In the theater, what happens behind the scenes is not seen from the audience: It is protected, guarded, never exposed. We do the same with your data.

This information is provided pursuant to Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 ("GDPR"), as well as Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 ("Privacy Code"), in relation to the website ifprana.com.

1. Data Controller

The Data Controller is:

Association IF Prana APS Headquarters: via Volturno, 19 – 55045 Pietrasanta (LU) C.F.: 92052220461 — VAT number: 02257890463 E-mail: info@ifprana.it — JEP: ifprana@pec.it

For any request relating to the processing of personal data, it is possible to contact the Data Controller at the addresses indicated above.

2. Types of data processed

The following categories of personal data may be processed through the website:

a) Navigation data The computer systems and software procedures used to operate the site acquire, during their normal operation, some data whose transmission is implicit in the use of Internet protocols. These include, but are not limited to: IP addresses, domain names of the devices used, URI/URL of the requested resources, time of the request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the server’s response and other parameters relating to the user’s operating system and IT environment.

b) Data provided voluntarily by the user The optional, explicit and voluntary sending of messages to the contact addresses indicated on the website, as well as the completion of the contact form on the ‘For information’ page, involves the acquisition of the sender’s contact details and any other personal data included in the communication. In particular, the contact form is used to process:

• name;
• e-mail address;
• the content of the message;
• any other data provided spontaneously by the user in the text of the message.

The submission of the form automatically generates, for security and anti-spam purposes, the collection of additional technical data attached to the communication: date and time of submission, page URL, IP address and device user agent. A copy of the request is kept in the reserved area of the site (Elementor Submissions), containing IP address and user agent, and is accessible only to site administrators.

c) Data relating to requests on shows, workshops and events If the user submits requests relating to performances, participation in workshops, courses, events or other initiatives of the company, the data necessary to manage the request may be processed, such as name and surname, contact details, data relating to the event or initiative of interest and any notes communicated by the user.

d) Data processed through cookies or other tracking tools The site uses only technical cookies and does not install profiling or analytical cookies subject to consent. For details, please refer to the Cookie Policy.

e) Data transmitted to embedded content providers The main page of the site shows the contents of the company's Instagram profile. Images and videos are uploaded directly from Meta Platforms servers: simple page loading involves the transmission of the visitor’s IP address to Meta, regardless of any interaction. The opening video is instead a file hosted directly on our servers and does not involve external suppliers.

3. Purpose of the processing and legal basis

Personal data are processed for the following purposes:

a) Allow navigation and operation of the site — legitimate interest of the Data Controller (Article 6(1)(f) GDPR).

b) To respond to requests sent by the user via contact form or e-mail addresses — execution of pre-contractual measures at the request of the data subject and/or legitimate interest of the Data Controller (Article 6(1)(b) and (f) GDPR).

c) Manage requests relating to shows, workshops and events — performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

d) Preventing and combating spam via the contact form – legitimate interest of the Data Controller (Article 6(1)(f) GDPR).

e) Fulfilment of legal obligations – Art. 6(1)(c) GDPR.

4. Nature of the provision of data

The provision of navigation data is necessary to allow the operation of the systems that allow the use of the site.

The provision of the data requested in the contact form is optional; however, failure to provide the mandatory data (name, e-mail, message) will make it impossible for the Data Controller to follow up on the request.

5. Methods of treatment

The processing of personal data takes place using manual, IT and telematic tools, with logic strictly related to the purposes indicated and adopting appropriate technical and organizational measures to ensure the security, integrity and confidentiality of the data. No automated decision-making processes or user profiling activities are carried out.

6. Recipients of the data

Personal data may be communicated, within the limits of the purposes indicated above, to subjects who operate as independent data controllers or data processors, including, by way of example:

• Automattic Inc. — provider of the hosting platform WordPress.com and the anti-spam service Akismet, the latter being used to analyse the content of messages sent via the contact form in order to detect and block unsolicited communications;
• Meta Platforms Inc. — provider of Instagram content embedded on the main page, which receives the visitor’s IP address when the page is loaded, acting as an independent controller in accordance with its own policy;
• subjects that take care of the technical maintenance of the site;
• e-mail providers;
• administrative, tax and legal advisors;
• public authorities or bodies, in the cases provided for by law.

The data are not transferred to third parties for commercial or advertising purposes. The updated list of data processors can be requested from the Data Controller.

7. Transfer of data to non-EEA countries

The suppliers Automattic Inc. and Meta Platforms Inc. are based in the United States. Data transfers to these entities take place in compliance with Articles 44 et seq. of the GDPR, on the basis of the adequacy decision of the European Commission relating to the EU-U.S. Data Privacy Framework, to which the aforementioned suppliers adhere, and/or the standard contractual clauses approved by the European Commission.

For more information: Automattic Privacy Policy — Meta Privacy Policy.

8. Retention period

Personal data will be kept for a period of time not exceeding that necessary to achieve the purposes for which they are processed. In particular:

• data collected through the contact form (e-mail received and a copy saved in the reserved area of the site): 12 months from receipt of the message, unless the request gives rise to a further report;
• data on requests for shows, workshops and events: for the time necessary to manage the request and the subsequent obligations;
• administrative and accounting data, where applicable: 10 years, pursuant to Article 2220 of the Civil Code;
• technical and security logs: for the period defined by the hosting provider, according to the relevant information.

9. Rights of the data subject

The data subject may exercise, within the limits provided for in Articles 15-22 of the GDPR, the following rights: access to personal data; rectification of inaccurate data; erasure of data, including requests saved in the reserved area of the site; limitation of processing; opposition to processing, where applicable; data portability, where applicable; revocation of consent at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation.

Requests can be sent to: info@ifprana.it or ifprana@pec.it.

The interested party also has the right to lodge a complaint with the Guarantor for the protection of personal data (www.garanteprivacy.it).

10. Minors

The site is aimed at a general audience. If data relating to minors are collected in the context of specific activities, initiatives or laboratories, the processing will take place in compliance with the applicable legislation and, where necessary, with the involvement of those exercising parental responsibility.

11. Third Party Sites

The site may contain links to third-party sites, platforms or services (including the Association’s social profiles on Instagram, Facebook and Threads and sharing buttons). These subjects operate as independent data controllers according to their respective privacy policies, which we invite you to consult.

12. Changes to this policy

The Owner reserves the right to update this Privacy Policy at any time, in particular in the event of regulatory changes, changes in the services or technologies used, or updates to the technical infrastructure of the site. Any changes will be published on this page, with an indication of the new update date.

This statement faithfully describes the configuration of the site and the data processing practices in place on the date indicated at the bottom. The third-party service providers mentioned (Automattic Inc., Meta Platforms Inc.) are autonomous entities whose policies may evolve independently of our will: It is recommended to regularly consult the respective official information sheets to check that they are up to date.

The continuation of navigation of the site after the publication of changes to this information does not constitute implicit acceptance of the same: if the changes concern processing operations that require the consent of the data subject, this consent will be collected in an appropriate manner before the start of the modified processing operation.

Date of last update: 23/07/2026