Last updated: 16 April 2026
1. Data Controller
The Data Controller for this website is:
EUROPASS FOUNDATION ETS (hereinafter referred to as “the Company” or “we”)
Via dei Servi 49
50122 Florence
Italy
For any questions regarding this policy or the processing of your personal data, you may contact us at the address provided on the website.
2. Introduction
This Privacy and Cookie Policy describes how EUROPASS FOUNDATION ETS collects, uses, and protects information relating to users who visit this website (hereinafter “the Site”), in accordance with:
- Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
- Italian Legislative Decree no. 196/2003 (Privacy Code), as amended by Legislative Decree no. 101/2018
- Italian Data Protection Authority (Garante per la protezione dei dati personali) guidelines on cookies and tracking tools
3. Hosting and Data Location
This website is hosted on servers located in Italy. All data collected through the Site is stored and processed within the European Economic Area (EEA), in compliance with the GDPR.
4. Data Collected and Purposes of Processing
4.1 Navigation Data (Technical Data)
During normal operation, the systems and software procedures that run this website automatically acquire certain data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified users, but by its nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes: IP addresses, browser type and version, operating system, referring URLs, pages visited, time of visit, and other parameters related to the user’s operating system, computing environment, and hosting provider.
This data is used solely for:
- Ensuring the correct functioning of the Site
- Statistical analysis in anonymous, aggregate form
- Security purposes and to detect any abuse
Legal basis: Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR). Retention period: Navigation data is retained for a maximum of 7 days, except where needed to investigate crimes or offences.
4.2 Data Collected via Google Analytics
This Site uses Google Analytics, a web analytics service provided by Google LLC (hereinafter “Google”). Google Analytics collects information about how users interact with the Site through the use of cookies and similar tracking technologies.
The data collected may include:
- Pages visited and time spent on each page
- Traffic source (direct, organic search, referral, etc.)
- Geographic location (country/city level)
- Device type, browser, and operating system
- User behaviour flows across the Site
This data is processed by Google on behalf of Europass S.r.l. and may be transferred to Google’s servers in the United States. Such transfers are carried out in compliance with applicable data protection law, including through Standard Contractual Clauses approved by the European Commission.
This website uses Google Analytics with IP anonymisation enabled (anonymizeIp), meaning the last octet of users’ IP addresses is masked before storage.
You can opt out of Google Analytics tracking at any time by:
- Installing the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout
- Managing your cookie preferences via our cookie banner
For more information on how Google processes data, please refer to Google’s Privacy Policy: https://policies.google.com/privacy
Legal basis: User consent (Art. 6(1)(a) GDPR), collected via the cookie consent banner. Retention period: Analytics data is retained for 14 months (as configured in Google Analytics settings).
4.3 Data collected to manage cookies
To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.
The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
4.4 Anti-Spam Protection (Cloudflare Turnstile)
This Site uses Cloudflare Turnstile, an anti-spam and bot-detection service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile is used to protect the Site from automated abuse and malicious traffic, without relying on intrusive visual challenges (such as traditional CAPTCHAs).
Cloudflare Turnstile may collect and process certain technical information from your device, including:
- IP address
- Browser type, version, and language settings
- Operating system and device characteristics
- Interaction signals and behavioural data used to distinguish human users from automated bots
This data is processed by Cloudflare on its infrastructure, which may involve transfers to servers located outside the European Economic Area, including the United States. Such transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission, as described in Cloudflare’s privacy documentation.
Cloudflare Turnstile does not set persistent tracking cookies and is designed to operate with minimal data collection. For further information on how Cloudflare processes data, please refer to Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/
Legal basis: Legitimate interest of the Data Controller in protecting the security and integrity of the Site (Art. 6(1)(f) GDPR).
Retention period: Transient technical data processed by Cloudflare Turnstile is not retained beyond what is strictly necessary for the security check, in accordance with Cloudflare’s data retention practices.
