Privacy policy
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") — last updated: 26/10/2026
1. Data controller
Sirotti Stefano Fotoreporter, via Fossanuova 5, 30024 Musile di Piave (VE), Italy, VAT IT02582180408, tax code SRTSFN77B11C573L. Email: info@sirotti.it.
2. What data we process, why and on what legal basis
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Browsing the website | IP address, date and time, requested page, browser and operating system, logged by the server | Operating and securing the website, preventing abuse and cyber attacks | Legitimate interest (Art. 6.1.f) | 30 days, unless needed to investigate offences |
| Registration and private area | Name or company name, email, address, phone, tax code and VAT number, password (stored encrypted) | Creating and managing the account, enabling purchases and file downloads | Performance of a contract and pre-contractual measures (Art. 6.1.b) | Until the account is deleted, which you can request at any time |
| Orders and licences | Account data, products and licences purchased, amounts, payment method | Managing orders, delivering digital files, invoicing and support | Contract (Art. 6.1.b) and tax and accounting obligations (Art. 6.1.c) | 10 years for accounting records (Art. 2220 of the Italian Civil Code) |
| Service emails | Email address, opening of the message and clicks on links | Sending order confirmations, credentials and service messages and checking they are received | Contract (Art. 6.1.b) and legitimate interest in knowing that the message arrived (Art. 6.1.f) | 24 months |
| Contact requests | Data included in the message | Replying to the request | Pre-contractual measures (Art. 6.1.b) and legitimate interest (Art. 6.1.f) | As long as needed to reply, at most 24 months |
| Visit statistics | Online identifier of the browser, pages viewed, duration and source of the visit, device type; Google Analytics 4 does not log the full IP address | Understanding, in aggregate form, how the website is used | Consent (Art. 6.1.a), given through the cookie banner and revocable at any time | Cookies up to 2 years, data in Google Analytics 14 months |
We do not carry out profiling, we do not send promotional communications and we do not take decisions based solely on automated processing.
3. People portrayed in the photographs
The archive publishes photographs of sports and news events, in which identifiable people may appear. These images are processed for journalistic and documentary purposes, in accordance with Art. 85 GDPR, Articles 136 et seq. of Italian Legislative Decree 196/2003 and the Italian code of conduct for journalistic activities. Anyone who believes that a photograph infringes their rights can ask for it to be reviewed and, where appropriate, removed by writing to info@sirotti.it.
4. Do you have to provide your data?
No data is required to browse the website. Registration and order data are necessary to buy and download photographs: without them we cannot provide the service. Consent to statistics cookies is optional and the website works without it.
5. Who may receive the data
- Mango Mobile S.r.l., for the development, technical management and hosting of the website, and Aruba S.p.A., for the email service, appointed as processors (Art. 28 GDPR).
- PayPal (Europe) S.à r.l. et Cie, S.C.A., if you choose to pay with PayPal: it processes payment data as an independent controller.
- Google Ireland Ltd., for Google Analytics, only if you give your consent.
- Tax advisers and public authorities, where required by law.
We do not sell or transfer personal data to third parties.
6. Transfers outside the European Union
With Google Analytics some data may be transferred to Google LLC in the United States, on the basis of the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), to which Google LLC adheres, and of the standard contractual clauses.
7. Security
The website uses an encrypted connection (HTTPS), passwords are stored in encrypted form and data is accessible only to authorised people, with appropriate measures under Art. 32 GDPR.
8. Your rights
At any time you can request access to your data, rectification, erasure, restriction of processing and portability (Articles 15-20 GDPR), object to processing based on legitimate interest (Art. 21) and withdraw your consent, without affecting processing already carried out. You can edit your account data from your private area; for other requests write to info@sirotti.it. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country.
9. Cookies
For the cookies used by the website see the cookie policy.
10. Changes
This policy may be updated; the date of the last update is shown at the top.
