Privacy policy

Privacy Policy

Information on the processing of personal data pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR)

1. Data Controller

The Data Controller for personal data is Chefactory S.r.l., with registered office in Via Camillo Cavour 178r / 180r
50129 Firenze, VAT / Tax ID 02359570971, contact email:info.chefactory@gmail.com.

2. Types of Data Collected

Through this website (operating on the WooCommerce platform) and the use of our cooking class booking services, we collect various types of personal data:

• Browsing data: The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (IP addresses, domain names of computers, URI addresses of requested resources, time of request, etc.).
• Data provided voluntarily by the user: Personal and contact details (name, surname, email address, phone number, billing address) provided during registration, purchase, or booking of a cooking class.
• Payment data: Handled securely through external payment gateways (e.g., PayPal, Stripe, credit cards). Our website does not directly store complete payment card details.
• Preferences and allergy data: Any information regarding food intolerances, allergies, or dietary preferences voluntarily communicated by the user during the class booking process to ensure a safe cooking experience.
• Analytical data: Information collected via cookies and statistical analysis tools (Google Analytics).

3. Purposes and Legal Basis of Processing

The personal data collected will be processed for the following purposes and based on the corresponding legal grounds:

Processing Purpose	Legal Basis (GDPR)	Retention Period
Booking and class purchases management: Delivery of cooking services, confirmation management, WooCommerce invoicing, and customer support.	Performance of a contract (Art. 6.1.b GDPR)	10 years for tax and accounting obligations
Allergies/intolerances management: Protection of participants’ health and safety during practical cooking lessons.	Explicit consent (Art. 9.2.a GDPR) or vital interests	Duration strictly necessary for the event
Direct marketing and Newsletter: Sending commercial communications, promotions for new courses, or discounts via email (via WooCommerce or newsletter plugins).	Data subject consent (Art. 6.1.a GDPR)	Until consent is revoked (opt-out)
Statistical analysis (Google Analytics): Monitoring and analyzing traffic and user behavior to improve the website experience.	Consent via Cookie Banner (Art. 6.1.a GDPR)	In accordance with Google’s retention terms

4. Processing Methods and Security

Data processing is carried out using IT and/or electronic tools, with organizational methods and logics strictly related to the stated purposes. Specific technical and organizational security measures (including SSL/TLS encryption protocols for e-commerce transactions) are observed to prevent data loss, illicit or incorrect use, and unauthorized access.

5. Communication of Data to Third Parties and Processors

Personal data may be shared with third parties acting as Data Processors (e.g., hosting service providers, WooCommerce maintenance providers, payment service providers, tax and accounting consultants). Data will not be disseminated. Any transfer of data outside the European Economic Area (EEA) takes place in compliance with the appropriate safeguards provided by the GDPR (e.g., Standard Contractual Clauses).

6. Use of Google Analytics and Cookies

This website uses technical cookies necessary for the operation of the WooCommerce cart and session platform. In addition, subject to the user’s consent, it uses Google Analytics to collect aggregate statistical information on website usage. Google Analytics collects the user’s IP address (anonymized where configured) and tracks interactions with the site pages. Users can manage their cookie preferences at any time via the cookie banner or browser settings.

7. Rights of the Data Subject

Pursuant to Articles 15 et seq. of the GDPR, the user has the right to:

• Access their personal data, request its rectification or erasure;
• Restrict processing or object to it for legitimate reasons;
• Request data portability;
• Revoke consent at any time (without prejudice to the lawfulness of processing based on consent given before the revocation);
• Lodge a complaint with a competent supervisory authority (Data Protection Authority).

Requests should be sent via email to the Data Controller at the contact details provided in Section 1.

8. Changes to this Privacy Policy

The Data Controller reserves the right to make changes to this privacy policy at any time by notifying users on this page. It is therefore recommended to check this page regularly, referring to the date of the last modification indicated at the bottom.

Last updated: September 7, 2026