This privacy policy explains what personal data we collect when you visit this website or contact us, why we collect it, how long we keep it, who we share it with and what rights you have. We are a small consultancy that gives guidance on studying in Italy and on the Italian student visa, and our main channel for talking to you is WhatsApp.
Last updated: October 10, 2026
Who is responsible for your data
The data controller is Italy Study Journey. “Controller” means the organisation that decides why and how your personal data is processed. If you have any question about this policy or about your data, contact us at the email address above or through the WhatsApp contact on our contact page.
What personal data we process
We collect only the data we need to answer your questions and, if you become a client, to provide our services. Depending on how you interact with us, this may include:
- WhatsApp messages. When you write to us on WhatsApp we receive the content of your messages, your WhatsApp display name and profile picture, your phone number, and the date and time of each message.
- Your name and phone number. We use these to identify you and to reply.
- Information you choose to share with us. To give you accurate guidance we may need details such as your nationality and country of residence, your previous education and qualifications, the course or university you are interested in, your planned budget and sources of funding, and copies of documents you decide to send us (for example a diploma, a transcript, a language certificate or a bank statement). You decide what to share; we will tell you when a particular document is not needed.
- Website analytics (if enabled).
- Contact form (if enabled).
- Technical data. Our hosting provider keeps standard server logs (IP address, time of request, pages requested, browser type) for security and troubleshooting.
Some of the information you share for a visa or admission file may be sensitive in your own eyes, for instance financial details or family circumstances. We treat all of it as confidential. We do not ask for, and ask you not to send, data about your health, religion, political opinions or similar special categories unless it is genuinely needed for a specific step (for example an insurance question) and you choose to share it.
Why we process your data and on what legal basis
Under the GDPR we need a legal basis for every use of your personal data. The table below sets out each purpose and the basis we rely on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering your enquiry on WhatsApp or through the contact form | Name, phone number, message content, information you share | Steps at your request before entering into a contract (Art. 6(1)(b) GDPR); our legitimate interest in responding to people who contact us (Art. 6(1)(f)) |
| Providing consultancy services you have engaged us for | All information and documents relevant to your file | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and tax records | Name, contact details, payment details | Legal obligation (Art. 6(1)(c)) |
| Keeping records of advice given, in case of a later dispute | Message history, documents reviewed | Legitimate interest in defending our legal position (Art. 6(1)(f)) |
| Website analytics (if enabled) | Usage data, approximate location, device data | Your consent (Art. 6(1)(a)), given through the cookie banner, where required by law |
| Sending you updates about procedures or our services | Name, phone number | Your consent (Art. 6(1)(a)); you can withdraw it at any time by telling us |
| Security of the website and prevention of abuse | Server logs | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for automated decision-making or profiling, and we do not sell it.
WhatsApp is a third-party service
WhatsApp is operated by Meta Platforms. When you message us on WhatsApp, Meta processes your data under its own terms and privacy policy, which we do not control. This includes the metadata that WhatsApp collects about your account and your use of the service, and the transfer of that data to servers that may be outside your country and outside the European Economic Area. Message content is end-to-end encrypted in transit, but WhatsApp’s own rules govern what Meta can see and how long it keeps it.
Before you contact us on WhatsApp, please read WhatsApp’s privacy policy, which is available from within the app and on WhatsApp’s website. If you would prefer not to use WhatsApp, you can reach us by email at the address given above.
Please do not send us more documents than we ask for, and consider sending sensitive documents by email rather than WhatsApp if that is more comfortable for you.
How long we keep your data
We keep personal data only for as long as we need it for the purposes above.
- Enquiries that do not become a client relationship:
- Invoices and accounting records:
- Analytics data (if enabled):
You can ask us to delete your messages and documents earlier at any time (see “Your rights” below). We will do so unless we are legally required to keep certain records, in which case we will tell you what we must keep and why.
Who we share your data with
We never sell personal data and we do not share it with universities, consulates, agents or any other organisation for their own purposes. We share it only in the following situations:
- Service providersThey may only use your data to provide their service to us.
- With your instruction. If you ask us to help you communicate with a university, a visa application centre or another body, we will share only what you have asked us to share, and only when you have asked. We never submit applications or documents on your behalf without your explicit request.
- Legal obligations. We may disclose data where the law requires it, for example to tax authorities, a court or a regulator, or to establish, exercise or defend legal claims.
- Business transfer. If the consultancy is sold or merged, your data may be transferred to the new owner under the same protections as this policy.
International transfers
We are based in Any Country and our clients are typically in Any Country or other countries outside the European Economic Area. Some of our service providers, including Meta (WhatsApp), store data in countries whose data-protection laws differ from those of the EEA and of your own country. Where the GDPR applies to a transfer, we rely on the safeguards the provider offers, such as the European Commission’s standard contractual clauses or an adequacy decision, and you can ask us for details of the safeguards that apply to a particular provider.
Your rights
Depending on where you are, you have some or all of the following rights over your personal data.
- Access: to receive a copy of the data we hold about you and information about how we use it.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to have your data deleted where we no longer need it or where you withdraw consent, subject to legal retention duties.
- Restriction: to ask us to stop using your data while a question about its accuracy or our basis for using it is resolved.
- Portability: to receive the data you gave us in a machine-readable format and to have it sent to another provider where technically possible.
- Objection: to object to processing based on our legitimate interests, and at any time to processing for direct marketing.
- Withdrawal of consent: where we rely on your consent, to withdraw it at any time without affecting the lawfulness of what was done before.
To exercise any of these rights, message us on WhatsApp or email us at the address above. We will respond within one month, or tell you if we need longer for a complex request. We may ask you to confirm your identity before acting, so that we do not disclose data to the wrong person. Exercising your rights is free unless a request is clearly unfounded or excessive.
Cookies and analytics
Version A (no analytics): This website sets only the technical cookies needed for it to work, for example to remember a cookie preference. It does not use analytics or advertising cookies, and it does not track you across other websites.
Version B (analytics enabled):Analytics cookies are set only after you give consent through the cookie banner, where the law requires consent, and you can change your choice at any time through the “cookie settings” link in the footer. The analytics data we see is aggregated; we do not use it to identify individual visitors. The provider’s own privacy policy explains how it handles the data it collects.
The WhatsApp button on this website opens WhatsApp in your browser or app; it does not set cookies of its own on this site.
Children
Our services are intended for prospective university students, who are normally adults, and for their parents or guardians. If a prospective student is under that age, we ask that a parent or guardian contacts us on their behalf. If you believe a child has sent us data without such consent, tell us and we will delete it.
How we protect your data
We take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will inform you and the competent authority without undue delay if a breach affecting your data occurs, as the law requires.
Changes to this policy
We may update this policy when our services, our providers or the law change. The date at the top shows when it was last revised. If a change significantly affects how we use your data, we will tell existing clients directly through the channel we normally use with them. We encourage you to review this page from time to time.
How to complain
If you are unhappy with how we have handled your data, please contact us first so that we can try to put it right. You also have the right to lodge a complaint with a data-protection supervisory authority. In the EU, this is the authority of the member state where you live, work or where the alleged infringement took place. Complaining to us first is not a condition of complaining to the authority.
Related pages: terms and conditions and disclaimer.