Cookie Policy
Last updated: 4 August 2026
This Cookie Policy describes the cookies and the other technologies that store or read information on your device used on the website and platform available at https://improoving.me (the "Platform"), pursuant to article 122 of Italian Legislative Decree 196/2003 (implementing Directive 2002/58/EC, "ePrivacy"), Regulation (EU) 2016/679 ("GDPR") and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante), decision no. 231 of 10 June 2021.
It forms an integral part of our Privacy Notice, which you should read for everything not specifically covered here (categories of data, recipients, retention periods, data subject rights).
1. Data controller and contact details
Improoving.me S.r.l.
Largo Francia 114 — 10143 Turin (TO), Italy
VAT no. 11619540013
E-mail: hello@improoving.me
Data Protection Officer (DPO): the Controller has not appointed a DPO, having assessed that the conditions set out in article 37(1) GDPR are not met. All data protection requests, including those relating to cookies, are handled directly by the Controller at hello@improoving.me.
2. What cookies and equivalent technologies are
Cookies are small text files that the websites you visit send to your device, where they are stored and then sent back to those same sites on your next visit.
Alongside cookies there are other technologies that allow information to be stored on or read from your device: browser local storage, local databases (IndexedDB), service workers, device identifiers for push notifications. The Garante's Guidelines of 10 June 2021 expressly treat these tools in the same way as cookies: the same rules therefore apply, which is why they are all described in this document (section 8).
We distinguish:
- by origin: first-party cookies, set directly by the
improoving.medomain, and third-party cookies, set by other providers' domains (for example Stripe or Google); - by purpose: technical cookies (necessary to make the site work and to enable authentication, security and the functions requested by the user), for which article 122(1) of Legislative Decree 196/2003 does not require consent, and non-technical cookies (non-anonymised statistical measurement, profiling, marketing), which may only be installed after you have given your consent;
- by duration: session cookies, deleted when the browser is closed, and persistent cookies, which remain until the stated expiry date or until you delete them.
3. Scope and Improoving.me's role
This Cookie Policy applies to all areas served by the improoving.me domain: the public and presentation pages, each organisation's public pages (catalogue, online booking, checkout), the customer area, the instructor area, the reseller area and the organisation management back office.
With respect to the cookies and tracking tools set through these pages, Improoving.me S.r.l. acts as data controller: it is Improoving.me that decides which technical tools are loaded. Client organisations cannot insert their own tracking codes into the Platform's pages.
The individual organisation remains the controller of the data it manages on the Platform for its own activity (customer records, bookings, payments it collects, communications): the allocation of roles is described in section 2 of the Privacy Notice.
If from the Platform's pages you follow a link to a third-party site (for example a meeting point shown on Google Maps, or an organisation's own website), that site's own privacy notice and cookie settings apply.
4. First-party technical cookies
These are set directly by improoving.me and are necessary for the site to work and for authentication and security. They do not require consent (article 122(1), Legislative Decree 196/2003); if you block them through your browser settings, some functions — including access to your account area and making purchases — will stop working.
| Name | Purpose | Type and duration |
|---|---|---|
laravel_session |
Identifies your browsing session and keeps you signed in; it also holds the selected language and temporary navigation data. Its contents are encrypted. | First party, technical. Persistent, expiring 24 hours after your last activity |
XSRF-TOKEN |
Protection against cross-site request forgery (CSRF): allows us to verify that forms and requests actually originate from our pages. | First party, technical/security. Persistent, 24 hours |
remember_web_… (the name contains an automatically generated code) |
Keeps you signed in between sessions: set only if you select the "remember me" option when signing in. | First party, technical. Persistent, 5 years or until you sign out |
cookieconsent |
Records that the short notice shown at the bottom of the page has already been displayed to you, so that it is not shown again on every page. Since the Platform uses no tools subject to consent (section 6), this cookie does not record any consent: it is simply an acknowledgement flag. | First party, technical. Persistent, 12 months |
do_not_ask_password_grant |
Remembers your choice not to be shown the password prompt for application authorisation again; set only if you select "don't ask me again". | First party, technical. Persistent, 30 days |
5. Third-party cookies necessary for payment security (Stripe)
Payments on the Platform are handled by Stripe Payments Europe, Ltd. Card details are collected directly by Stripe and never pass through our systems.
