Last updated: 1 October 2026

Privacy policy

This policy explains what personal data the website ufflzl.com (“Uffizi Blog”, “we”) processes when you visit this website, and the rights and choices available to you. This website is an independent editorial publication about visiting the Uffizi Gallery in Florence; it is not affiliated with, sponsored by or endorsed by the Uffizi Galleries or any public authority.

1. Who is responsible for your data

The editorial team of Uffizi Blog is responsible for the processing described below. You can reach us at info@ufflzl.com or by post at Uffizi Blog, Florence, Italy (see our contact page).

2. Data we process

• Technical logs. When you request a page, our hosting provider records the request on the server for security and stability purposes: IP address, time, requested URL, user-agent string and the referring website. The logs are kept for a maximum of 30 days and are not used to profile individual visitors.
• Contact enquiries. If you write to us by e-mail, we process your address and the content of your message to answer the enquiry. Correspondence is kept for up to 12 months and then deleted.
• Cookie preference. We store a single cookie that remembers the choice you make in the cookie banner (see our cookie policy).

3. Purposes and legal bases

• Operation, stability and security of the website — legitimate interest (Art. 6(1)(f) GDPR).
• Answering your questions by e-mail — legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
• Storing your cookie choice — your consent (Art. 6(1)(a) GDPR), expressed via the banner.

4. Cookies and advertising

This website does not use advertising networks, tracking pixels, analytics services or social media plug-ins. Only the essential cookies described in the cookie policy are set. Marketing or profiling cookies are only set after an explicit opt-in through the cookie banner.

5. Recipients and data transfers

The website is hosted by a professional hosting provider on our behalf. Where data is transferred outside the EEA, standard contractual clauses or equivalent safeguards apply. We do not sell or rent personal data to third parties.

6. Retention

Server logs are rotated and deleted after 30 days. E-mail correspondence is deleted after 12 months unless a longer statutory retention period applies.

7. Your rights

You may request information about the data we process about you and — where applicable — request its rectification, erasure or restriction of processing, object to processing based on legitimate interest and lodge a complaint with the competent supervisory authority (Garante per la Protezione dei Dati Personali, Italy). Contact us at info@ufflzl.com to exercise any of these rights.

8. Security

The website is served exclusively over an encrypted HTTPS connection. Access to the hosting environment is restricted to the editorial team.