Privacy and cookies

Ostia International School S.r.l.

Via Andrea Corsali 10/12, 00122 Ostia Lido (Rome), Italy

Privacy notice (Articles 13 and 14 of EU Regulation 2016/679)

Your personal data is used by OSTIA INTERNATIONAL SCHOOL S.r.l., as data controller, in line with the data protection principles of EU Regulation 2016/679 (GDPR).

Data controller and contact details

• Data controller: OSTIA INTERNATIONAL SCHOOL S.r.l., Via Andrea Corsali 10/12, 00122 Ostia Lido (Rome), Italy
• Email for any request about your data: info@ostiainternationalschool.it
• Person responsible for data processing: Maurizio Conti

How and why we process your data

Data is processed both electronically and on paper, for the following purposes:

• running the Ostia International School and meeting the related obligations;
• employment contracts;
• providing educational services;
• school trips and guided visits;
• health and safety at work;
• school administration and pupil support;
• publishing photos, images and texts about school events and activities;
• school transport.

Legal basis and whether you must provide your data

Providing your data is mandatory where it is required by law or by contract: if you refuse to provide it, in whole or in part, we may be unable to provide the services you have asked for.

The school processes optional data on the basis of your consent, given by explicitly accepting this notice, for the purposes and in the ways described here.

Who may receive your data

Apart from disclosures required by law or by contract, the data collected may be shared, only for the purposes listed above, with the following categories of recipients:

• associations and local authorities;
• clients and users;
• the municipality and other local authorities;
• consultants and independent professionals, including firms;
• employers;
• social security and welfare bodies;
• the tax authorities and other public bodies;
• family members of the data subject;
• internal managers;
• archiving and records management providers.

The following authorised persons and internal and external processors, appointed in writing and given specific written instructions, may also have access to the data:

• Maurizio Conti, legal representative;
• external consultants and professionals;
• teachers and staff, employees and collaborators.

Transfers outside the European Union

The school does not transfer personal data outside the European Union. The only exceptions are some technical services used by the website, whose providers are based in the United States (Cloudflare, Resend and, only with your consent, Google): in these cases data is transferred with the safeguards required by the GDPR, such as the EU-US Data Privacy Framework or standard contractual clauses. See "Cookies and third-party services" below for details.

IT systems

• Activity: nursery schools
• IT system: on-site, internal
• Location: registered office (Lido di Ostia)

Processing principles

Data is processed in line with the principles of Article 5 GDPR: lawfully, fairly and transparently, for specified and explicit purposes, limited to what is necessary, kept accurate and up to date, stored no longer than needed, and protected by appropriate technical and organisational measures. The controller is responsible for complying with these principles and can demonstrate it.

Processing is based on one of the conditions set out in Article 6 GDPR: the data subject's consent, the performance of a contract or of pre-contractual steps, a legal obligation, the protection of vital interests, a task in the public interest, or the controller's legitimate interests, unless they are overridden by the data subject's rights, especially where the data subject is a child.

For children's data, consent, where needed, is given or authorised by the holder of parental responsibility. Special categories of data (Article 9 GDPR, for example health data) are processed only in the cases allowed by that article.

The full text of the Regulation is available on EUR-Lex.

How long we keep your data

Data required for contractual and accounting purposes is kept for as long as the business and accounting relationship requires.

Data of people who have been in touch with the school but do not go on to use its services will be deleted or anonymised, unless keeping it is otherwise justified or they have validly consented to later promotional or market research activities.

Unless stated otherwise, data is kept for one year.

Your rights

Under the GDPR and Italian law, and within the limits they set, you have the right to:

• ask whether we hold personal data about you (right of access);
• know where it came from;
• receive it in an intelligible form;
• be told the logic, methods and purposes of the processing;
• have it updated, corrected, completed, erased or anonymised, and have data processed unlawfully blocked, including data no longer needed for the purposes it was collected for;
• where processing is based on consent, receive the data you provided in a structured, commonly used and machine-readable format;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it;
• lodge a complaint with a supervisory authority.

To exercise your rights, simply write to info@ostiainternationalschool.it.

When can you object to processing? (Article 21 GDPR)

On grounds relating to your particular situation, you can object at any time to the processing of your personal data when it is based on legitimate interests or carried out for marketing purposes, by writing to the controller at the email address above.

You have the right to have your data erased unless the controller has an overriding legitimate reason to keep it, and in any case if you have objected to processing for marketing purposes.

Who can you complain to? (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you can lodge a complaint with the competent supervisory authority in Italy, the Garante per la protezione dei dati personali, or with the authority of the Member State where the infringement took place.

Cookies and third-party services

This section describes the website in its current version (updated October 2026).

The website does not use profiling cookies and shows no advertising. No third-party content that sets cookies is loaded when a page opens.

• Visit statistics: we use Cloudflare Web Analytics, which measures visits in aggregate form, without cookies and without identifying individual visitors.
• Google Analytics 4 (only with your consent): if you choose "Accept" in the banner, we use Google Analytics 4 (Google Ireland Ltd.) for aggregate statistics on how the site is used: pages visited and actions such as sending the contact form or tapping the phone, WhatsApp and email links. It sets the _ga and _ga_* cookies, which last up to 2 years. Google Analytics 4 does not store IP addresses; advertising signals and ad personalisation are turned off. What you type in the contact form is never sent to Google. Data may be transferred to the United States under the EU-US Data Privacy Framework. Without your consent Google Analytics is not loaded. Your choice is remembered in your browser and you can change it at any time from the "Cookie preferences" link at the bottom of every page.
• Contact form: the data you enter (name, email, phone, reason for your request, message and any optional details, such as the Open Day date, visit preferences, your child's year of birth, the year you would like to start and how you heard about us) is used only to answer your request, as a pre-contractual step you have asked for (Article 6(1)(b) GDPR). It is emailed to the school office through the Resend email service and kept for the period stated above. The Cloudflare Turnstile spam check verifies that the form is not filled in by an automated program, without profiling cookies.
• YouTube videos: videos are loaded only when you choose to watch them, through the youtube-nocookie.com domain. From that moment Google's privacy policy applies.
• Google Maps: the map is loaded only if you click "Show the map". From that moment Google may set its own cookies, according to its policy.
• Social networks and WhatsApp: the links to Facebook, Instagram and WhatsApp are plain links and load no third-party content until they are clicked.
• Hosting: the website is hosted by Cloudflare, which processes technical browsing data such as IP addresses for security and operation.

You can manage or delete cookies at any time in your browser settings.