Privacy notice

This notice explains how the personal data of users who visit this website and use its contact and service request forms are processed, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).

1. Data controller

The data controller is Federico Lupica, Human Design System Analyst and Teacher.
Email: federico.lupica.hds@gmail.com — Phone/WhatsApp: +39 338 139 1827.
Italian VAT number: 03944760135.

2. Categories of personal data processed

  • Contact form data (“Contact me”): first name, surname, email address, message content and service of interest.
  • Service request form data (“New client”): first name, surname, date, time and place of birth, Italian tax code, postal address and email address.
  • Browsing data: data automatically collected by IT systems in the server log files, such as IP address, browser type, and the date and time of the request.

Birth details—date, time and place—are used exclusively to produce the Human Design chart required for the requested service. These details do not constitute special categories of personal data under Article 9 GDPR, and the service has no medical, diagnostic or therapeutic purpose.

3. Purposes of processing and legal bases

  • Responding to enquiries submitted through the contact form — legal basis: the data subject’s consent and/or taking steps in response to the data subject’s request (Article 6(1)(a) and (b) GDPR).
  • Providing the Human Design analysis or training service — legal basis: performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
  • Compliance with administrative, accounting and tax obligations, such as invoicing, for which an Italian tax code and address are required — legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

The provision of data marked as mandatory is necessary in order to respond to the request or provide the service. If these data are not provided, the request cannot be fulfilled.

4. How personal data are processed

Personal data are processed using electronic and IT systems, with appropriate technical and organisational measures to ensure their security, confidentiality and integrity, and only for as long as strictly necessary for the stated purposes.

5. Recipients of personal data

Personal data may be processed by parties acting as processors or persons authorised to process the data, including:

  • the website hosting provider, Hetzner Online GmbH (Germany), where submissions made through the forms are stored;
  • Google LLC / Google Ireland Ltd., as provider of the email service (Gmail) used to receive enquiries;
  • Cloudflare, Inc., for antispam protection of the contact forms through Cloudflare Turnstile;
  • the tax adviser/accountant, for accounting and tax compliance;
  • public authorities, where required by law.

Personal data are not made public or disclosed to third parties for marketing purposes.

6. Transfers of personal data outside the EU

The use of Google (Gmail) and Cloudflare (Turnstile) services may involve the transfer of personal data to the United States. Such transfers are based on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and/or participation in the EU–US Data Privacy Framework.

7. Retention periods

  • Contact enquiries: for the time required to handle the enquiry and subsequently for no longer than 24 months.
  • Client data: for the duration of the relationship and, in the case of accounting and tax documents, for the period required by law, normally 10 years.

8. Cookies and analytics

The website uses technical cookies that are necessary for its operation and do not require consent. Some pages, such as “The Rave Mandala”, embed video content from YouTube (Google). These videos are loaded only after the user explicitly clicks on them, using YouTube’s privacy-enhanced mode at youtube-nocookie.com, so no third-party cookies are placed without user interaction. Users can manage or delete cookies at any time through their browser settings. As the website does not use profiling or marketing cookies, no cookie consent banner is displayed.

For visitor statistics, the website uses Burst Statistics, a self-hosted analytics tool installed on the website itself. It is cookie-free and uses anonymised data: it does not use profiling cookies, track users across different websites or share data with third parties. Google Analytics is not used. Antispam protection for the forms is provided by Cloudflare Turnstile, which does not use tracking cookies to profile users.

9. Rights of the data subject

The data subject may exercise at any time the rights provided for in Articles 15–22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection, as well as withdrawal of consent, without affecting the lawfulness of processing carried out before consent was withdrawn. Requests should be sent to federico.lupica.hds@gmail.com. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

10. Automated decision-making

No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out.

Last updated: 3 June 2026.