Privacy Policy

This page describes what personal data ActiLab collects today and why. Sections for features that don't exist yet (Academy accounts, certificates, payments) will be added once those are actually built — nothing here describes data flows that aren't real yet.

Data controller

Giacomo Scarpellini, operating ActiLab. For any question or to exercise your rights (see below), contact: info@actilab.eu.

Hosted and protected under EU law

Everything ActiLab holds — see below for exactly what and why — is processed on servers located in the European Union, under the GDPR, one of the strictest data-protection frameworks in the world: it gives you enforceable rights (access, correction, erasure, portability) and requires us to justify every piece of data we collect.

Newsletter

Data collected: your email address only.

Purpose and legal basis: to send you occasional newsletter emails, based on your consent (GDPR Art. 6(1)(a)). You give consent explicitly by ticking the checkbox on the signup form, and it's confirmed via double opt-in: nothing is sent to you until you click the confirmation link in the email you receive.

Retention: if you never confirm, your address is deleted automatically within about 9 days. If you confirm, it's kept until you unsubscribe (a link is included in every email) or ask us to delete it.

Who processes it: emails are delivered through Amazon SES (Amazon Web Services), acting as our data processor. The only data shared with SES is your email address, needed to deliver the message. Sending infrastructure is hosted in an EU region, and AWS's standard GDPR Data Processing Addendum applies to this processing.

Your rights: you can withdraw consent (unsubscribe) at any time, and you can ask us at any time to access, correct, or delete the data we hold about you, by writing to info@actilab.eu.

Technical and security logs

To keep the site secure — for example, to limit abuse of the newsletter signup form — our web server temporarily logs technical data including IP addresses. This is based on our legitimate interest in operating the site securely (GDPR Art. 6(1)(f)), not on consent. These logs are kept for a limited time (up to 30 days) and are not used for any other purpose. This is separate from the traffic analytics described in the Cookie Policy: those specifically do not store your IP address.