Effective Date: 04/11/2026
Last Updated: 04/11/2026
1. Introduction and Data Controller Information
Welcome to The Laboratory of Life (“we,” “us,” “our,” or the “Website”). We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and other applicable privacy laws.
Data Controller:
Carlo Praful Saracino
Operating as: The Laboratory of Life
Address: Via Capo Soprano, 41, 00122 Lido di Ostia RM, Italia
Email for privacy matters: privacy@thelaboratoryoflife.com
Website: www.thelaboratoryoflife.com
For any questions regarding this Privacy Policy or your personal data, please contact us at privacy@thelaboratoryoflife.com
2. Scope of This Policy
This Privacy Policy applies to all personal data collected through:
- Our website at www.thelaboratoryoflife.com
- Email communications
- Registration for classes, trainings, and workshops
- Booking of private sessions (individual, couple, or family)
- Any other interactions with The Laboratory of Life
3. Types of Personal Data We Collect
3.1 Data You Provide Directly
When you contact us, register for services, or book sessions, we may collect:
- Identity Data: Full name, title
- Contact Data: Email address, telephone number, postal address
- Service Data: Information relevant to the services you request, including session preferences, workshop selections, and training enrollment details
- Communication Data: Content of emails and messages you send us
- Health-Related Data: Where voluntarily disclosed by you in connection with our services (e.g., emotional or psychological concerns discussed during sessions). This constitutes special category data under GDPR Article 9
- Newsletter Data: email address; optionally first name, last name and country; records of your consent (date and time of subscription and confirmation, how you subscribed, and the technical data of the confirmation step).
3.2 Data Collected Automatically
When you visit our website, we may automatically collect:
- Technical Data: IP address, browser type and version, operating system, device type
- Usage Data: Pages visited, time spent on pages, navigation paths, referring website
- Cookie Data: Information collected through cookies and similar technologies (see our Cookie Policy)
4. Legal Bases for Processing
We process your personal data based on the following legal grounds under GDPR Article 6:
| Purpose | Legal Basis |
| Responding to inquiries | Legitimate interest (Art. 6(1)(f)) |
| Providing requested services | Contract performance (Art. 6(1)(b)) |
| Session booking and management | Contract performance (Art. 6(1)(b)) |
| Sending service-related communications | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
| Website functionality and security | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Newsletter and information about our activities | Consent (Art. 6(1)(a)) |
| Keeping proof of your consent | Legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1)) |
Is providing your data mandatory? You are free to decide whether to give us your data. Without an email address we cannot send you the newsletter; without the data needed for a booking we cannot organise your participation. All other data is optional.
For Special Category Data (health-related information voluntarily shared):
- Explicit consent under GDPR Article 9(2)(a)
5. How We Use Your Personal Data
We use your personal data to:
- Provide Services: Process bookings, deliver sessions, and manage your participation in classes and trainings
- Communicate: Respond to your inquiries, send appointment confirmations, and provide service updates
- Improve Our Services: Analyze website usage to enhance user experience
- Ensure Security: Protect against unauthorized access and maintain website integrity
- Comply with Law: Meet legal and regulatory obligations
- Send our newsletter and information about our activities, if you have subscribed (see section 6)
6. Newsletter and information about our activities
What we do. If you subscribe, we send you a newsletter about once a month and information about our groups, trainings and sessions.
What data we use. Your email address is required to receive the newsletter. Your first name, last name and country are optional. We use your name only to greet you. We use your country only to send information about in-person activities that may be relevant where you are. We do not use your data for any other kind of profiling.
Email statistics. We only look at overall figures for each newsletter (for example, how many people opened it). We do not use individual reading or clicking data to decide what to send you.
Service provider. We send the newsletter through Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017, Paris, France), which processes data on our behalf under a data processing agreement (Art. 28 GDPR). Brevo may also use some of this data on its own behalf to keep its platform secure (for example, to detect fraud or hacking attempts), as described in Brevo’s Privacy Policy.
