APPOINTMENTS

Privacy Policy

Last updated: October 9, 2026

Pursuant to Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, this Privacy Policy describes how the personal data of users who visit https://www.antoniocolonna.com or contact ANTONIO COLONNA through the channels available on the website are processed.

1. Data controller

The Data Controller is:

ANTONIO COLONNA
Via Annibale Maria di Francia 66
70022 Altamura (BA), Italy
Email: art@antoniocolonna.com
Website: https://www.antoniocolonna.com

2. Types of data processed

The following categories of personal data may be processed, depending on the services used and the manner of interaction with the site.

a) Identification and contact details
Name, surname, email address, telephone number, postal address and any other data voluntarily provided by the user in messages, information requests, appointment requests, quotes or communications sent to the Data Controller.

b) Data relating to requests, appointments and contractual relationships
Data contained in requests for information, consultations, quotes, appointments, orders, bespoke work, repairs, appraisals, experiences in the workshop, pre- and post-sales assistance, as well as data necessary for the administrative, accounting and fiscal management of the relationship.

c) Navigation data
The computer systems and software procedures responsible for the functioning of the website may acquire, during their normal operation, certain data the transmission of which is implicit in the use of Internet protocols, such as IP addresses, technical identifiers of the device, data related to the browser, operating system, time of the request, pages visited and technical logs.

d) Data collected via cookies and similar tools
The site uses technical cookies and, according to the preferences expressed by the user, statistical tools, measurement systems, pixels, tags, scripts and other tracking tools, as described in the Cookie Policy.

Some tools can operate, before consent is given for the optional categories, in a limited mode without using the cookies normally used for full measurement. The behavior of individual services is described in the following sections and in the Cookie Policy.

e) Data provided for promotional and newsletter purposes
If the user chooses to subscribe to the newsletter or receive promotional communications, the data necessary for sending these communications and managing the related preferences may be processed.

f) Data relating to interactions with external services
When the user clicks on links to external services, such as WhatsApp, TidyCal, social profiles, external customer areas, or other platforms linked to the Data Controller’s services, the data processing may continue in accordance with the privacy and cookie policies of the respective providers.

3. Purposes of the processing and legal bases

Personal data is processed for the following purposes.

a) Management of user requests
To respond to requests for information, consultations, appointments, quotes, business contacts or assistance.
Legal basis: execution of pre-contractual measures adopted at the request of the data subject, pursuant to Article 6, paragraph 1, letter b) of the GDPR.

b) Performance of the contractual relationship and related obligations
To manage orders, sales, bespoke work, services, appointments, assistance, warranties, repairs, shipments, and any other activity related to the execution of the relationship with the customer.
Legal basis: Execution of a contract or pre-contractual measures pursuant to Art. 6, Par. 1, letter b) of the GDPR.

c) Compliance with legal obligations
To fulfill regulatory, fiscal, accounting, administrative or orders from competent authorities.
Legal basis: compliance with a legal obligation pursuant to Article 6, paragraph 1, letter c) of the GDPR.

d) Site security and protection of the Data Controller's rights
To ensure the security of the site, prevent abuse, spam, malfunctions, or unauthorized access, as well as to ascertain, exercise, or defend a right in judicial or extrajudicial proceedings.
Legal basis: legitimate interest of the Data Controller pursuant to Article 6, paragraph 1, letter f) of the GDPR.

e) Sending promotional communications and newsletters
With the prior consent of the data subject, to send informational and promotional communications by email or other means of contact, including invitations to events and updates on the Data Controller’s services, creations, initiatives or content.
Legal basis: consent of the data subject pursuant to Article 6, paragraph 1, letter a) of the GDPR.

f) Statistical analysis and site improvement
To understand how users use the site, improve content, structure, navigation, performance, functionality, and the quality of the browsing experience. Some statistical tools may operate in a limited mode before consent and switch to full measurement after consent regarding the Statistics category.
Legal basis: consent of the data subject pursuant to Article 6, paragraph 1, letter a) of the GDPR, where required by applicable law.

g) Marketing, conversion measurement and promotional activities
To measure the effectiveness of communication activities and promotional campaigns, monitor relevant interactions with the site and improve marketing activities. The full functionality of advertising, attribution, profiling and remarketing is used with consent, where required.
Legal basis: consent of the data subject pursuant to Article 6, paragraph 1, letter a) of the GDPR for activities subject to consent.

h) Cookie consent management
To record and respect the preferences expressed by the user through the cookie banner, also through technical cookies necessary for storing the choices made.
Legal basis: compliance with regulatory obligations and legitimate interest in the proper technical management of consent.

The provision of data for the purposes referred to in letters a), b) and c) is necessary in order to be able to respond to the user’s requests or to properly execute the contractual relationship and the legal obligations.

The provision of data for promotional purposes and for activities that require consent is optional; failure to provide such consent will not affect your ability to browse the website or use the main services.

4. Method of processing

The processing of personal data takes place using paper, computer and telematics tools, in accordance with logics strictly related to the indicated purposes and in compliance with the principles of legality, correctness, transparency, minimization, accuracy, integrity, confidentiality and limitation of retention.

