Privacy Policy

1. Who is responsible for your data, and keeping this Policy current

The data controller (titolare del trattamento) is STUDIA DI RENZO IVAN DIAZ DELGADO, registered office Strada Santa Maria Bianca 21, 27058 Voghera (PV), Italy; VAT (P.IVA) 11342870968; REA PV-334184. For everyday questions about this Policy, to update or withdraw a testimonial consent, or to exercise your rights, write to privacy@renzo-diaz.com; formal legal notices may be sent to the certified email (PEC) renzodiaz@postecert.it. No Data Protection Officer is appointed: the scale of processing does not require one under Article 37 GDPR. This Policy may be updated from time to time. The current version is always the one published here, with the "last updated" date at the top. Material changes affecting enrolled families will be communicated directly.

2. Information collected

• •Parent and student contact details (name, email, phone number).
• •Academic background provided at application and during the engagement (current grades, school, subject and level, target grade, timeline).
• •Session data: recordings of online sessions, written session summaries and notes, practice work, and AI-assisted progress reports generated from that material.
• •Payment and billing details, processed through third-party payment providers — card numbers are not stored by Renzo Diaz.
• •Website usage data (see the Cookies section).

3. How data is used, and the legal basis

• •To deliver and personalise tutoring and coaching sessions, including producing summaries, progress reports and study plans — necessary to perform the contract (Art. 6(1)(b) GDPR).
• •To record sessions and maintain the searchable archive the student keeps — necessary to perform the contract; recording is a defined feature of the Service and is also confirmed in the Client Agreement.
• •To process payments and keep accounting records — to perform the contract and to comply with legal tax and accounting obligations (Art. 6(1)(b) and (c) GDPR).
• •To improve the Services (teaching materials, dashboards, AI tooling) using data in aggregated or de-identified form wherever possible — legitimate interest in delivering a better service (Art. 6(1)(f) GDPR), balanced against your rights.
• •To communicate about scheduling, updates and support — necessary to perform the contract. Any optional or marketing communication relies on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Testimonials, reviews and case studies

• •Where a student or a parent has published a public review of the Services — for example on Google — Renzo Diaz may quote it on this website with a link back to the original, so a reader can verify it independently. This relies on the reviewer having chosen to make those words public themselves.
• •Publishing the categories that accompany the review — the student’s or parent’s first or full name, the subject and level, the school, the grade change, the university the student went on to attend, and a link to the review — is done only with that person’s separate, specific, opt-in consent (a parent’s or guardian’s where the student is a minor, including for the university), recorded with the date, the exact wording shown and its version.
• •A document or screenshot (a school notice, an email, a results screenshot) is authorised separately, one item at a time: the exact redacted version is shown to the person first, and it is published only where no other individual in it is identifiable. A link to a professional profile such as LinkedIn is published only with the adult former student’s own specific consent.
• •Consent is granular: you may agree to some items (for example, first name and subject) and decline others (for example, school name or exact grades).
• •Consent can be withdrawn at any time, as easily as it was given, by writing to privacy@renzo-diaz.com. On withdrawal, the material is removed from the site at the next update and from the structured data; content already cached by third parties such as search engines is outside Renzo Diaz’s control, and a removal request will be made where possible.
• •Absent consent, a case may still be described on the site only in genuinely de-identified form — no name, no school, no uniquely identifying detail — and any underlying documents or messages are withheld.

5. Data sharing and international transfers

• •Personal data is never sold, and never shared with third parties for their own marketing.
• •A small number of processors support the site and the Services: Google Analytics (usage analytics), Cookiebot (cookie-consent management), Elfsight (embedding the public Google reviews widget), and Typeform (the application form). Each processes data under its own terms and a data-processing agreement.
• •Some processors operate infrastructure outside the EU/EEA. Transfers are covered by the provider’s own safeguard — the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses.
• •Data may be disclosed to public authorities only where required by law.

6. Storage, security and retention

• •Data is stored on encrypted, access-controlled platforms.
• •Only Renzo Diaz and vetted processors, acting under instruction, have access.
• •Reasonable technical and organisational measures are in place to protect against unauthorised access, loss or misuse.
• •Session recordings, summaries and progress data: kept for the duration of the engagement and for up to 12 months after it ends, then deleted — unless you ask for earlier deletion, or a longer period is required to resolve a dispute.
• •Invoicing and accounting records: kept for 10 years, as required by Italian law (Art. 2220 of the Civil Code).
• •Application data from people who do not go on to enrol: kept for up to 12 months, then deleted.
• •Testimonial and media consents: kept for as long as the related content is published, and for a short period afterwards as a record that consent existed; withdrawn consents are logged as withdrawn.

7. Minors

Where the student is under 18, all data is provided by, and the processing described here is consented to by, a parent or legal guardian, who also exercises the student’s rights on their behalf. Child-specific data — session recordings, academic and progress data, and school name — is treated with particular care, and is never used for testimonials or marketing without the guardian’s specific opt-in consent. Italy sets the age of digital consent at 14 (Art. 2-quinquies of the Data Protection Code); in this practice a guardian consents regardless of the student’s age, because the guardian is the contracting party.

8. Your rights

Under the GDPR you have the right to request access to your data; to have it corrected or completed; to have it erased ("right to be forgotten"); to restrict or object to processing; to receive your data in a portable format; and to withdraw any consent at any time without affecting processing already carried out. To exercise any of these, write to privacy@renzo-diaz.com (or the PEC address for a formal notice); a response follows within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, garanteprivacy.it) if you believe your data has been handled unlawfully.

9. Cookies and analytics

• •Cookiebot is used as the consent-management platform. Non-essential cookies are blocked until you consent.
• •Cookies are used for essential site functionality, analytics (Google Analytics), and embedded content (the Elfsight reviews widget).
• •You can review or change your choices at any time through the cookie settings link, or by clearing cookies in your browser.

Data controller and company information

• •Legal name: STUDIA DI RENZO IVAN DIAZ DELGADO
• •Registered office: Strada Santa Maria Bianca 21, 27058 Voghera (PV), Italy
• •VAT number (Partita IVA): 11342870968
• •Business Register number (REA): PV - 334184
• •PEC: renzodiaz@postecert.it