Your choice. You can unsubscribe at any time with the link at the bottom of every email, or by writing to us. You can update your data through the link “Update your profile” in every email.
How long we keep it. We keep your newsletter data until you unsubscribe. After that we keep only your email address in a list of people who do not wish to receive emails, so we do not write to you again by mistake, and the record of your consent for five years to be able to demonstrate it. We may occasionally ask you to confirm that you still wish to receive our emails.
7. Data Sharing and Disclosure
We do not sell, rent, or trade your personal data. We may share your data only:
- With Service Providers acting on our behalf under data processing agreements (Art. 28 GDPR), in particular: website hosting (Aruba Business S.r.l., Via Gulinelli n. 21/A, Ferrara (FE), Italia), newsletter service (Brevo – Sendinblue SAS, 17 rue de Salneuve, 75017, Paris, France), email service (Aruba Business S.r.l., Via Gulinelli n. 21/A, Ferrara (FE), Italia). An up-to-date list is available on request.
- For Legal Requirements: When required by law, court order, or governmental authority
- With Your Consent: When you have given explicit permission
8. International Data Transfers
As our services are offered internationally, your data may be transferred outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, including:
- Transfers to countries with an EU adequacy decision, including, for United States providers, those certified under the EU–U.S. Data Privacy Framework
- Standard Contractual Clauses (SCCs) approved by the European Commission
- In exceptional cases, and only where allowed by Art. 49 GDPR, your explicit consent
9. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Type | Retention Period |
| Contact and inquiry data | 2 years from last contact |
| Service/session records | 5 years (legal requirements) |
| Marketing consent records | Until consent withdrawn + 1 year |
| Website analytics data | 26 months |
| Cookie data | See Cookie Policy |
| Newsletter data | Until you unsubscribe |
| Email address after unsubscribing | Kept only in a do-not-contact list, to respect your choice |
After the retention period, data is securely deleted or anonymized.
Automated decisions. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.
10. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of Access (Art. 15): Request a copy of your personal data
- Right to Rectification (Art. 16): Request correction of inaccurate data
- Right to Erasure (Art. 17): Request deletion of your data (“right to be forgotten”)
- Right to Restriction (Art. 18): Request limited processing of your data
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to Object (Art. 21): Object to processing based on legitimate interests
- Right to Object to Direct Marketing (Art. 21(2)): you can object at any time to receiving our newsletter and information about our activities. We will stop, without needing a reason
- Right to Withdraw Consent: Withdraw consent at any time (without affecting prior lawful processing)
- Right to Lodge a Complaint: File a complaint with a supervisory authority
To exercise your rights, contact us at: prafulsessions@gmail.com
We will respond within one month of receiving your request. This may be extended by two further months for complex requests; in that case we will tell you why
11. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with:
Garante per la Protezione dei Dati Personali
(Italian Data Protection Authority)
Piazza Venezia 11, 00187 Roma, Italy
Website: www.garanteprivacy.it
Email: protocollo@gpdp.it
You may also lodge a complaint with the supervisory authority of the EU or EEA country where you live or work.
12. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Secure server infrastructure
- SSL/TLS encryption for data transmission
- Access controls and authentication
- Regular security assessments
- Staff confidentiality obligations
While we strive to protect your data, no transmission over the internet is 100% secure. We cannot guarantee absolute security.
13. Children’s Privacy
Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately for its deletion.
14. Links to Third-Party Websites
Our website may contain links to external sites (e.g., Instagram). We are not responsible for the privacy practices of third-party websites. We encourage you to review their privacy policies.
15. Changes to This Privacy Policy
We may update this Privacy Policy periodically. Changes will be posted on this page with an updated “Last Updated” date. Significant changes will be communicated via email where appropriate.
16. Contact Us
For questions, concerns, or requests regarding this Privacy Policy or your personal data:
Email: privacy@thelaboratoryoflife.com
Website: www.thelaboratoryoflife.com