Privacy Policy
Last updated: 12 October 2026
English version provided as a courtesy. In case of doubt, the Italian version prevails. Draft awaiting legal review.
Who the data controller is
Data controller: MAXIMIZE ACADEMY S.r.l.s., VAT no. 02147290767, Via Benedetto Croce 8, 71121 Foggia. Email: mauriziomaximize@gmail.com.
For any question about your data or to exercise your rights, write to the email address above. [DA COMPLETARE: data protection officer, only if appointed].
Legal references and terms used
This notice is given under arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code), as amended by Legislative Decree 101/2018. It applies to this site and the related services: contact form, feedback, account. It does not apply to the third-party sites we link to: each has its own notice.
- Personal data: any information about an identified or identifiable person.
- Controller: who decides why and how data is processed.
- Processor: who processes data on behalf of the controller.
- Data subject: the person the data refers to, that is you.
How we process data: the principles
We follow the principles of art. 5 GDPR. In plain words:
- we process data lawfully, fairly and transparently;
- we use it only for the purposes written on this page;
- we ask for the minimum needed;
- we try to keep it accurate and up to date;
- we keep it only as long as needed;
- we protect it from unauthorised access and use.
What data we process
Contact form. If you write to us from the site, we process the name, contact details (email or phone) and message you enter. The reason for contact (information, training, work, gift) is used to route the request.
Technical data. The server hosting the site may record, for a short time, technical connection data (such as the IP address and browser type) to make the site work and for security. The contact form uses an anonymised IP address, kept only in memory, to limit repeated requests.
Statistics. Only if you accept them, we count clicks on the main buttons. We do not collect personal data in the statistics. Chosen tool: [DA COMPLETARE: tool].
Anonymous feedback (page reached by QR code in the shop). If you answer, we process the scores, the name of the professional you choose and an optional comment. We do not ask for name, email or phone and we do not store your IP address. Do not write personal data in the comment. Visits arriving from a QR code are counted only if you accept statistics.
Account and private area. If you create an account, we process your email, name (optional), password (stored in encrypted form, never readable by us), sign-up date and last sign-in date. If you sign in with Google or Apple we receive your profile email and name from them, not your password. To make sign-in work we store a session token on your device. Signing in on the computer with the phone (QR code) uses a temporary code that lasts 2 minutes and a device label (for example “Windows · Chrome”), deleted immediately after use. The owner sees the list of members in the private area.
Bookings. Booking is done on the Treatwell site: the data you enter there is processed by Treatwell. We see it only as far as needed to manage the appointment.
Messages on WhatsApp and social media. If you write to us on WhatsApp, Instagram or Facebook, we process your number or username and the content of the message in order to reply.
Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Replying to your request | Name, contact details, message | Your request or pre-contractual measures (art. 6.1.b); consent to the form (art. 6.1.a) |
| Security and proper working of the site | Technical connection data | Legitimate interest (art. 6.1.f) |
| Statistics and maps | Clicks on buttons; IP address sent to Google for the map | Your consent (art. 6.1.a) |
| Improving the service with feedback | Scores, chosen professional, comment | Legitimate interest (art. 6.1.f), with data that cannot be traced to a person |
| Creating and managing your account | Email, name, encrypted password, sign-in dates | Performance of the service you ask for (art. 6.1.b); security of access (art. 6.1.f) |
| Legal obligations | Data required by law | Legal obligation (art. 6.1.c) |
Consent and how to withdraw it
Where the legal basis is consent (contact form, statistics, maps), you can withdraw it at any time, as easily as you gave it. For statistics and maps use the “Cookie preferences” button. For the form, write to the controller’s address. Withdrawal does not affect processing already carried out. If you do not give consent, the site still works, except the part that depends on that consent.
Health data and other sensitive data
Through the site we do not ask for data about health, opinions, religion or other sensitive aspects of life (the “special categories” of art. 9 GDPR). Please do not write them in the contact form, the feedback or the comments. If, for a treatment in the shop (for example a massage), you give us information about allergies or health conditions, we use it only for that treatment, with the notice given in the shop. [DA COMPLETARE: in-shop notice and consent, after legal review].
