Last updated: 10 August 2026 · Version: 1.0

Information notice on the processing of personal data pursuant to art. 13 and art. 14 GDPR (Regulation (EU) 2016/679) and to D.Lgs. 196/2003 (Legislative Decree 196/2003), as amended by D.Lgs. 101/2018 — the "Codice Privacy" (the Italian Privacy Code). Website: www.mairuna.it

---

1. In brief

This page explains who processes your personal data when you visit www.mairuna.it, write to us, subscribe to a newsletter or take part in one of our programmes; for which purposes we do so; on what legal basis; how long we keep the information; and which rights you can exercise.

Three things we think it is important to tell you straight away:

• We do not sell your data to anyone and we do not use it for purposes other than those listed here.
• The website does not install measurement or marketing cookies until you give your consent. You can change your mind at any time through the "Manage cookies" link at the bottom of every page.
• The programmes we offer are about motherhood, so some of the information you entrust to us may reveal your state of health. We treat this data with particular care: there is a dedicated section at point 6.

---

2. Who processes your data: the Joint Controllers

Mairuna – Centro Maternità Evolutiva is not a company: it is a project shared by three independent professionals, each with her own VAT number, who together determine the purposes and means of the processing of the data collected through the website and the activities of the Centre.

For this reason the three professionals act as Joint Controllers pursuant to art. 26 GDPR:

Operating locations

• Via Cormor Alto 134, 33100 Udine (UD) — main location
• Viale dello Sport 31, 33074 Fontanafredda (PN)

Single contact details for privacy matters

• E-mail: [email protected]
• Telephone: +39 351 404 8761 (Monday to Friday, 9:00–19:00)
• Post: Mairuna – Centro Maternità Evolutiva, Via Cormor Alto 134, 33100 Udine (UD)

We have not appointed a Data Protection Officer (DPO), as the conditions set out in art. 37 GDPR do not apply.

Other professionals also work at the Centre alongside the three founders: when they process data on behalf of the Joint Controllers they do so as persons authorised to process the data (art. 29 GDPR and art. 2-quaterdecies of the Codice Privacy), on the basis of written instructions, or as processors under art. 28 GDPR if they act with their own organisational autonomy.

---

3. Essential content of the joint controllership arrangement (art. 26(2) GDPR)

The Joint Controllers have set out in writing, in an internal arrangement, how their respective responsibilities are allocated. As required by art. 26(2) GDPR, we make the essence of that arrangement available:

1. Common purposes and means. The Joint Controllers jointly determine the purposes listed at point 5 and the tools used (website, e-mail marketing platform, measurement tools, contact channels).
2. Single point of contact. The address [email protected] is the point of contact for data subjects. Every request received is handled jointly, regardless of which Joint Controller receives it.
3. Information notice and consent. The drafting of the information notice and the collection and retention of evidence of consent are handled jointly through the website's systems.
4. Exercise of rights. You may exercise your rights (point 10) in respect of and against each of the Joint Controllers, as guaranteed by art. 26(3) GDPR, even though the internal arrangement assigns day-to-day handling to one of them. You are not required to approach any particular joint controller.
5. Security and breaches. The Joint Controllers jointly adopt security measures and jointly handle any notification of a personal data breach to the Garante and any communication to data subjects (art. 33 and art. 34 GDPR).
6. Relations with suppliers. The contracts with the suppliers that process data on our behalf (point 8) are entered into in the name and on behalf of all the Joint Controllers and contain the clauses required by art. 28 GDPR.
7. Liability towards you. The joint and several liability provided for by art. 82(4) GDPR remains unaffected: you may obtain compensation for the entire damage from any one of the Joint Controllers.

You may request a full copy of the arrangement by writing to [email protected].

---

4. The independent processing carried out by the midwives

Two of the three Joint Controllers — Dott.ssa Chiara Tosolini and Dott.ssa Giorgia Nadin — are midwives registered with the Ordine della Professione di Ostetrica (the Italian professional body for midwives). Dott.ssa Nadin is also an IBCLC certified lactation consultant.

When one of them collects clinical information in the course of a session (for example gestational age, relevant medical history, how breastfeeding is progressing, assessment of a feed), she processes that data as an independent data controller, in the exercise of her healthcare profession, and is bound by professional secrecy.