The Stripe.js library is loaded by the public and booking pages, by the customer area and by the back office — that is, by every area in which a payment may be started — even when the specific page you are viewing contains no payment function. It sets the following cookies, which Stripe uses for fraud prevention and transaction security:
| Name | Controller | Purpose | Duration |
|---|---|---|---|
__stripe_mid |
Stripe Payments Europe, Ltd. | Identifies the device for payment fraud prevention purposes | 1 year |
__stripe_sid |
Stripe Payments Europe, Ltd. | Identifies the current payment session for fraud prevention purposes | 30 minutes |
These cookies are treated as technical, as they are strictly necessary to deliver securely the payment service requested by the user and to prevent the fraudulent use of payment instruments. They are not used by Improoving.me for statistical or profiling purposes.
Stripe privacy policy: https://stripe.com/privacy — Stripe cookie policy: https://stripe.com/cookies-policy/legal.
6. No measurement, analytics or profiling tools
The Platform uses no analytics, statistical measurement, tracking or profiling tools whatsoever. In particular, our pages contain none of the following:
- usage analytics systems (Google Analytics or equivalent, in any version, including the module built into Firebase);
- tag managers (Google Tag Manager) or any other container capable of loading measurement tags;
- advertising or conversion pixels of social platforms (Meta/Facebook, LinkedIn, TikTok or others);
- profiling, retargeting or behavioural advertising cookies, whether our own or third-party;
- device fingerprinting or cross-site audience measurement tools.
We therefore do not collect browsing statistics about our users and we do not transmit browsing data to third parties for advertising or measurement purposes, whether ours or theirs. We do not sell or otherwise transfer browsing data.
All the public pages of the website carry a domain ownership verification meta tag for Meta Business (facebook-domain-verification): it is simply a string in the page source, it loads no script and sets no cookie, and it does not allow Meta to observe your browsing.
Because we use no tools subject to consent, you are not asked for cookie consent: what remains on your device is described in sections 4, 5, 7 and 8 and falls within the exemption in article 122(1) of Legislative Decree 196/2003. Should we introduce measurement tools in the future, we will ask for your prior, freely given and withdrawable consent, and this Cookie Policy will be updated before they are activated (sections 11 and 16).
7. Other third-party components loaded by the pages
Some Platform features use resources hosted by third parties (libraries, fonts, icons, maps). Merely loading these resources means that your IP address and basic technical browser information are disclosed to the provider and — depending on the provider — may involve identifiers being read from or written to your device.
| Component | Provider | When it is loaded | Purpose |
|---|---|---|---|
Google Maps (maps.googleapis.com) |
Google Ireland Limited | Only on pages that contain a map or a location search field — including the public organisation search page, the organisation's page and forms in which a meeting point is chosen. On those pages the library is loaded when the page opens, without waiting for you to interact with the map | Location search and display of maps |
Google Fonts (fonts.googleapis.com) |
Google Ireland Limited | On all application pages | Loading the site's fonts |
Google (gstatic.com) — chart libraries and the Firebase library |
Google Ireland Limited | On pages containing statistical charts; in the push notification service worker | Displaying charts (the data is processed on your device and not sent to Google); receiving push notifications. Of the Firebase platform we use only the messaging service (Cloud Messaging): no analytics module is active (section 6) |
Software library CDNs (cdnjs.cloudflare.com, cdn.quilljs.com, ajax.googleapis.com, maxcdn.icons8.com) |
Cloudflare, Inc.; Quill; Google; Icons8 | On all application pages | Delivery of stylesheets, icons and JavaScript libraries required by the interface |
Facebook JavaScript SDK (connect.facebook.net) |
Meta Platforms Ireland Ltd. | Only on the integrations settings page of the back office and only from the moment an organisation selects "connect WhatsApp": before that click the library is not loaded | Embedded Signup procedure for the organisation's WhatsApp Business account |
Pusher (pusher.com, European cluster) |
Pusher Limited (United Kingdom) | In areas with real-time updates (planner, instructor area) | Real-time connection for immediate lesson updates; uses a WebSocket connection and does not set tracking cookies |
These components are loaded in order to deliver the Platform's functions, not for profiling purposes on our part: we receive no statistics about your browsing from them and we do not use them to recognise you. If you would rather avoid disclosing your IP address to these providers altogether, you can block third-party content through your browser settings or extensions (section 12); the map and some graphical elements will then not be displayed, while the Platform's essential functions will keep working.
