Privacy notice

If you are short on time, here is what matters.

• We collect data only when you type it in yourself, through the enrollment form or the contact form. Simply browsing leaves us nothing that identifies you.
• We do not sell, rent or pass on your data to anyone for commercial purposes.
• We do not profile you and we use no advertising cookies. Right now there is not even a visitor-statistics tool running.
• You can ask us at any time to show, correct or delete what concerns you, by writing to edu.italiamo@gmail.com.

The data controller — the party that decides why and how your data is used — is:

LEGAL NAME OF THE ENTITY REGISTERED IN LEBANON
FULL REGISTERED ADDRESS, BEIRUT, LEBANON
COMMERCIAL REGISTER NUMBER / REGISTRATION WITH THE MINISTRY OF ECONOMY AND TRADE

Contact point for anything concerning personal data: edu.italiamo@gmail.com.

italiAMO is the Italian language course taught by Maria Elisa Midulla. We have not appointed a data protection officer: Lebanese law does not require one, and given the size and nature of the activity none of the cases that make it mandatory under the GDPR apply. Requests therefore go to the address above, which is monitored directly.

The controller is established in Lebanon, so the primary reference is Lebanese Law No. 81 of 10 October 2018 on electronic transactions and personal data, in force since 31 March 2019 and enforced by the Ministry of Economy and Trade.

That law requires processing to be declared to the Ministry, but it exempts from the licensing requirement cases where processing is carried out with the data subject’s consent, processing by educational institutions, and processing of customers’ data in the ordinary course of business: collecting enrollments for a language course, with explicit consent, falls within those exceptions.

We also apply Regulation (EU) 2016/679 (GDPR). Partly because we must — anyone enrolling from Italy or another EU country falls under Article 3(2) — and partly by choice: the GDPR is the most protective of the standards in play, and applying one standard to everyone avoids treating two students differently depending on where they happened to be when they pressed “send”.

For cookies and tracking tools we follow Article 122 of the Italian Privacy Code (Legislative Decree 196/2003) and the cookie guidelines issued by the Italian Data Protection Authority on 10 June 2021. The detail is in the cookie policy.

Only what you hand us, through two forms.

Course enrollment form. First and last name, email address, phone number, country, city (optional), year of birth (optional), current level of Italian, target university (optional), your motivation written in free text, and how you heard about us (optional). Alongside these we store the language you were browsing in, the date and time of submission, and a technical browser string (the *user agent*, truncated to 200 characters) that helps us spot automated submissions.

Contact form. Name, email address, subject (optional), the text of your message and the language you would prefer a reply in, with the same technical data as above.

The motivation field is free text, and that deserves a warning: tell us what helps us understand your study plans, but do not include sensitive data — health conditions, political or religious views, legal matters. We do not need it and we would rather not hold it.

While you are simply browsing we collect nothing identifying: no profiling cookies, no measurement, no third-party content. Like any web server, the infrastructure hosting the site records technical access logs including IP addresses, for security and diagnostics; those logs are handled by the hosting provider and we do not use them to identify visitors.

• To handle your enrollment — assessing the application, getting back to you, organising classes and levels. Legal basis: steps taken at your request before entering into a contract, and then performance of that contract, Art. 6(1)(b) GDPR, together with the explicit consent you tick in the form, which is also what brings us within the exemption under Lebanese Law 81/2018.
• To answer your messages — legal basis: our legitimate interest in replying to people who write to us, Art. 6(1)(f) GDPR. An interest that coincides with yours, given that you contacted us.
• To make the site work and remember your cookie choice — legal basis: strictly necessary technical cookies, for which Art. 122 of the Italian Privacy Code requires no consent.
• To measure visits in aggregate form — legal basis: your consent, withdrawable at any time. This purpose is not pursued today: no statistics tool is installed. The entry stays in the preferences panel so that, if we ever install one, it remains off until you switch it on.
• To defend ourselves in the event of a dispute — legal basis: legitimate interest, within the retention periods set out below.

We will not send you marketing you did not ask for. If we ever start a newsletter, it will need its own separate consent, and unsubscribing will be as easy as subscribing.

With as few parties as possible.

Google Ireland Limited / Google LLC, through the Firebase services, acts as our data processor: Cloud Firestore holds the enrollments and messages, Firebase Hosting serves the pages, Firebase Authentication protects the private area. The relationship is governed by the Google Cloud data processing terms, which bind the provider to process data only on our instructions.

