Privacy Policy
This notice explains how personal data is handled for people who visit lucianozitoli.it and for people who write to us for information or a quote. It is written under Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR). The Italian version on the Italian privacy page has the same content.
The short version: the details you give us are used to reply to you; visit statistics (Google Analytics 4) and third party content only switch on if you consent; we do no profiling and no targeted advertising.
Last updated: 12 November 2026.
Who is the data controller?
The controller is Benedetto Zitoli, Via Umberto 230, 76125 Trani (BT), Italy, VAT number IT03793090725, REA BA-279154, trading as Luciano Zitoli and, for maternity and newborn photography, as Little Stories by Zitoli.
For anything about your data you can write to info@lucianozitoli.it, call +39 0883 588902, message us on WhatsApp at +39 347 717 3992 or send a letter to the studio address.
The people in the studio who read your requests do so as persons authorised by the controller, following the controller's instructions. No data protection officer has been appointed, because none of the cases in Article 37 of the GDPR applies.
What data do our forms collect?
Depending on the form (availability request, contact form, Little Stories request), we ask for: name, email, telephone, the date of the event, the venue, the services you are interested in, the reason for writing or where you are with your plans, and a free message. Only the fields marked as required are compulsory.
Together with the request we store the date and time it was sent, the IP address it came from and the page you sent it from: they help us protect the form from abuse, such as automated submissions and spam.
The request reaches the studio by email, in the info@lucianozitoli.it mailbox and as a copy in a Gmail mailbox of the controller. You receive a confirmation email summarising what you wrote.
And information about a pregnancy?
The Little Stories form asks where you are and the date you have in mind. If you tell us you are expecting a baby or give us the due date, you are sharing health information, which the GDPR treats as a special category of data (Article 9).
We use it only to organise the photo session, on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the dedicated box in the form. You can withdraw it at any time by writing to us; withdrawal does not affect what was done before. We share this information with nobody, apart from the email providers listed below.
Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your request and preparing a quote | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) |
| Handling pregnancy information from the Little Stories form | Your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time |
| Carrying out the service, if you hire us | Performance of the contract (Art. 6(1)(b) GDPR) |
| Meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Protecting the site and its forms from abuse and keeping server logs | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
| Visit statistics with Google Analytics 4 | Your consent (Art. 6(1)(a) GDPR), given in the banner and revocable |
| Google map and Instagram posts embedded in the pages | Your consent (Art. 6(1)(a) GDPR), given in the banner and revocable |
| Publishing photographs and films of clients on the site | Written consent of the people portrayed, separate from the contract and revocable |
What happens when you message us on WhatsApp?
The WhatsApp button on the site opens a chat with +39 347 717 3992. The site sends no data to Meta: the link simply opens the app or WhatsApp Web on your device.
From then on the conversation takes place on the platform of WhatsApp Ireland Limited, which handles the data under its own notice, available at whatsapp.com/legal/privacy-policy-eea. We use the messages you send us for the same purposes and with the same retention periods as the forms.
Does the site use statistics tools?
Yes, but only with your consent. If you switch on «Statistics» in the banner, the site loads Google Analytics 4 (ID G-8PDHSJ23PF), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without consent no Google script is loaded.
Google Analytics 4 records the pages viewed, how long visits last, the type of device, the approximate area the visit comes from and whether a form was sent, using the cookies _ga and _ga_8PDHSJ23PF, which last about two years. Advertising signals stay denied (Consent Mode with ad_storage, ad_user_data and ad_personalization set to «denied»): the data is not used for advertising or profiling.
Google may also process this data in the United States, through Google LLC: the transfer is covered by the EU and US Data Privacy Framework, in which Google takes part. Google's notice is at policies.google.com/privacy.
You can withdraw consent at any time from the «Manage consent» link at the bottom of every page: the _ga cookies are deleted and from the next page the tool no longer loads.
And the map and the Instagram posts?
The contact page contains a Google Maps map, provided by Google Ireland Limited, and some pages show Instagram posts from the Little Stories profile, provided by Meta Platforms Ireland Limited. They load only if you consent to «third party content» in the banner.
Without consent, the map is replaced by a box with a button, and clicking an Instagram post opens it on instagram.com in a new tab, without our page loading anything from Meta.
Once loaded, Google and Meta may set their own cookies and handle the data under their own notices: policies.google.com/privacy and privacycenter.instagram.com/policy. Any transfer to the United States is covered by the EU and US Data Privacy Framework, in which both take part.
Where is the data hosted, and who receives it?
The site, the forms and the info@lucianozitoli.it mailbox are hosted by a hosting provider in a data centre in Frankfurt, Germany, inside the European Union. The provider processes on our behalf the data needed to serve the pages, the forms and the email, including server logs with IP addresses; outgoing email passes through an anti spam service used by the provider.
Pages are delivered through the network of Cloudflare, Inc., which acts as a content delivery network and security filter. Cloudflare processes technical browsing data (IP address, browser type, request logs) only to deliver the pages faster and protect the site from abuse. Any transfer to the United States is covered by the EU and US Data Privacy Framework, in which Cloudflare takes part.
Request notifications also reach a Gmail mailbox of the controller. The email service is provided by Google, which may also process the data in the United States; the transfer is covered by the EU and US Data Privacy Framework.
If you become a client, the data needed goes to our accountant for tax purposes and, if you order albums or prints, to the print lab, limited to what is necessary. Authorities receive data only when a law requires it. We do not sell or pass on data to anyone for marketing.
How long do we keep the data?
| Data | How long |
|---|---|
| Form requests and messages that do not lead to a booking | Up to 24 months from the last contact, then deleted. The site's archive of requests clears itself after 24 months |
| Requests recognised as spam | 30 days |
| Pregnancy information | As long as the request, or until you withdraw consent if that comes first |
| Contract and tax records, if you become a client | Ten years, as the law requires |
| Server logs | The technical time needed for the security of the site |
| Google Analytics 4 statistics | Data on individual visits at most 14 months, the Google Analytics 4 limit; the _ga cookies about two years |
| Your choice in the banner | 12 months, in your browser |
Photographs published on the site
The photographs and films of clients you see on the site are published with the written consent of the people portrayed, separate from the contract. For images of minors, consent is given by whoever holds parental responsibility.
Anyone who appears in a photograph can withdraw consent at any time by writing to info@lucianozitoli.it: we remove the image from the site and from the profiles we manage. We have no control over copies already saved or shared by others.
Do we do profiling?
No. The site does no profiling, makes no automated decisions about visitors and does not use data for targeted advertising. We read and assess requests ourselves.
What are your rights?
Articles 15 to 22 of the GDPR give you the right to access your data, correct it, erase it, restrict its processing, receive it in a machine readable format and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time, without affecting what was done before.
To exercise these rights, write to info@lucianozitoli.it or use the other contact details above. You will receive a reply within one month, as Article 12 of the GDPR requires.
If you believe your data is being processed in breach of the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome (garanteprivacy.it), or with the supervisory authority of the EU country where you live or work, or go to court.
Do you have to give us your data?
No, but without a name, an email and a line about what you need we cannot reply. You can leave the optional fields empty: they only help us understand your situation better.
Changes to this notice
This notice changes if the tools on the site change: the version published on this page, with the date at the top, is the one that applies. If something about consent changes, the banner appears again and asks you to choose.
Cookies and similar technologies, with purposes and durations, are listed in the cookie policy. The rules for using the site, including who owns the photographs, are in the terms of use.