Privacy Policy

Last updated: 18 October 2026

1. Data controller

The data controller is TGO — Security · Service · Consulting, with its registered office at Via 51° Stormo 31, 36016 Thiene (VI), Italy — VAT no. 04608490241. For any request concerning personal data, please write to info@tgo-ssc.com.

2. Personal data processed

We process the personal data you provide voluntarily and the data collected automatically while you browse:

• Contact and enrolment request data — full name, telephone number, email address, the topic and the content of your message, submitted through the contact form or the enrolment request form on course pages.
• List data — full name, email address and the date and wording of your consent, if you join the list described in section 10.
• Browsing data — technical data transmitted automatically by your browser (for example IP address, device and browser type, date and time of the request), processed to operate and secure the site, including the spam protection for forms described in section 8.
• Direct contact data — if you write to us by email or WhatsApp, or call us on the numbers shown on the site, we process the data you choose to share with us, for the same purposes as for requests sent through the forms.

3. Purposes and legal basis

• Responding to information, contact and course enrolment requests — legal basis: steps taken at your request before entering into a contract, and legitimate interest (Art. 6(1)(b) and (f) GDPR).
• Ensuring the operation, security and maintenance of the site — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Complying with legal obligations — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending emails about any new editions of the course concerned and of similar courses, only to those who join the list described in section 10 — legal basis: consent (Art. 6(1)(a) GDPR).

We do not carry out any profiling, and we send promotional communications only to those who have consented by joining that list. Providing the data marked with an asterisk (*) in the forms is necessary: if you do not provide it, we cannot reply to your request or add you to the list. Please do not include health data or other sensitive information (special categories of personal data under Art. 9 GDPR) in your message: if we need such data to provide the service you request, we will collect it later with the safeguards required by law.

4. How data is processed

Data is processed using electronic tools, with appropriate technical and organisational measures to ensure its security, integrity and confidentiality and to prevent unauthorised access.

5. Recipients and transfers

In addition to TGO, data is processed by service providers acting on behalf of the controller, appointed as data processors and bound to comply with the applicable law: Cloudflare (site hosting and content delivery network, spam protection for forms and traffic statistics), Brevo (a provider based in France with servers in the European Union, which relays to TGO the emails generated by the forms) and the provider of the controller's email service. Cloudflare also acts as an independent controller, solely to improve its own bot-detection service (see section 8). If you choose to contact us on WhatsApp, your message is also processed by WhatsApp (part of the Meta group) under that service's own terms and privacy policy. Data is not made public. Cloudflare is based in the United States and operates a worldwide network, so data may be transferred to third countries (outside the European Economic Area); such transfers take place only in compliance with Art. 44 et seq. GDPR. Transfers to the United States rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, in which Cloudflare participates.

6. Retention period

Contact and course enrolment requests (including those received by email, WhatsApp or telephone) and the data they contain are kept for as long as needed to handle them and in any event for no more than 24 months from the last contact, unless a contractual relationship is established or the law requires longer retention. List data (section 10) is kept for 24 months from the date of consent, unless you withdraw your consent earlier. Browsing data and data processed for spam protection are kept only for as long as is technically necessary. At the end of the retention period, data is deleted or anonymised.

7. Data subject rights

You may exercise the rights provided by Articles 15-22 of the GDPR at any time: access, rectification, erasure, restriction, objection to processing and data portability. Requests should be sent to info@tgo-ssc.com. You also have the right to lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Spam protection for forms and web traffic analytics

To protect our forms from automated submissions (spam), we use Cloudflare Turnstile. It runs when you open a page that contains a form and analyses certain technical signals from your browser and connection (for example IP address, browser type and session characteristics) to tell a person from an automated program. When you submit the form, our server sends Cloudflare only the verification token generated by Turnstile and your IP address, so that Cloudflare can confirm the result of the check. The content of the form fields is not sent to Turnstile, which does not read or store it. Cloudflare processes the technical signals, token and IP address described above on behalf of TGO as a data processor. Cloudflare also uses this data as an independent controller, solely to improve its own bot-detection service; that processing is governed by Cloudflare's privacy notice. The legal basis for the processing carried out on our behalf is our legitimate interest in the security of the site (Art. 6(1)(f) GDPR).

To measure visit trends in aggregate (page views, traffic source, device type), we use Cloudflare Web Analytics, a tool that sets no cookies, does not rely on fingerprinting (identifying a device from its technical characteristics) and does not track individual users across different sites. The data collected is aggregated and does not allow the data subject to be identified; it is not used for marketing or profiling purposes. The provider, Cloudflare, acts as a data processor. As this tool stores no cookies or other identifiers and the site uses no cookies other than strictly necessary technical ones, no cookie banner is required.

9. Cookies

For information on cookies and third-party resources, please see the Cookie Policy.

10. List for new editions (optional)

If you join the list from a course page, we process your full name, your email address and the date and wording of your consent in order to email you about any new editions of that course and of similar courses. Joining is optional: it is not a booking and does not affect your ability to attend any course.

• Legal basis — your consent (Art. 6(1)(a) GDPR and Art. 130 of Italian Legislative Decree 196/2003).
• Retention — 24 months from the date of your consent, unless you withdraw it earlier; at the end of that period the data is deleted.
• Recipients — the data is processed by TGO and by the technical service providers referred to in section 5, appointed as data processors. It is not disclosed or passed on to anyone else, including course organisers and certification bodies.
• Withdrawal — you can withdraw your consent at any time by writing to info@tgo-ssc.com; this does not affect the lawfulness of any processing carried out before the withdrawal. Every email sent to the list explains how to unsubscribe.

For your other rights, including the right to lodge a complaint with the Italian Data Protection Authority, see section 7.