Privacy Notice

The controller of the personal data collected through the site is the operator of Sarfatti Strategy. You can contact us at [email protected].

For anything concerning personal data, including the rights described at point 9, write to [email protected].

No Data Protection Officer has been appointed, as the conditions in Article 37 GDPR do not apply. Please use the contact details above.

We process only the categories listed below. We do not process special categories of data under Article 9 GDPR and we do not ask you to provide them.

Article 6 GDPR permits processing only where one of the legal bases it lists applies. For each purpose, the basis we rely on is stated below.

Providing account, booking and payment data is necessary to enter into and perform the contract: without it we cannot activate the service. Providing data that depends on consent is entirely optional, and refusing does not affect your access to the services in any way.

We do not sell your data and we do not pass it to third parties for their own purposes. We do use suppliers who process data on our behalf, appointed as processors under Article 28 GDPR, and parties acting as independent controllers for obligations imposed on them by law.

Data may also be shared with professionals advising us on accounting, tax and legal matters, and with public authorities where disclosure is required by law or necessary to establish or defend a legal claim.

Tutors assigned to individual sessions are given access only to the data needed to deliver the session assigned to them.

The database holding your account, booking and simulation data is located in the European Union, in the eu-west-3 (Unione europea, Parigi) region. Storage alone therefore involves no transfer to a third country for that data.

Some of the suppliers listed at point 4 are, however, companies established in the United States and may access or process data outside the European Economic Area. The GDPR permits such transfers only where adequate safeguards are in place.

On 10 July 2023 the European Commission adopted an adequacy decision on the EU-U.S. Data Privacy Framework under Article 45 GDPR: transfers to United States organisations certified under that framework need no further authorisation. The General Court of the European Union confirmed the decision's validity on 3 September 2025. Stripe and Cloudflare appear on that list as active participants.

For suppliers not covered by the adequacy decision, transfers rely on the standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR, as provided for in the data processing agreements in place with each of them.

You can request a copy of the safeguards applied by writing to [email protected].

Article 122 of Legislative Decree 196/2003 allows information to be stored on your device, or already stored information to be accessed, only with your consent. Tools strictly necessary to provide a service you have explicitly requested are exempt.

The site uses the following tools, and no others.

On your first visit a banner appears that follows the guidelines on cookies and other tracking tools adopted by the Italian Data Protection Authority on 10 June 2021. It lets you accept or refuse using commands of identical size, emphasis and colour, and it can be closed using the command marked with an X: in that case only the default settings remain, meaning no non-essential cookies.

Continuing to browse, scrolling the page or doing nothing does not count as consent. Access to content is in no way conditional on accepting non-essential cookies.

You can change or withdraw your choice at any time through the "Cookie preferences" link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out beforehand. You can also delete cookies already set from your browser settings.

We keep data only as long as necessary for the purposes for which it was collected, and afterwards for any period the law requires us to retain it or during which it may be needed to establish or defend a legal claim.

Our services are also aimed at students preparing for university admission, who may be under 18.

Article 8 GDPR and Article 2-quinquies of Legislative Decree 196/2003 provide that, in Italy, a minor who has reached the age of fourteen may validly consent to the processing of their personal data in relation to information society services offered directly to them. Below the age of fourteen, processing based on consent is lawful only where consent is given by the holder of parental responsibility.

The capacity to consent to data processing is separate from the capacity to enter into a contract, which is dealt with in the Terms and Conditions.

If you believe a minor has provided personal data without the required consent, write to [email protected]: we will check and delete it.

The GDPR gives you the following rights, which you can exercise free of charge.

• Access (Art. 15): obtain confirmation that processing is taking place and a copy of the data, together with information on purposes, recipients and retention periods.
• Rectification (Art. 16): correct inaccurate data and complete incomplete data.
• Erasure (Art. 17): have data deleted in the cases provided for, including where it is no longer needed or consent has been withdrawn.
• Restriction (Art. 18): require that data only be stored and not otherwise processed, in the cases provided for.
• Portability (Art. 20): receive, in a structured, commonly used and machine-readable format, the data you provided that we process on the basis of consent or contract, and have it transmitted to another controller.
• Objection (Art. 21): object at any time, on grounds relating to your particular situation, to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights write to [email protected]. We will respond without undue delay and in any event within one month of the request, extendable by two months where the request is particularly complex, in which case we will tell you.

We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR. Automatic scoring and the statistics on your weaker areas are the very service you asked for and do not give rise to decisions of that kind.

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority under Article 77 GDPR. In Italy the competent authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it.

You also retain the right to an effective judicial remedy under Article 79 GDPR, regardless of any complaint.

We apply appropriate technical and organisational measures under Article 32 GDPR. These include encrypted connections in transit across the whole site, passwords stored as hashes and never in clear text, row-level access rules on the database preventing one user from reading another's data, and administrative access restricted to authorised personnel.

We may update this notice to reflect changes to the services, to our suppliers or to the law. The date at the top shows when it was last updated. Where changes materially affect the processing we will give you reasonable advance notice and, where required, ask for fresh consent.