The Data Controller adopts appropriate technical and organizational measures to protect personal data from unauthorized access, loss, disclosure, alteration or destruction.

5. Services and tools used by the website

For the operation of the site, the management of requests, performance measurement and communication activities, the site uses or may link to the following services and tools.

5.1 WordPress, hosting and technical infrastructure

The site is built with WordPress and uses hosting, maintenance, security, caching, backup, and technical management services necessary for the proper functioning of the pages and the connected services.

5.2 Complianz

The website uses Complianz for the management of the cookie banner, the collection of consent preferences and the technical storage of the choices expressed by the user.

5.3 Google Tag Manager

The website uses Google Tag Manager to centrally manage some scripts, measurement tools, and third-party services.

Google Tag Manager allows you to manage, among others, Google Analytics 4, Microsoft Clarity, Microsoft Advertising UET and Meta Pixel according to the technical configuration of the site and the consent preferences expressed by the user.

5.4 Google Consent Mode v2

The website uses Google Consent Mode v2 to communicate to Google services the state of consent expressed by the user through the cookie banner.

Depending on the preferences expressed by the user, the analysis, measurement and marketing tools can operate in full mode, limited mode or remain deactivated.

5.5 Google Analytics 4

The website uses Google Analytics 4, through Google Tag Manager, to collect statistical data on the use of the pages and on the interaction events configured on the site.

Before the Statistics consent, Google Analytics 4 can operate in a limited mode without using Analytics cookies. After the Statistics consent, it can switch to the full measurement provided by the service configuration.

5.6 Microsoft Clarity

The website uses Microsoft Clarity to analyze the navigation experience of users, also through heat maps, clicks, scrolling, and technical recordings of interactions with the pages.

Before consent is granted, Clarity can operate in limited mode without using its own analytics cookies. After consent is granted, it can switch to the full collection provided by the service.

The tool is configured to respect the user’s consent preferences and must not be used to collect sensitive data entered in forms.

5.7 Microsoft Advertising / Universal Event Tracking (UET)

The website uses Microsoft Advertising Universal Event Tracking (UET), through Google Tag Manager, to measure visits, interactions and conversions and to evaluate the effectiveness of promotional activities.

UET may process technical information related to the visit and interaction with the site, such as the page URL, the origin of the visit, technical information about the browser and device, and configured measurement events.

Before the Marketing consent, Microsoft Advertising UET can operate in a limited mode without using advertising cookies.

After consent from Marketing, the service can use cookies and identifiers provided by the platform for complete measurement, attribution, and remarketing functionality.

The consent state is transmitted to Microsoft UET through the configuration of the Consent Mode integrated with Google Tag Manager.

5.8 Meta Pixel / Facebook Pixel

The website uses Meta Pixel, through Google Tag Manager, to measure some user interactions with the site.

The monitored events may include, for example, page views, clicks on WhatsApp, telephone and email links, clicks to the appointment booking system, and successful newsletter form submissions, where configured.

Meta Pixel and the related marketing events are activated after the Marketing consent.

5.9 Mailchimp

The website uses Mailchimp for the management of the newsletter and the communications sent to users who voluntarily choose to subscribe.

Subscription to the newsletter takes place through confirmation by the user in accordance with the procedures provided for by the service.

5.10 TidyCal

The site contains links to TidyCal or other external appointment booking systems.

When the user clicks on such links and accesses the external service, the processing of data is also governed by the privacy and cookie policies of the relevant provider.

5.11 WhatsApp, phone, email and social media profiles

The site contains links that allow the user to contact the Data Controller via WhatsApp, phone, email, or social media profiles.

The simple connection present on the website does not, per se, involve the installation of third-party cookies by the external service.

When the user clicks on the link and accesses the external service, the processing of data is also governed by the information provided by the relevant provider.

5.12 YouTube

The site contains embedded videos from YouTube.

Videos are blocked when the required consent is not yet available and can be displayed after the user’s acceptance or interaction, according to the consent system configuration.

5.13 Google Fonts

The site uses fonts provided by Google Fonts configured to be hosted locally on the site server.

In this way, a direct call to Google's servers for the loading of the characters is not normally made.

5.14 Google Search Console

The website uses Google Search Console for the management of indexing, monitoring of presence in search engines and verification of the status of the site.

The service is used for technical and SEO purposes, such as verifying domain ownership, sending sitemaps, monitoring indexing, and analyzing any scanning errors.

When verification is carried out using DNS records or other equivalent technical methods, this tool does not, per se, involve the installation of profiling or marketing cookies on the user’s device.

5.15 Payments via Stripe

For the payment of the amounts due, the site may direct the user to a payment page managed by Stripe.

Stripe processes the data necessary to complete the payment, prevent fraud and manage the transaction in accordance with its Privacy Policy.

Antonio Colonna receives only the data and transaction outcome necessary to manage the request and comply with administrative and tax obligations.

The payment card data are entered directly on the page managed by Stripe and are not processed through antoniocolonna.com.

