LearnAmo — learnamo.com
This Website collects some Personal Data from its Users.
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and to Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (the “Italian Privacy Code”)
Last updated: 25/07/2026
Data Controller
LearnAmo di Graziana Filomeno – Italian VAT no. IT08338130720
Via XX Settembre 8, Adelfia (BA), 70010, Italy
Email address: [email protected]
The Controller has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR do not apply. For any matter concerning the processing of personal data, please write to the email address above.
2. Scope
This Privacy Policy applies to the processing of personal data carried out through:
- the website learnamo.com and its English and Spanish versions;
- the learning platform edu.learnamo.com (LearnAmo Academy), including accounts, subscriptions and members-only features;
- the contact, newsletter sign-up and lesson booking forms available on those domains.
This Policy does not cover processing carried out by the operators of LearnAmo’s social media and messaging channels (YouTube, Instagram, Facebook, TikTok, X, LinkedIn, Pinterest, Telegram, WhatsApp), which act as independent controllers under their own privacy policies.
3. Categories of personal data processed
Depending on how you interact with us, the Controller processes:
| Category | Examples |
|---|---|
| Identity and contact data | first name, last name, email address, username, country, language, phone number where provided |
| Billing data | address, Italian tax code, VAT number, company name, e-invoicing recipient code (SDI) |
| Payment data | transaction outcome, last digits and expiry date of the card, transaction ID. The Controller does not process or store full payment card numbers, which are handled directly by the payment service provider |
| Learning data | self-declared and assessed level, test and exercise results, course progress, downloaded materials, lesson attendance |
| User-generated content | messages submitted through contact forms, support requests, text entered into artificial intelligence features |
| Usage and technical data | IP address, device and browser identifiers, operating system, pages visited, time spent, traffic source, system logs |
| Data collected via cookies and similar technologies | session and measurement identifiers and — subject to consent — marketing and profiling identifiers |
Special categories of data under Article 9 GDPR are neither requested nor intentionally processed. Users are asked not to enter data concerning health, religious beliefs, political opinions or sexual orientation into free-text form fields or into AI features.
4. Purposes, legal bases and retention periods
| # | Purpose | Data | Legal basis | Retention |
|---|---|---|---|---|
| A | Account registration and provision of the learning services (Academy, video courses, one-to-one lessons, materials) | Identity, contact, learning, technical | Art. 6.1.b — performance of a contract | For the duration of the relationship and for 12 months after account closure, subject to legal defence needs |
| B | Management of purchases, subscriptions and payments | Identity, billing, payment | Art. 6.1.b — performance of a contract | For the duration of the relationship |
| C | Tax, accounting and statutory obligations (e-invoicing, VAT records) | Billing, payment | Art. 6.1.c — legal obligation (Art. 2220 Italian Civil Code, Presidential Decree 633/1972) | 10 years from the accounting entry |
| D | Responding to enquiries submitted via contact form or email | Contact, message content | Art. 6.1.b — pre-contractual measures, or Art. 6.1.f for non-contractual enquiries | 24 months from the last interaction |
| E | Sending the newsletter and promotional communications about LearnAmo products and services | Email, name, email engagement data | Art. 6.1.a — freely given, specific and revocable consent | Until consent is withdrawn or the user unsubscribes. Contacts showing no opens or interactions for 24 consecutive months are removed |
| E-bis | Sending communications about products and services similar to those already purchased | Art. 130(4) Italian Privacy Code — legitimate interest, with opt-out always available | Until objection, and in any case no longer than 24 months from the last purchase | |
| F | Retaining proof of consent and related logs | Email, timestamp, text of the notice accepted, IP address | Art. 6.1.c and Art. 7.1 — accountability | 10 years from withdrawal |
| G | Statistical measurement and analysis of website usage | Usage data, analytics cookies | Art. 6.1.a — consent, pursuant to Art. 122 Italian Privacy Code. No consent is required for purely aggregated first-party statistics | Maximum 14 months at user level |
| H | Marketing, retargeting and advertising campaign measurement | Advertising identifiers, usage data | Art. 6.1.a — consent | As set out in the Cookie Policy, and in any case no longer than 12 months |
| I | Delivering the level test and returning a personalised study plan | Test answers, assessed level | Art. 6.1.b — service expressly requested | 24 months from completion of the test |
| J | Artificial intelligence features (AI chat, AI flashcards) — see § 5 | Text entered, learning data | Art. 6.1.b — features included in the subscribed plan | See § 5 |
| K | Website security, prevention of abuse, spam and unauthorised access (including reCAPTCHA) | IP, logs, browsing data | Art. 6.1.f — legitimate interest in protecting the infrastructure and ensuring service continuity | 12 months for system logs |
| L | Establishing, exercising or defending legal claims | All relevant data | Art. 6.1.f — legitimate interest in protecting the Controller’s rights | For the duration of the dispute and any appeal periods |
Once the periods above expire, data is deleted or irreversibly anonymised. From that point onwards, the rights of access, rectification, erasure and portability can no longer be exercised over that data.
Legitimate interests pursued (Art. 13.1.d GDPR). Where processing is based on Art. 6.1.f, the Controller pursues, respectively: customer retention through communications about similar services (E-bis); protection of the website against attacks, automated traffic and fraudulent use (K); and protection of its own rights in and out of court (L). In each case the Controller has carried out a balancing test between that interest and the rights of data subjects; the outcome of that assessment is available on request by writing to the Controller.
