Privacy policy

Last updated: 12 November 2026

This page explains what personal data I collect through the alessiazitoli.it website, why I collect it and what you can ask me to do with it. It is written pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Who processes your data

Little Stories by Zitoli is the newborn, pregnancy and family service of the Zitoli photography studio in Trani. On this page it is me speaking, Alessia Zitoli: I read and handle the enquiries that come in through the site, as a person authorised to process data on behalf of the studio.

The data controller is Benedetto Zitoli, VAT number 03793090725, REA BA-279154, based at Via Umberto 230, 76125 Trani (BT).

• Email: info@alessiazitoli.it
• Phone: +39 0883 588902

No data protection officer has been appointed, as the cases provided for under Article 37 of the GDPR do not apply.

What data I collect

The data you send me through the form

When you fill in the enquiry form I collect: name, phone number, email address, the service you are interested in, the expected date of the birth, the ceremony or the party, what stage you are at, and the text of your message.

This is the data I need to give you a useful reply. The expected date and where you are with things help me understand what window of time we are working with: for a newborn session, it makes all the difference whether the baby has not been born yet or is already three weeks old.

Together with the enquiry the site saves the IP address it comes from and the page you sent it from: they are used to protect the form against automated submissions and misuse. After sending, you receive a confirmation copy at the email address you gave.

Information about health

Two kinds of information you may give me concern health, which the GDPR treats as a special category of data (Article 9):

• the pregnancy and the expected due date, if you mention them in the form;
• allergies, medical conditions or anything else about the baby that I ask you to tell me before the session, as explained in the terms and conditions.

I process them only with your explicit consent: for the pregnancy you give it by ticking the box at the bottom of the form, for the information about the baby with a written statement when you book the session. I use them solely to organise the session and to work safely, I do not share them with third parties (they stay only within the hosting and email services listed below) and you can withdraw your consent at any time. If you would rather not give them, leave those fields empty: I will still reply.

Data collected automatically

The server that hosts the site records, as any web server does, the IP address of whoever connects, the date and time of the request, the page requested and the browser type. These are used to make the site work and to detect misuse.

Pages are delivered through the Cloudflare network, which acts as a content delivery network (CDN) and security filter: it processes the IP address, the browser type and the technical data of requests, solely to deliver the pages and protect the site.

What stays in your browser

The site saves an entry called lsz-consensi, in your browser's local storage, which remembers the choice made on the consent banner. It is not a profiling cookie, it does not travel to me and it does not identify anyone. You can find the detail in the cookie policy.

Why I process it, and on what legal basis

Purpose	Legal basis
Responding to your enquiry and preparing a quote for you	Steps taken at your request before entering into a contract (Art. 6.1.b GDPR)
Processing the pregnancy, the expected due date and information about the baby's health	Your explicit consent (Art. 9.2.a GDPR), which you can withdraw at any time
Carrying out the photography session, if you decide to book it	Performance of the contract (Art. 6.1.b GDPR)
Fulfilling tax and accounting obligations	Legal obligation (Art. 6.1.c GDPR)
Running the site and protecting it, form included, against misuse	Legitimate interest (Art. 6.1.f GDPR)
Publishing your photos on the site or on social media	Your written consent, separate and always revocable

Photographs, and especially those of children

The photographs I take during a session are personal data belonging to you and to whoever is pictured. I use them to deliver the finished work to you and for administrative obligations.

I never publish a photograph without written consent, and consent to publication is always separate from the contract: you can book a session and say no to publication, and nothing about it changes. For images depicting minors, the consent of both parents or of whoever holds parental responsibility is required.

This applies to this site too: every photograph of a child you see here is published with the written consent of whoever holds parental responsibility, and that consent can be withdrawn at any time.

Consent to publication can be withdrawn at any time by writing to info@alessiazitoli.it. Once withdrawn, I remove the images from the site and from the social media profiles I manage. Over copies already downloaded or shared by third parties I have no control, and it is only fair that you know this beforehand.

Who I share your data with

I do not sell or transfer your data to anyone. Only the following know it:

• the provider that hosts the site and the studio's email, on servers in the European Union, appointed as data processor pursuant to Article 28 of the GDPR: the form emails are sent from there, from info@lucianozitoli.it, the Zitoli studio mailbox;
• Cloudflare, Inc., for delivering the pages and for the security of the site, as data processor;
• Google: enquiry notifications also reach a Gmail mailbox I use for work, so the content of the form is also stored on Google's servers, which run that email service;
• the accountant and the consultants who handle tax matters, once you become a client;
• the printing labs, limited to the images required, if you order albums or prints;
• the authorities, if a law requires it of me.

Transfers outside the European Union

The site and the studio's email are hosted on servers in the European Union. Two services may involve a transfer of data to the United States: Cloudflare, for the technical browsing data, and Google, for the Gmail mailbox that receives the form notifications. Both companies participate in the EU-U.S. Data Privacy Framework, which the European Commission recognised as adequate in its decision of 10 July 2023.

If you give consent to third party content, the pages may also load elements provided by Meta or Google group companies (for example Instagram posts or a map). In that case the transfer takes place on the basis of the same adequacy decision or of standard contractual clauses. Without your consent that content is not loaded and no data leaves at all.

How long I keep it

• Enquiries that do not turn into a booking: up to twenty four months from the last contact, then I delete them. The same applies to the notification emails.
• Enquiries recognised as spam by the form's system: thirty days, then they are deleted automatically.
• Health information: only for the duration of the session, then I delete it; sooner, if you withdraw your consent.
• Contractual and tax data: ten years, as required by law.
• Delivered photographs: I keep them for as long as needed to be able to redo a delivery, and in any case no longer than what was agreed with you. You can ask me to delete them sooner.
• Server and Cloudflare logs: the technical time needed for security.

What you can ask me

At any time you can ask to access your data, to correct it, to delete it, to restrict its processing, to object to processing based on legitimate interest, and to receive the data in a machine readable format (portability). Where processing is based on consent, you can withdraw it whenever you like, without this affecting the validity of what was done before.

Write to info@alessiazitoli.it. I reply within one month.

If you believe that I am processing your data incorrectly you can lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it) or turn to the courts.

Is providing this data mandatory?

No, but without a name, a contact and a line about what you need I cannot reply to you. You can leave blank the fields not marked as mandatory: they only help me understand your situation better.

The box at the bottom of the form confirms that you have read this page and, if you mention the pregnancy or the expected due date, gives me your explicit consent for that information. The form will not send without the box ticked.

Automated decision making

I do not use any. I read and assess every enquiry myself. The form recognises automated advertising messages on its own, but only so as not to send them the confirmation copy: the enquiry still reaches me.

Changes to this notice

If I change anything, I update the date at the top of the page. If the change concerns consent, the banner reappears and asks you to choose again.