Privacy Policy

1. Introduction

HF SRL ("we," "us," or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website, use our services, or interact with us in any way.

HF SRL is a company registered and operating under the laws of Italy, with its registered office at:

This Privacy Policy is issued in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Italian Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018 (the "Italian Privacy Code"), and any other applicable data protection legislation.

2. Data Controller

The data controller responsible for the processing of your personal data is HF SRL, with its registered office at Via Conte Rosso, 36, 20134 Milano, Italy. For any questions or requests regarding the processing of your personal data, you may contact us at [email protected].

3. What Personal Information We Collect

We may collect and process the following categories of personal information:

3.1 Information You Provide Directly

• Contact form submissions: Full name, email address, phone number, selected program, preferred learning format, and any message or comment you include.
• Email correspondence: Any personal information you choose to share when communicating with us via email.
• Consent records: Records of the consent you provide when submitting a form, including the date and time of consent.

3.2 Information Collected Automatically

• Technical data: IP address, browser type, operating system, screen resolution, and device type.
• Usage data: Pages visited, time spent on each page, referring website, and click-through data.
• Cookie data: Information collected through essential, analytics, and preference cookies as described in our Cookie Policy.

4. Why We Collect Your Information

We collect and process your personal data for the following purposes:

• Responding to inquiries: To process and respond to your contact form submissions and email correspondence.
• Providing educational services: To provide information about our meditation and mindfulness education programs available to participants throughout Canada.
• Website functionality: To ensure the proper functioning, security, and performance of our website.
• Improving our services: To analyze website usage patterns and improve user experience, content, and program offerings.
• Legal compliance: To comply with applicable legal obligations, including data protection laws, tax laws, and other regulatory requirements under Italian and European Union law.
• Consent management: To maintain records of consent given through our website forms and cookie consent mechanisms.

5. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases for processing your personal data:

• Consent (Article 6(1)(a) GDPR): When you submit a contact form, you provide explicit consent for us to process the data you have included. You may withdraw your consent at any time.
• Legitimate interest (Article 6(1)(f) GDPR): We have a legitimate interest in analyzing website usage data to improve our services and ensure website security, provided that such interests are not overridden by your rights and freedoms.
• Legal obligation (Article 6(1)(c) GDPR): We may process your data when required to comply with applicable laws and regulations.

6. How We Store Your Information

Your personal data is stored securely using appropriate technical and organizational measures to protect against unauthorized access, alteration, disclosure, or destruction. Specific measures include:

• HTTPS encryption across all pages of our website.
• Secure server infrastructure with firewall protection.
• Limited access to personal data on a need-to-know basis only.
• Regular review of security measures and data handling procedures.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Contact form submissions are retained for a maximum of 24 months from the date of submission unless a longer retention period is required by law or requested by you.

7. How Form Submissions Are Processed

When you submit a form through our website, the following process takes place:

1. Your data is transmitted securely via HTTPS to our server.
2. The information is forwarded to our team at [email protected] for review and response.
3. Your submission is stored securely for the duration specified in Section 6 above.
4. A member of our team will respond to your inquiry using the contact information you provided.

We implement server-side validation and spam protection measures to ensure the integrity and security of form submissions.

8. How Consent Is Collected Through Forms

Our contact form includes a mandatory consent checkbox that must be actively selected (not pre-checked) before submission. By checking this box, you confirm that:

• You have read and understood this Privacy Policy.
• You consent to the collection and processing of the personal data you provide through the form.
• You consent to being contacted by HF SRL using the contact information you have provided.

You may withdraw your consent at any time by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9. Cookies

Our website uses cookies to ensure proper functionality and to improve your browsing experience. Cookies are small text files that are stored on your device when you visit our website.

We use the following types of cookies:

• Essential cookies: Required for the basic functionality of the website, such as cookie consent preferences.
• Analytics cookies: Used to collect anonymous information about how visitors use our website, helping us improve content and user experience.
• Preference cookies: Used to remember your settings and preferences for future visits.

For detailed information about the cookies we use and how to manage your cookie preferences, please read our Cookie Policy.

10. Sharing of Personal Data

We do not sell, rent, or trade your personal information to third parties. We may share your personal data in the following limited circumstances:

• Service providers: We may share data with trusted service providers who assist us in operating our website and delivering our services (e.g., hosting providers, email service providers). These providers are contractually obligated to process your data only on our behalf and in accordance with this Privacy Policy and applicable data protection laws.
• Legal requirements: We may disclose personal data when required by law, court order, or governmental regulation, or when necessary to protect our legal rights.

11. International Data Transfers

As HF SRL is based in Italy and serves participants throughout Canada, some data transfers may occur between Italy and Canada. Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

• Standard contractual clauses approved by the European Commission.
• Adequacy decisions issued by the European Commission, where applicable.
• Other appropriate safeguards as required by applicable data protection law.

12. Your Rights

Under the GDPR and the Italian Privacy Code, you have the following rights regarding your personal data:

• Right of access (Article 15 GDPR): You have the right to request a copy of the personal data we hold about you.
• Right to rectification (Article 16 GDPR): You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17 GDPR): You have the right to request deletion of your personal data, subject to applicable legal obligations.
• Right to restriction of processing (Article 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Article 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days, as required by law.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if you believe your data protection rights have been violated. The Garante can be contacted through its official website or at the following address: Piazza Venezia, 11 – 00187 Roma, Italy.

13. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is completely secure. We encourage you to take precautions to protect your personal information when using the Internet.

14. Children's Privacy

Our website and educational programs are intended for adults. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a person under 18 years of age, we will take steps to delete such information promptly.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or regulatory obligations. Any material changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

17. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of Italy and the European Union, including the GDPR and the Italian Privacy Code. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Milan, Italy.