Beyond that, your data may be seen by Maria Elisa Midulla and those who help run the course, to the extent needed to organise it.

No one else. In particular: no advertising network, no data broker, no social media platform receives your data from us. If we were legally compelled to disclose it to a judicial or administrative authority, we would do so only against a valid request and only to the extent required.

A note on WhatsApp. The green button in the corner of the page is an ordinary link: until you tap it nothing happens and no data leaves. Once you open it, the conversation takes place inside WhatsApp — a service of Meta Platforms Ireland Limited, with its own terms and its own privacy notice. What you write to us there we treat like any other contact message, but the channel is not ours.

Data is stored on Google Cloud infrastructure, in the FIRESTORE DATABASE REGION — CHECK IN THE FIREBASE CONSOLE, e.g. eur3 (Europe) or nam5 (United States) region.

Lebanese Law 81/2018 is silent on transfers abroad, so it sets no conditions. The GDPR is not: where data leaves the European Economic Area, the transfer relies on the standard contractual clauses adopted by the European Commission and incorporated into the Google Cloud terms, supplemented by the technical measures Google states it applies (encryption in transit and at rest).

One fact worth stating plainly: the site’s typefaces are hosted by us, not loaded from Google Fonts. It is a small but real difference, because it stops your IP address reaching an outside server before you have read a single word of this page.

• Enrollment applications that do not go ahead (course not run, place not confirmed, withdrawal): up to 12 months from submission, so we can contact you about the next intake. Then they are deleted.
• Confirmed enrollments: for the duration of the course and the 24 months that follow, a period that covers issuing certificates and answering any dispute. Only the documents that Lebanese accounting and tax rules require us to keep stay longer, and only for as long as that.
• Messages received through the contact form: 24 months from the last exchange.
• The technical consent cookie: 6 months, after which the banner reappears and the choice has to be made again.
• Technical server logs: according to the hosting provider’s retention periods, typically a few months.

Once those periods expire the data is deleted. You can of course ask for deletion sooner: see the section on your rights.

You can ask us, at any time and free of charge:

• to know whether we process data about you and to receive a copy of it (access);
• to correct anything wrong or incomplete (rectification);
• to delete your data, where we no longer have a legitimate reason to keep it (erasure);
• to restrict its use while we look into a complaint of yours;
• to receive it in a machine-readable format, or have it transferred elsewhere (portability);
• to object to processing based on legitimate interest, explaining your situation;
• to withdraw a consent already given, without affecting the lawfulness of what was done before the withdrawal;
• to object at any time, with no reason required, to any use of your data for direct marketing.

The rights of access and rectification are also recognised by Lebanese Law 81/2018, along with the right to object to the use of data for marketing. We recognise the others because we apply the GDPR.

To exercise any of them, an email to edu.italiamo@gmail.com is enough. We reply within thirty days. We may ask for something that confirms your identity, but only if we have a reasonable doubt about who is writing — and never more information than it takes to settle it.

If our answer does not satisfy you. In Lebanon you can turn to the Ministry of Economy and Trade, which oversees Law 81/2018, or bring the matter before the competent court, including the Judge of Urgent Matters. If you are in the European Union you can lodge a complaint with your national supervisory authority; in Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it). We would be grateful if you tried us first — it is almost always faster.

The measures match what we hold, and they are these.

• The site runs over HTTPS only, with a certificate managed by Firebase Hosting.
• The database security rules let anyone create their own enrollment, but not read, edit or delete it: not their own, not anyone else’s. Only an authenticated administrator can read.
• Access to the private area requires authentication and is limited to a closed list of addresses.
• The forms reject fields that are not expected and enforce length limits, which keeps the attack surface small.
• Data is encrypted in transit and at rest by the Google Cloud infrastructure.

No measure is perfect. Should a breach occur that poses a high risk to your rights, we will tell you — Lebanese law does not require it, the GDPR does, and we follow the stricter rule.

The course is aimed at adults, or at people close to university entry. If you are under 18, enroll only with the consent of a parent or guardian, and give us an adult contact.

We do not knowingly collect data from children under 14. If you notice that we have, write to edu.italiamo@gmail.com and we will delete everything, no questions asked.

If anything substantial changes — a new purpose, a new recipient, a measurement tool — we will update this page and the date at the top, and for cookies we will bring the banner back so you can choose again. Earlier versions are available on request at edu.italiamo@gmail.com.