For that processing:

• the legal basis is art. 6(1)(b) and (c) GDPR together with art. 9(2)(h) GDPR (purposes of preventive medicine, diagnosis and healthcare carried out by a professional bound by professional secrecy), as referred to in art. 75 of the Codice Privacy;
• retention follows the periods laid down by law and by professional codes of conduct;
• the data is neither shared with the other Joint Controllers nor used for marketing purposes.

The same applies to the other healthcare professionals who work with the Centre, each within the scope of her own professional rules.

If a given programme involves completing a form with information about your situation, it is provided to you together with a specific information notice and you are asked for explicit, separate consent.

---

5. What data we process, why and on what legal basis

5.1 Browsing the website

Data: IP address, browser type and operating system, page requested, date and time, referrer, technical logs of the server and of the network protection service.
Purpose: to allow the website to work, to keep it secure, to prevent abuse and attacks, to diagnose malfunctions.
Legal basis: art. 6(1)(f) GDPR — legitimate interest of the Joint Controllers in security and in the proper delivery of the service.
Retention: technical logs are kept for a maximum of 12 months, unless further retention is necessary in the event of security incidents or requests from the authorities.

5.2 Contact form

Data: name, e-mail address, subject, message text, language, how you heard about us, IP address and date/time of submission.
Purpose: to reply to your request and keep a record of the correspondence.
Legal basis: art. 6(1)(b) GDPR — pre-contractual steps taken at your request.
Provision of data: name, e-mail and message are necessary in order to reply to you; without them we cannot get back to you. The other fields are optional.
Retention: 24 months from the last meaningful contact, unless the request turns into an enrolment (in which case point 5.5 applies).

5.3 Form to request a place on a programme

Data: name, e-mail address, date and location chosen, programme area, how you heard about us, language, IP address and date/time of submission, marketing consent where given.
Purpose: to handle your request to take part, check availability of places, contact you to confirm and organise the programme.
Legal basis: art. 6(1)(b) GDPR — pre-contractual steps and performance of the contract.
Important note: submitting the form does not complete your enrolment. It is a request to which we reply in order to agree the details. See the Terms & Conditions.
Retention: 24 months from the request if no enrolment is completed; otherwise point 5.5 applies.

5.4 Waiting list form

Data: name, e-mail address, preferred location, programme area, how you heard about us, language, IP address and date/time of submission, marketing consent where given.
Purpose: to let you know when a new edition of the programme you are interested in opens.
Legal basis: art. 6(1)(b) GDPR — pre-contractual steps taken at your request.
Retention: up to 24 months, or until you ask to be removed.

5.5 Enrolment, management and invoicing of the programme

Data: personal and contact details, data needed for invoicing (tax code and/or VAT number, address), programme attended, attendance, payments.
Purpose: to perform the participation contract, issue tax documents, comply with accounting and tax obligations.
Legal basis: art. 6(1)(b) GDPR (performance of the contract) and art. 6(1)(c) GDPR (legal obligation, in particular D.P.R. 633/1972 and art. 2220 c.c., the Italian Civil Code).
Retention: 10 years from the end of the financial year for accounting and tax documents; data not needed for that purpose is deleted earlier.

5.6 Programme newsletter

Data: e-mail address, programme of interest, language, date/time and IP address of the request and of the confirmation.
Purpose: to send you content, updates and information about new editions of the programme you have chosen.
Legal basis: art. 6(1)(a) GDPR — your consent, and — where the message reveals that you belong to a programme linked to motherhood — art. 9(2)(a) GDPR (explicit consent). See point 6.
How it works: we use double opt-in. After your request we send you an e-mail with a confirmation link: until you click it you are not subscribed and you receive no communications. We record the date, time and IP address of both the request and the confirmation as evidence of consent.
Withdrawal: you can unsubscribe at any time through the link in every e-mail or from the e-mail preferences page, without having to contact us. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Retention: until consent is withdrawn. Evidence of consent and of its withdrawal is kept for a further 5 years for the purposes of legal defence (art. 6(1)(f) GDPR).