For the processing each provider carries out as an independent controller, its own privacy notice applies:
- Google: https://policies.google.com/privacy
- Cloudflare: https://www.cloudflare.com/privacypolicy/
- Meta: https://www.facebook.com/privacy/policy
- Pusher: https://pusher.com/legal/privacy/
8. Technologies equivalent to cookies: local storage, IndexedDB, service workers and push notifications
The Platform is designed to work as an installable web application and with an unstable connection (typically on the mountain). For this reason, in addition to cookies, it uses the following local storage technologies, all first party and all for technical purposes. None of them is used to profile you or to measure your behaviour.
| Technology | Contents | Purpose | Deletion |
|---|---|---|---|
| Browser local storage | Shopping cart (shopping-cart), cached list of countries (app_countries_cache), interface preferences (for example whether the side menu is locked) |
Keeping the cart across different tabs and reducing loading times | Automatically when the cart expires (15 minutes after the last update) and when the cache expires; manually through your browser settings |
IndexedDB (local databases school_db_… and workers_db) |
A local copy of the data needed to run the back office and the instructor area: customers, pupils, instructors, resellers, packages, events, lessons, services, products, rentals, price lists, locations, assessment criteria, consents, plus authentication tokens | Allowing the planner and the instructor area to be used quickly and even during a temporary loss of connection | Automatically when you leave the reserved area and when you switch organisation; manually by clearing the site data in your browser |
| Service workers (web application, push notifications, real time) | Support scripts registered by the browser | Offline operation, receiving notifications and real-time updates | By uninstalling the web application or clearing the site data in your browser |
| Push notifications (Firebase Cloud Messaging) | A device identifier (token), generated only if you allow notifications | Sending service notifications (new bookings, planner changes) | By withdrawing notification permission in your browser or disabling notifications in the Platform; the token is then deleted from our systems |
Local storage is usually substantial in size: if you use a shared device we recommend that you sign out when you have finished, which deletes the organisation's local databases.
9. Processing that does not involve cookies
For clarity: some of the providers listed in the Privacy Notice process data without setting cookies or tracking tools on your device, because they operate solely server-side. This is the case, among others, for SMS delivery (Skebby — Commify Italia S.r.l.), WhatsApp Business messaging (Meta), transmission of electronic invoices to the Italian Interchange System (A-Cube S.r.l.) and hosting (Serverplan S.r.l.).
Sending newsletters through Mailchimp may involve statistical tools that measure openings and clicks inside the e-mail: these operate within the e-mail message, not on this website; they are governed by the Privacy Notice and by your newsletter subscription preferences.
10. Legal bases
| Category | Legal basis |
|---|---|
| First-party technical cookies (section 4) | Article 122(1), Legislative Decree 196/2003, which exempts from consent the cookies necessary to transmit the communication or to provide the service requested; article 6(1)(b) and (f) GDPR (performance of the contract and legitimate interest in the security of the service) |
| Payment security cookies (section 5) | Article 122(1), Legislative Decree 196/2003; article 6(1)(b) and (f) GDPR (performance of the contract and legitimate interest in fraud prevention), together with payment security obligations under Directive (EU) 2015/2366 (PSD2) |
| Measurement, statistical or profiling tools (section 6) | None: we do not use any, so we process no data on that basis and no consent is requested from you |
| Functional third-party components (section 7) | Article 122(1), Legislative Decree 196/2003 for any technical storage on the device that is strictly necessary for the function; article 6(1)(b) and (f) GDPR (performance of the contract and legitimate interest in delivering the Platform's interface and functions through reliable resources) |
| Local storage technologies (section 8) | Article 122(1), Legislative Decree 196/2003 (technical tools); article 6(1)(b) GDPR |
11. The information notice and the choices available to you
Why we do not ask for your consent. The consent required by article 122(1) of Legislative Decree 196/2003 is needed in order to store on, or read from, your device tools that are not necessary to provide the service you requested: typically statistical, profiling and advertising cookies. As set out in section 6, the Platform uses no tools of that kind: there is therefore no consent to collect, and you will find no "Accept / Reject cookies" buttons.
