Privacy Policy
Information on the processing of personal data of users of the website www.cmtf.it, provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
Last updated: 23 October 2026
This is a translation of the Italian privacy policy. In case of discrepancy, the Italian version prevails.
1. Data controller
Centro Milanese di Terapia della Famiglia Srl
Via Leopardi, 19 – 20123 Milan, Italy
VAT no. IT06878870150 – REA MI 1123554
Phone: +39 02 4815350
Email: segreteria@cmtf.it
2. What data we process
Browsing data
The computer systems and software that run the website collect, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP address, browser type and operating system, date and time of the request, requested page, server response code. This data is used to ensure the operation and security of the website and is not used to identify or profile users.
Data provided voluntarily by the user
When a user fills in the contact form, we process the data they enter: first name, last name, email address, phone number (optional) and the text of the request. The same applies to data contained in messages sent directly to the email addresses shown on the website.
We ask users not to enter health data or other special categories of data (Art. 9 GDPR) in the form. If the request concerns a psychotherapy programme, the details will be collected later, in the settings and with the safeguards required for clinical activity.
Cookies
The website uses technical cookies, described in section 9 and in the Cookie Policy. It does not use profiling cookies, analytics or tracking tools. Third-party content that may set cookies (YouTube videos) is loaded only after the user has given consent.
3. Purposes and legal basis of processing
| Purpose | Legal basis |
|---|---|
| Responding to requests sent through the contact form or by email, providing information on courses, the school, seminars and services | Performance of pre-contractual measures or of a contract at the request of the data subject (Art. 6.1.b GDPR) |
| Ensuring the security of the website, preventing unauthorised access, spam and abuse | Legitimate interest of the Controller in protecting the website and its users (Art. 6.1.f GDPR) |
| Complying with legal obligations and requests from authorities | Legal obligation (Art. 6.1.c GDPR) |
| Defending a right in court | Legitimate interest of the Controller (Art. 6.1.f GDPR) |
The data is not used to send newsletters or promotional communications, nor transferred to third parties for marketing purposes.
4. Provision of data
Providing data is optional. However, the fields marked as required in the contact form are necessary to reply: without them, the request cannot be handled.
5. Processing methods and security measures
Data is processed electronically by personnel authorised and instructed by the Controller, using appropriate technical and organisational measures to prevent loss, unlawful use or unauthorised access. The website uses an encrypted connection (HTTPS), a web application firewall and protection systems against unauthorised access.
To protect the contact form from spam, when a message is submitted the system performs automatic checks on the data entered (for example, verifying that the email domain exists and comparing the IP address and email against the public list of spam senders of the StopForumSpam service). These checks do not lead to decisions producing legal effects on the user: at most, the message is blocked as spam.
The fonts used by the website are hosted on the website’s own server: displaying them does not involve sending any data to Google or other providers.
6. Recipients of the data
Data may be disclosed to:
- staff and collaborators of the Controller authorised to process it (office, administration);
- SupportHost, provider of the website hosting service (servers located in Germany), acting as data processor (Art. 28 GDPR);
- Aruba S.p.A., based in Italy, provider of the email service, acting as data processor;
- Elia Belli, responsible for the development and technical maintenance of the website, acting as data processor;
- StopForumSpam, an external anti-spam service consulted when the form is submitted, limited to the IP address and email address;
- public authorities, where required by law.
Data is not disseminated. The up-to-date list of data processors is available from the Controller on request.
7. Content from external platforms
Some pages of the website show videos hosted on YouTube, a service provided by Google Ireland Limited. Videos are blocked in advance and are loaded only after the user has given consent through the cookie banner. From that moment, YouTube may collect data (such as the IP address) and set its own cookies in accordance with its privacy policy: https://policies.google.com/privacy. Google may transfer data to the United States; such transfers take place on the basis of the EU-US Data Privacy Framework.
Consent can be changed or withdrawn at any time from the cookie settings available on the website.
8. Place of processing and transfers abroad
Data is processed at the Controller’s premises and on the servers of the hosting provider, located in Germany. The email service is provided in Italy.
A transfer outside the European Economic Area may occur only in the cases described in sections 6 and 7 (YouTube and StopForumSpam), on the basis of adequacy decisions of the European Commission or other safeguards provided for by Articles 44 et seq. of the GDPR.
9. Cookies
The website uses technical cookies, necessary for its operation, for which the user’s consent is not required (Art. 122 of the Italian Privacy Code and the Italian Data Protection Authority guidelines of 10 June 2021). It does not use profiling, marketing or analytics cookies. YouTube third-party cookies are set only after consent, as described in section 7.
The complete and up-to-date list of cookies used, with the purpose and duration of each, is available in the Cookie Policy, where users can also change their choices.
Users can delete or block cookies at any time from their browser settings; blocking technical cookies may prevent some parts of the website from working properly.
10. Retention period
- Requests sent through the contact form or by email: for the time needed to handle the request and in any case no longer than 24 months from the last contact, unless a contractual relationship follows (in which case the retention periods of that relationship apply, including the 10-year tax retention period).
- Website security and anti-spam logs: up to 30 days.
- Server technical logs: up to 12 months, unless needed to investigate offences.
The contact form does not store messages in the website database: requests are forwarded by email to the office.
11. Rights of the data subject
Users may exercise at any time the rights provided for by Articles 15-22 of the GDPR:
- access to their data and information on the processing;
- rectification of inaccurate or incomplete data;
- erasure of data;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest.
Requests should be sent to segreteria@cmtf.it or by post to the Controller’s address. We will reply within one month of receipt, extendable by two months in more complex cases.
Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where they live or work.
12. Minors
The website is not intended for children under 14, and the Controller does not knowingly collect data relating to them. If a parent or guardian believes that a minor has provided data through the website, they can request its deletion by writing to segreteria@cmtf.it.
13. Changes to this policy
The Controller may amend this policy, for example following changes in legislation or in the services used by the website. The version in force is always the one published on this page, with the date of the last update shown at the top.