5.16 Cloudflare Turnstile

The website uses Cloudflare Turnstile, provided by Cloudflare, Inc., as an anti-bot security measure to protect the site's modules from automated submissions, spam, abuse, and potentially harmful activities.

To perform the verification, Turnstile can process technical signals related to the connection and the device, such as IP address, User-Agent and other technical parameters necessary for the verification.

The processing carried out by the Data Controller through Turnstile is based on the legitimate interest in the security of the site and in the prevention of abuse, pursuant to Article 6, paragraph 1, letter f) of the GDPR.

The Turnstile is configured on the site in mode Invisible and performs the verification in the background normally without requiring any visible interaction from the user.

For more information, please consult the Cloudflare Turnstile Privacy Addendum .

5.17 Google reCAPTCHA

Some features or modules of the site may be used Google reCAPTCHA as a technical security measure against spam, abuse and automated traffic.

The service may process technical information necessary for verification, such as data related to the browser, device, and connection.

The service is used for security and site protection purposes.

6. Recipients of the data

Personal data may be disclosed, to the extent strictly necessary for the purposes set out above, to:

  • collaborators and persons authorised by the Data Controller to process data;
  • technical, IT and hosting service providers, site maintenance, security, backup, e-mail management, newsletters, appointment management, statistics, marketing, payments, shipping, document storage or other related activities;
  • digital service providers connected to the site, such as analytics, measurement, newsletter, consent management tools, booking platforms, social networks or external communication tools;
  • consultants, professionals or firms assisting the Data Controller in administrative, fiscal, legal or organisational matters;
  • authorities, public and private bodies or entities in the cases provided for by law.

If these entities process data on behalf of the Data Controller, they are appointed, where necessary, as Data Processors pursuant to Article 28 of the GDPR.

Personal data is not subject to indiscriminate public disclosure.

7. Transfer of data to non-EU countries

Some digital service providers, technical, statistical, newsletter, marketing or communication providers may also process personal data outside the European Economic Area.

If, for technical or organizational reasons, some data are processed or stored by entities located outside the European Economic Area, the transfer will be carried out in compliance with Chapter V of the GDPR, based on a decision of adequacy by the European Commission or through the adoption of appropriate safeguards, such as standard contractual clauses. or other instruments provided for by the applicable regulations.

8. Data retention period

Personal data are kept for a period not exceeding that necessary to achieve the purposes for which they were collected.

In particular:

  • The data processed to respond to requests for contact, information, appointments, or quotes are kept for the time necessary to manage the request and any subsequent developments;
  • The data processed for contractual, administrative, accounting and fiscal purposes are kept for the time necessary to execute the relationship and, subsequently, for the period stipulated by the applicable regulations;
  • The data processed based on consent for promotional purposes and newsletter are kept until the consent is revoked or the request for deletion is made, unless there is a need for further storage for legal obligations;
  • The data processed through cookies and similar tools is stored in accordance with the provisions of the Cookie Policy and the settings of the individual tools used;
  • The technical logs and data necessary for the site's security are kept for the time necessary for technical management, security, and the prevention of abuse or malfunctions.

After the applicable retention period has expired, the data will be deleted or anonymized, subject to any further legal obligations. or the need to protect the rights of the Data Controller.

9. Data relating to minors

The Data Controller’s website and services are not primarily intended for minors.

For information society services based on consent, the processing of a minor’s personal data is lawful in accordance with applicable Italian law. In Italy, a minor who has reached 14 of age may independently give consent in relation to the direct offer of information society services. For minors under the age of 14such consent must be given by the person exercising parental responsibility.

10. Rights of the data subject

The data subject may exercise, in the cases provided for in Articles 15-22 of the GDPR, the following rights:

  • obtain confirmation as to whether or not personal data concerning him or her are being processed, and access to the related data;
  • request the rectification of inaccurate data or the completion of incomplete data;
  • request the erasure of personal data, in the cases provided for by law;
  • request restriction of processing;
  • object to processing, where permitted by law;
  • receive the personal data in a structured, commonly used and machine-readable format, where applicable, and transmit those data to another controller;
  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  • lodge a complaint with the Data Protection Authority.

To exercise your rights, you can write to: art@antoniocolonna.com

11. Complaint to the supervisory authority

The person concerned who considers that the processing of personal data is taking place in violation of current regulations has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), in accordance with the procedures indicated on the Authority’s institutional website.

12. Cookies

The site uses technical cookies and similar tools according to the configuration described in the Cookie Policy.

Some statistical and measurement tools may operate in limited mode before consent is given, without using the cookies normally associated with full measurement.

The complete analytical, marketing, attribution, profiling or remarketing functionality is used in accordance with the preferences expressed by the user and, where required, with prior consent.

For detailed information about the categories of cookies used, the purposes and the retention periods and regarding the methods for expressing, denying or revoking consent, the user can consult the Cookie Policy of the site.

Consult the Cookie Policy.

13. Changes to this privacy policy

The Data Controller reserves the right to update or amend this Privacy Policy at any time, including as a result of regulatory changes, technical updates to the website, the activation of new services or changes in the organisation of processing activities.

Any changes will be published on this page.