The notice. On your first visit a short notice appears at the bottom of the page, telling you that only technical cookies are used and linking to this Cookie Policy. By selecting "Got it" the notice is no longer shown: the acknowledgement is recorded in the technical cookie cookieconsent for 12 months. This is not a consent but a reminder: closing or ignoring the notice activates nothing, because there is nothing to activate.
We do not use cookie walls: access to content and services is in no way conditional on accepting cookies.
How you can still limit what stays on your device. Even though no tools are subject to consent, you can:
- delete cookies and site data at any time through your browser settings (section 12), bearing in mind that blocking technical cookies prevents access to your account area and purchasing;
- block third-party content (maps, fonts, libraries) through your browser settings or extensions, if you would rather your IP address were not disclosed to the providers listed in section 7;
- withdraw your push notification permission at any time through your browser settings or the Platform (section 8);
- sign out, which deletes the organisation's local databases (section 8).
If we introduce measurement tools in the future. They will not be activated before you have been shown a compliant consent banner (accept and reject options with equal prominence, nothing loaded before you choose, withdrawal always available) and before this Cookie Policy has been updated (section 16).
12. Browser settings
You can block or delete cookies and site data at any time through your browser settings, and you can also block third-party content selectively. Please note that blocking technical cookies prevents access to your account area and online purchasing.
- Google Chrome: https://support.google.com/chrome/answer/95647
- Mozilla Firefox: https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
- Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
- Apple Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
We do not list opt-out tools for Google's or other providers' analytics because, as explained in section 6, no measurement tools are active on the Platform for you to opt out of.
13. Transfers to third countries
The Platform's data is hosted on servers located in Italy.
Using the components described in sections 5 and 7 may involve a transfer of personal data (typically IP address and technical identifiers) to the United States. Such transfers take place on the basis of the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (implementing decision (EU) 2023/1795), to which Google LLC, Stripe, Inc. and Meta Platforms, Inc., among others, adhere, and, alternatively or in addition, on the basis of the Standard Contractual Clauses adopted by the European Commission under article 46(2)(c) GDPR. Transfers to the United Kingdom (Pusher Limited) are covered by the adequacy decision renewed by the European Commission on 19 December 2025.
You may request information about the safeguards in place by writing to hello@improoving.me.
14. Retention of data collected through cookies
Data collected through first-party cookies is retained for the durations set out in the tables in sections 4 and 8; after that, the cookie expires and is removed by the browser.
Data collected by the third-party providers listed in sections 5 and 7 is retained in accordance with each provider's own policies, as set out in their respective notices.
We keep no history of your browsing derived from cookies: as we have no measurement tools (section 6), we hold no statistical or behavioural records relating to the users of this website.
Web server logs (IP address, date and time, page requested, browser type), which do not derive from cookies but from the normal operation of the protocol, are processed for security and diagnostic purposes as described in the Privacy Notice.
15. Your rights
In relation to personal data processed through cookies and equivalent technologies you may exercise the rights set out in articles 15-22 GDPR: access, rectification, erasure, restriction, portability and objection. We do not ask you for any cookie-related consent (section 11); you remain free to withdraw at any time your push notification permission (article 7(3) GDPR) and, more generally, to limit or delete from your browser whatever is stored on your device (sections 11 and 12).
Requests should be sent to hello@improoving.me. We will respond without undue delay and in any case within one month of receipt, extendable by two further months for complex requests (article 12(3) GDPR).
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) under article 77 GDPR, as well as to bring proceedings before the courts (article 79 GDPR).
16. Changes to this Cookie Policy
The Controller may update this Cookie Policy to reflect changes in legislation, decisions of supervisory authorities or changes in the tools used. The current version is always published on this page with its last-updated date and version number.
Introducing measurement or profiling tools would be a material change: in that case this Cookie Policy will be updated before they are activated and a banner will be shown to collect your consent, which you will be free to refuse without any restriction of the services.