IT EN
€0 Book a course
Privacy

Privacy

Privacy notice pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR"). Last updated: 30 September 2026.

1. Data controller

The controller of the data collected through this site is Stefano Milanesi (Scrummy), VAT ID IT04468450400. For any request about your personal data, write to us via the contact form.

2. What data we collect

  • Contact form: first name, last name, email, phone (optional), subject and message.
  • Course purchase: before payment we ask for your first name, last name, company name (optional), VAT number or tax code, billing address (street, town/city, province, postcode, country), phone and email and, only for Italian electronic invoicing and on an optional basis, SDI recipient code and PEC certified email. We also record the course purchased, the course date, the quantity, the amount, any discount coupon used, and the date and time you accepted the Terms and conditions and this privacy notice.
  • Participant data: in the optional "Additional information" field you can enter the first name, last name and email of the people who will attend the course, if different from the purchaser, and a purchase order number if any. If you enter other people's data, please inform them of the processing described on this page.
  • Payment data: collected and processed directly by Stripe. This site never sees or stores your card number.
  • Technical browsing data: as with any website, the servers hosting it record technical data such as IP address, date and time of the request and browser type, used only to operate and secure the site.

3. Purposes and legal bases

  • Replying to requests sent through the contact form: pre-contractual steps taken at your request or, for general enquiries, our legitimate interest in replying to you (Art. 6(1)(b) and 6(1)(f) GDPR).
  • Managing your purchase and course enrollment (order confirmation, organisational communications about the course, support): performance of a contract to which you are a party (Art. 6(1)(b) GDPR).
  • Issuing the invoice and complying with tax and accounting obligations: legal obligation (Art. 6(1)(c) GDPR).
  • Keeping evidence that you accepted the Terms and conditions and protecting our rights in case of disputes: the controller's legitimate interest (Art. 6(1)(f) GDPR).
  • Protecting the site from spam and abuse (spam check on the contact form) and collecting aggregate traffic statistics that do not identify individual visitors: the controller's legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for newsletters or marketing, we do not sell it, and we do not subject it to automated decision-making or profiling.

4. Whether providing data is mandatory

The fields marked as required in the purchase form are necessary to complete your enrollment and issue the invoice: without them the purchase cannot be completed. You may leave optional fields blank with no consequences.

5. Recipients of the data

The data is processed by the controller and, on its behalf, by the following providers, acting as data processors under their respective data protection agreements:

  • Stripe: payment processing.
  • Resend: sending transactional emails (order confirmation including a summary of your billing details, internal new-order notification, contact form messages).
  • Aruba: hosting of the site and of the database where orders and billing details are stored, in Italy.
  • Cloudflare: spam protection on the contact form (Turnstile) and aggregate traffic statistics (Web Analytics), which use no cookies and do not identify individual visitors.
  • Google Fonts: the site's typefaces are loaded from Google's servers (fonts.googleapis.com, fonts.gstatic.com), which may receive the visitor's IP address at load time.

The data needed for invoicing may also be disclosed to the controller's tax advisor and, through the Italian Exchange System (SDI), to the Italian Revenue Agency, as required by tax law. The data is not published or shared with third parties for any other purpose.

6. Transfers outside the European Union

Stripe, Resend, Cloudflare and Google are companies based, or with a parent company based, in the United States: using their services may involve transferring personal data outside the European Union. These transfers rely on the safeguards provided by the GDPR, such as the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, for participating companies, and/or Standard Contractual Clauses approved by the European Commission.

7. How long we keep your data

  • Billing data and paid order data: 10 years, as required by Article 2220 of the Italian Civil Code for accounting records and tax documents.
  • Data from incomplete orders (payment started but not completed): for the time needed to handle any payment support requests, after which it is deleted.
  • Contact form messages: for the time needed to handle your request and any relationship that follows.
  • Technical browsing data: for short periods, according to the hosting provider's policies, unless needed to establish liability in case of abuse.

8. Cookies

For details on the cookies used by the site, see the Cookie Policy.

9. Your rights

At any time you can exercise the rights set out in Articles 15-22 GDPR: access to your data, rectification, erasure (within the limits of legal retention obligations), restriction of processing, data portability, and objection to processing based on legitimate interest. To do so, write to us via the contact form: we will reply within one month of your request.

If you believe the processing of your data infringes the GDPR, you also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

10. Changes to this notice

This notice may be updated over time, for example when new site features are introduced or the law changes. The date of the last update is shown at the top of the page.