5. Cookie Policy
5.1 What Are Cookies?
Cookies are small text files stored on your device (computer, tablet, smartphone) when you visit a website. They are widely used to make websites work more efficiently and to provide information to website owners.
5.2 Cookies Used on This Site
This Site uses the following categories of cookies:
Technical / Strictly Necessary Cookies
These cookies are essential for the Site to function correctly. They do not collect any personally identifiable information and cannot be disabled.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
wordpress_* | Europass S.r.l. | WordPress session management | Session |
wp-settings-* | Europass S.r.l. | User interface preferences (admin only) | 1 year |
PHPSESSID | Europass S.r.l. | Server session management | Session |
| Cookie consent preference | Europass S.r.l. | Stores the user’s cookie consent choice | 12 months |
Legal basis: Not required — strictly necessary cookies are exempt from consent requirements under applicable law.
Analytics Cookies (Third-Party)
These cookies are set by Google Analytics to collect information about how users use the Site. They help us understand which pages are most popular and how users navigate the Site.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes unique users | 2 years |
_ga_* | Google Analytics | Maintains session state (GA4) | 2 years |
_gid | Google Analytics | Distinguishes unique users | 24 hours |
_gat | Google Analytics | Throttles request rate | 1 minute |
Legal basis: User consent (Art. 6(1)(a) GDPR).
5.3 Managing Cookie Preferences
When you first visit this Site, a cookie banner will be displayed, giving you the option to accept or decline analytics cookies. You can change your preferences at any time.
In addition, you can manage or delete cookies directly through your browser settings. Please note that disabling certain cookies may affect the functionality of the Site. For instructions on how to manage cookies in your browser, refer to:
- Google Chrome: https://support.google.com/chrome/answer/95647
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
- Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
- Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge
6. Data Sharing and Disclosure
Europass S.r.l. does not sell, trade, or rent users’ personal data to third parties.
Data may be shared with:
- Google LLC, as a data processor, solely for the purpose of website analytics (as described in Section 4.2)
- Hosting and infrastructure providers, operating within Italy/EEA, for the purpose of maintaining the Site
- Competent authorities, where required by law or to protect the legitimate rights of the Company
All third-party processors have been engaged under appropriate data processing agreements in compliance with Art. 28 GDPR.
7. Data Retention
Personal data collected through this Site is retained only for as long as necessary to fulfil the purposes for which it was collected, and in any case no longer than required by applicable law. Specific retention periods are set out in Section 4 above.
8. Your Rights Under the GDPR
As a data subject, you have the following rights in relation to your personal data:
- Right of access (Art. 15): the right to obtain confirmation of whether your data is being processed and to receive a copy
- Right to rectification (Art. 16): the right to have inaccurate data corrected
- Right to erasure (Art. 17): the right to have your data deleted (“right to be forgotten”)
- Right to restriction of processing (Art. 18): the right to restrict how your data is used in certain circumstances
- Right to data portability (Art. 20): the right to receive your data in a structured, machine-readable format
- Right to object (Art. 21): the right to object to processing based on legitimate interests
- Right to withdraw consent (Art. 7(3)): where processing is based on consent, the right to withdraw it at any time without affecting the lawfulness of prior processing
- Right to lodge a complaint: you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it
To exercise any of the above rights, please contact Europass S.r.l. at the contact details provided on the Site.
9. Changes to This Policy
Europass S.r.l. reserves the right to update or amend this Privacy and Cookie Policy at any time, in order to reflect changes in applicable law, regulatory guidance, or the services provided through the Site. Any changes will be published on this page with an updated revision date. Users are encouraged to review this page periodically.
10. Applicable Law
This Policy is governed by Italian law and EU Regulation 2016/679 (GDPR). Any disputes relating to the processing of personal data shall be subject to the jurisdiction of the competent Italian courts, without prejudice to the user’s right to lodge a complaint with the Garante per la protezione dei dati personali.