5. AI-powered features
Premium Academy plans include artificial intelligence features (“AI Chat”, “AI Flashcards”). To operate these features, the text entered by the user and the relevant learning context are transmitted to the language model provider:
OpenAI Ireland Ltd and Anthropic PBC
The Controller specifies that:
- the provider acts as a Data Processor, under a data processing agreement pursuant to Article 28 GDPR;
- the content transmitted is not used to train artificial intelligence models, in accordance with the terms of service applicable to the plan subscribed to by the Controller;
- conversations are retained in order to ensure continuity of the learning experience, and may be deleted by the user at any time from their account settings;
- generated responses are provided for educational purposes only, may contain errors and do not constitute professional advice of any kind;
- users are asked not to enter their own or third parties’ personal data, or any confidential information, into these conversations.
Use of these features does not involve automated decision-making producing legal effects concerning the user or similarly significantly affecting them within the meaning of Article 22 GDPR.
6. Recipients and data processors
Personal data may be accessed by authorised staff and collaborators of the Controller (teachers, support, administration), instructed pursuant to Article 29 GDPR, and disclosed to the following providers, appointed as Data Processors under Article 28 GDPR where they act on the Controller’s behalf.
| Provider | Service | Location |
|---|---|---|
| SiteGround | Website and database hosting | EU |
| Cloudflare, Inc. | CDN, security, email address protection | USA |
| Google Ireland Limited | Google Tag Manager, Google Analytics 4, reCAPTCHA, embedded YouTube videos | IE / USA |
| Intuit Inc. / The Rocket Science Group LLC (Mailchimp) | Newsletter delivery and contact management | USA |
| CookieYes Limited | Cookie consent management platform and consent logs | EU |
| Stripe Payments Europe Ltd / PayPal (Europe) S.à r.l. | Payment and subscription processing | IE / LU |
| Rebel Idealist LLC (Donorbox) | Donation processing | USA |
| Anthropic PBC / OpenAI Ireland Ltd | AI features (§ 5) | EU / USA |
Data may also be disclosed to public authorities where required by law or by an order of a competent authority. Personal data is never disseminated publicly and is never sold to third parties.
An up-to-date and complete list of Data Processors may be requested at any time by writing to the Controller.
7. Transfers outside the European Economic Area
Some of the providers listed in § 6 are established or operate infrastructure outside the EEA, primarily in the United States. Where this is the case, transfers take place on the basis of one of the following safeguards provided for in Chapter V GDPR:
- an adequacy decision of the European Commission, in particular the decision of 10 July 2023 on the EU-US Data Privacy Framework, for certified US providers;
- Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, supplemented — where necessary — by additional technical and organisational measures identified through a transfer impact assessment.
Users have the right to obtain a copy of the safeguards in place for any given transfer by writing to the Controller’s email address.
8. Minors
LearnAmo’s services are not intended for persons under 18 years of age.
9. Nature of the provision of data
Providing the data marked as mandatory in our forms is necessary for the performance of the contract or to comply with a legal obligation: refusal makes it impossible to create an account, complete a purchase or receive support.
Providing data for marketing and profiling purposes is always optional: refusing or withdrawing consent does not in any way affect access to the services or their quality.
10. Processing methods and security
Processing is carried out using electronic tools, following logic strictly related to the purposes stated, and with technical and organisational measures appropriate under Article 32 GDPR, including: encrypted connections (HTTPS/TLS), role-based access control, authentication for administrative accounts, regular backups and confidentiality agreements with collaborators and providers.
The Controller does not carry out processing involving automated decision-making producing legal effects within the meaning of Article 22 GDPR. The level test (purpose I) and the AI features (§ 5) return educational suggestions with no legal or similarly significant effects.
11. Cookies and tracking technologies
The website uses cookies and similar technologies. Non-essential cookies are installed only with the user’s prior consent, collected through the banner displayed on first access, in accordance with the Italian Data Protection Authority’s Guidelines of 10 June 2021.
Consent can be changed or withdrawn at any time through the “Cookie preferences” link in the footer of every page.
A full list of cookies, including name, provider, purpose and duration, is available in the Cookie Policy, which forms an integral part of this Privacy Policy.
12. Your rights
Users may exercise the rights set out in Articles 15 to 22 GDPR at any time:
- access to their data and to information about the processing, including a copy of the data processed;
- rectification of inaccurate data and completion of incomplete data;
- erasure of data, in the cases set out in Article 17;
- restriction of processing, in the cases set out in Article 18;
- portability, meaning the right to receive their data in a structured, commonly used and machine-readable format and to transmit it to another controller;
- objection to processing based on legitimate interest, on grounds relating to their particular situation. For direct marketing, objection may be exercised at any time and without giving reasons;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
How to exercise them. Simply send a request to the Controller’s email address set out in § 1. For the newsletter alone, the unsubscribe link at the bottom of every message may be used. Exercising these rights is free of charge, and the Controller will respond within one month of the request, extendable by a further two months in particularly complex cases, with notice to the data subject.
Complaints. Any data subject who considers that the processing infringes the GDPR has the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority):
This is without prejudice to the right to an effective judicial remedy under Article 79 GDPR and Article 152 of the Italian Privacy Code.
13. Changes to this Privacy Policy
The Controller may update this Privacy Policy at any time, giving notice on this page and indicating the date of the latest update. Where changes concern processing based on consent, the Controller will obtain data subjects’ consent again.
Users are encouraged to review this page periodically.
14. Key definitions
Personal data: any information relating to an identified or identifiable natural person. Processing: any operation performed on personal data, from collection to erasure. Controller: the party determining the purposes and means of the processing. Processor: the party processing data on the Controller’s behalf under an agreement pursuant to Article 28 GDPR.Data subject: the natural person to whom the data relates. Cookie: a small piece of data stored on the user’s device.
This Privacy Policy has been prepared pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 and Italian Legislative Decree 196/2003.