5.7 Marketing to past participants ("soft spam")

If you have already taken part in one of our programmes, we may send information about similar programmes to your e-mail address, pursuant to art. 130(4) of the Codice Privacy, without fresh consent.
Legal basis: art. 6(1)(f) GDPR — legitimate interest in promoting similar services to our own clients.
Objection: you may object free of charge and at any time, both at the first sending and at every subsequent one, using the unsubscribe link or by writing to us.

5.8 Communications via WhatsApp

If you write to us via WhatsApp (number +39 351 404 8761) we process your telephone number, profile name and the content of the messages in order to reply and organise your participation.
Legal basis: art. 6(1)(b) GDPR.
Warning: WhatsApp is a service provided by WhatsApp Ireland Ltd. (Meta group). We have no control over the metadata that the platform collects on its own account and we encourage you to read its privacy policy. If you would rather not use WhatsApp, you can contact us by e-mail or telephone with the same result. We ask you not to send us medical reports, diagnostic images or clinical details through the chat: if you need to share them, we will agree a more suitable channel together.
Retention: conversations are kept for 24 months from the last message, unless they form part of the documentation of an ongoing enrolment.

5.9 Cookies and measurement tools

The website uses technical cookies and, only with your consent, analytics and marketing cookies and identifiers. You will find the full list, with suppliers, purposes and durations, in the Cookie Policy.
Legal basis: art. 6(1)(f) GDPR and art. 122 of the Codice Privacy for technical cookies; art. 6(1)(a) GDPR (consent) for all the others.

5.10 Record of your cookie choices

So that we can demonstrate that we obtained valid consent (art. 7(1) GDPR), each time you make a choice on the banner we record the date and time, the version of the policy, the categories accepted or refused, the IP address and the browser user agent.
Legal basis: art. 6(1)(c) GDPR — legal obligation to demonstrate consent.
Retention: 5 years from the record.

5.11 Defence of rights

In the event of a dispute we may process the data needed to establish, exercise or defend a legal claim in or out of court.
Legal basis: art. 6(1)(f) GDPR — legitimate interest; for special category data, art. 9(2)(f) GDPR.
Retention: for the duration of the dispute and for the subsequent time limits for appeal.

---

6. Health data and other special categories

Some of the programmes we offer — pre-conception, pregnancy, birth and labour, post-partum and breastfeeding — are by their nature linked to a physical condition. It follows that:

• even simply enrolling in a programme or in its newsletter may reveal a state of health (for example an ongoing pregnancy). We consider this information to be data belonging to special categories within the meaning of art. 9 GDPR, even where you have given us no clinical detail whatsoever;
• consequently, the form and the banner ask you for explicit and separate consent, not merely generic consent;
• we do not profile your health data for advertising purposes and we do not pass on to advertising suppliers any data revealing which programme you are enrolled in. The conversion events sent to advertising platforms are generic (a Lead event with no reference at all to the programme, the topic area or the page of origin) and do not make it possible to work out your condition;
• if during sessions you share clinical information with a midwife, point 4 applies;
• if you spontaneously write to us with information about your state of health by e-mail, WhatsApp or the contact form, we process it solely in order to reply to you and organise your participation, on the basis of the explicit consent you express by sending it to us, and we delete it as soon as it is no longer necessary.

Legal basis for these categories of data: art. 9(2)(a) GDPR — explicit consent; art. 9(2)(h) GDPR for healthcare processing carried out by the midwife; art. 9(2)(f) GDPR for any defence of a legal claim.

You may withdraw your consent at any time by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out beforehand.

---

7. How we collect data

We collect data directly from you: when you fill in a form on the website, write to us, telephone us, contact us via WhatsApp or take part in a programme.

We do not buy contact lists and we do not collect data from public sources or third parties for marketing purposes.

---

8. Who we share data with

Your data is accessible to the professionals at the Centre who are authorised to process it and to the suppliers listed below, which act as processors under art. 28 GDPR on the basis of a contract binding them to our instructions.

Data may also be disclosed to public authorities where required by law.

We do not disseminate your data and we do not transfer it to third parties for their own commercial purposes.

The up-to-date list of processors, with their respective names and addresses, is available on request by writing to [email protected].

---

9. Transfers outside the European Union

We favour suppliers that process data within the European Union: the e-mail platform and the statistics tool run on European infrastructure.