Job applications
If you write to us to work with us, we process the data you send (for example name, contact details, experience, CV) to assess the application and contact you. Please do not send unnecessary data, such as photos, health, opinions or family situation. Legal basis: your request (art. 6.1.b). Retention: [DA COMPLETARE: period]. If the application does not go ahead, we delete it at the end of that period, unless you consent to us keeping it.
If you give us other people’s data
If you write to us on behalf of others (for example for a gift) or give us other people’s contact details, make sure you are allowed to. We use that data only for your request.
What we do not do
The site does not save the content of the contact form in an archive: the message is sent by email to the owner. We do not sell your data. We do not use profiling or automated decisions. We do not send marketing communications to members without your separate consent.
How we process data
Data is processed with electronic tools, by authorised and instructed people, only for the stated purposes. Access to the tools that contain personal data is protected by credentials. The controller does not sell or pass data to third parties for their own marketing.
Who receives the data
The data is accessible to the owner and to those who work with them to reply to requests. We use these providers, who process data on our behalf or as independent controllers.
| Who | What for | Notes |
|---|---|---|
| Vercel Inc. | Site hosting | [DA COMPLETARE: check the data processing agreement and non-EU transfers] |
| Email service | Sending the contact form and feedback | [DA COMPLETARE: chosen service] |
| Supabase | Management of accounts and sign-ins | [DA COMPLETARE: check the data processing agreement, server region and non-EU transfers] |
| Google and Apple | Sign-in with your profile, if you choose it | Independent controllers: their privacy notice applies |
| Google (map) | Map on the Where we are page | Only if you load it: Google receives your IP address |
| Treatwell | Booking appointments | Independent controller: read its privacy notice before booking |
| WhatsApp, Instagram and Facebook (Meta) | Messages and social media | Independent controllers: their privacy notice applies |
Transfers outside the European Union
Some providers may process data outside the European Economic Area. In these cases the safeguards required by the GDPR are needed (for example adequacy decisions or standard contractual clauses). [DA COMPLETARE: safeguards adopted for each provider, after legal review].
For how long
| Data | Time |
|---|---|
| Contact form requests | [DA COMPLETARE: period] |
| Your cookie choice | 6 months |
| Anonymous feedback | For internal use, without personal data: [DA COMPLETARE: period] |
| Account | Until you delete it or ask the owner to delete it. Inactive accounts: [DA COMPLETARE: time] |
| Temporary QR sign-in code | 2 minutes, deleted after use |
At the end of the period the data is deleted or anonymised, unless the law requires otherwise.
Your rights
You can ask at any time for:
- access to your data;
- rectification of wrong data;
- erasure;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability of the data you gave us;
- withdrawal of consent, without effect on the past (from the “Cookie preferences” button at the bottom of the page for statistics and maps).
Write to mauriziomaximize@gmail.com. We normally reply within one month. You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
How to exercise your rights
Write to the controller (email at the top) saying which right you want to exercise. To protect you, if needed we ask you to prove who you are: we may not give data to a person we cannot recognise. Exercising your rights is free, except for manifestly unfounded or excessive requests (art. 12 GDPR). We reply within one month of the request; if the request is complex or there are many, the term may be extended by two more months, and we tell you. If you are not satisfied, you can lodge a complaint with the Italian Data Protection Authority or go to the courts.
Do you have to give us the data?
No, but without some data we cannot provide the service: for example, without a contact we cannot reply to the form, and without an email you cannot create an account. Statistics and the map are always optional.
Minors
The site is not designed for children. We do not knowingly collect data from minors under 14 without the consent of whoever holds parental responsibility. If you think a minor gave us data without consent, write to us and we will delete it.
Security
The connection to the site is encrypted (HTTPS). Passwords are stored in encrypted form. We apply reasonable access controls, but no online system can guarantee zero risk.
Data breaches
If a breach puts personal data at risk (for example unauthorised access), we handle it immediately. When the law requires, we notify the Authority within 72 hours and, if the risk to you is high, we also inform you (arts. 33 and 34 GDPR).
Changes to this notice
If we change the way we process data, we update this page and the date at the top. For important changes we say so on the site.