostics (legitimate interests — Art. 6(1)(f) GDPR).

We do not process data for profiling, automated marketing or behavioural advertising purposes.

4. Third-party services and external processors

To provide the service we rely on the following providers, designated as data processors (Art. 28 GDPR):

• Supabase (Supabase Inc., USA, compliant with the EU-U.S. Data Privacy Framework, DPF) — authentication, database and storage of materials. Data is hosted on servers in the European Union where available.
• Netlify — hosting of the website and of the serverless functions.
• Resend — sending of transactional emails (confirmations, password resets, post-lesson notes).
• Cloudflare Turnstile (Cloudflare, Inc., USA, compliant with the EU-U.S. Data Privacy Framework, DPF) — anti-bot protection of the sign-up, login and password-recovery forms. Turnstile automatically analyses technical signals from the browser and the device to tell real users apart from bots, without advertising tracking or profiling. Its use is subject to Cloudflare's Privacy Policy and to the Turnstile Privacy Addendum.
• Umami (where used) — aggregate and anonymous traffic statistics, without cookies or personal data.

5. Cookies

We use essential technical cookies needed for authentication (Supabase) and interface preferences to work. For full details, including the purpose of each cookie, see our cookie policy.

6. Retention periods

• Account data: for the duration of the relationship and up to 24 months from the last activity, unless erasure is requested.
• Tax documents: 10 years, as required by law.
• Technical logs: 90 days at most.

7. Your rights

You may exercise at any time the rights provided for by Articles 15-22 GDPR:

• Access to, rectification and erasure of your data.
• Restriction of and objection to processing.
• Portability of your data in a structured format.
• Withdrawal of consent, where given, without affecting the lawfulness of the processing carried out before the withdrawal.
• Lodging a complaint with the Italian data protection authority (Garante per la Protezione dei Dati Personali) (garanteprivacy.it).

To exercise your rights, write to glripetizioni@gmail.com: we reply within 30 days.

8. Minors

For students who are minors, the account must be registered in the name of a parent or legal guardian, who gives consent to the processing of the minor's data.

9. Changes

We update this notice when the purposes or the providers change. The current version shows the date of the last update at the top of the page.