Some processing nevertheless involves a transfer to third countries:

• United States (Meta, Google, Cloudflare): the transfer takes place on the basis of the EU-US Data Privacy Framework adequacy decision of 10 July 2023, for suppliers that adhere to it, and/or of the Standard Contractual Clauses approved by the European Commission (decision 2021/914), supplemented by additional measures.
• United Arab Emirates (Telegram): there is no European Commission adequacy decision for this country. The transfer concerns solely the internal notification by which our working group is alerted that a new request has come in, and is based on the Standard Contractual Clauses and, in the alternative, on art. 49 GDPR. We are considering replacing this channel with one that does not involve transfers outside the European Union.

You may ask us for a copy of the safeguards adopted by writing to [email protected].

---

10. Your rights

At any time you may exercise the rights provided for by art. 15–22 GDPR:

• access — to know whether we process your data and obtain a copy of it;
• rectification — to correct inaccurate data or complete incomplete data;
• erasure ("right to be forgotten") — in the cases provided for by art. 17;
• restriction of processing — in the cases provided for by art. 18;
• portability — to receive, in a structured, machine-readable format, the data you have provided to us on the basis of consent or of a contract, and to transmit it to another controller;
• objection — to object at any time to processing based on our legitimate interest and, without having to give any reason, to processing for direct marketing purposes;
• withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• not to be subject to automated decisions — see point 12.

How to exercise them. Write to [email protected] or to Mairuna – Centro Maternità Evolutiva, Via Cormor Alto 134, 33100 Udine (UD). We reply within one month of receiving the request; this may be extended by two months in particularly complex cases, in which case we will let you know. Exercising your rights is free of charge; we may ask for a contribution towards costs only for manifestly unfounded or excessive requests, in particular repetitive ones (art. 12(5) GDPR). To make sure the request really comes from you, we may ask you for a means of identification.

As provided for by art. 26(3) GDPR, you may address your request to any one of the Joint Controllers listed at point 2.

Complaint. If you believe that the processing infringes the law, you may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) — Piazza Venezia 11, 00187 Rome — tel. +39 06 696771 — www.garanteprivacy.it — or bring proceedings before the courts.

---

11. Nature of the provision of data

Providing the data marked as mandatory in the forms is necessary in order for us to get back to you or to manage your participation: without it we cannot deliver the service requested.

Providing data for the newsletter and for marketing purposes is always optional: refusing has no effect whatsoever on your ability to take part in the programmes.

---

12. Automated decision-making and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR).

If you consent to marketing cookies, advertising platforms may show you adverts based on your behaviour on the website: this is a form of profiling for advertising purposes, to which you may object at any time by withdrawing your consent through the "Manage cookies" link.

---

13. Minors

The services offered through the website are aimed at adults. We do not knowingly collect data relating to children under 14 years of age through the website (the threshold set by art. 2-quinquies of the Codice Privacy for information society services).

Some programmes involve babies or children being present with a parent: any data concerning them is processed on the instructions and with the consent of the person holding parental responsibility, solely in order to run the activity.

---

14. Security

We adopt technical and organisational measures appropriate under art. 32 GDPR, including: encrypted connection (HTTPS) across the whole website, protection of forms against automated submissions, rate limiting of requests, system access limited to authorised persons with individual credentials, periodic updating of software components, backups, and separation between development and production environments.

No system is absolutely secure: should a personal data breach occur involving a high risk to your rights, we will inform you without undue delay pursuant to art. 34 GDPR.

---

15. Changes to this notice

We may update this notice to reflect changes in the law or the evolution of our services. The version in force is always published on this page with the date of the last update.

Where the changes are substantial we will tell you clearly — with a notice on the website or, if you have given us a contact detail, by e-mail — and, where the change concerns processing based on consent, we will ask you for fresh consent.

---

16. Useful links

• Cookie Policy — full list of cookies and measurement tools
• Terms & Conditions — conditions of use of the website and of participation in the programmes
• Manage cookies — link at the bottom of every page, to change or withdraw your choices

---

Mairuna – Centro Maternità Evolutiva
Ti accompagniamo nel tuo percorso, al passo che sceglie il tuo corpo.