Privacy
How we handle the data you send us with the application, including children’s and teenagers’ data.
Last updated: November 2026
Who we are
The data controller is Booking Pepperkids Agency SNC di Monica Oliveri del Castillo e Paola Zampieri, Via Giuseppe Frua 11, 20146 Milan, Italy, VAT 09340020966. Phone +39 02 23165803, email info@pepperkids.it.
For anything about your data, write to privacy@pepperkids.it. This is a translation; if the two versions differ, the Italian one prevails.
Data we collect
Through the application form: the applicant’s name, age, gender, eye and hair colour; for applicants under 18, the parent’s or guardian’s name; email, phone, city and any notes; 2 to 4 photos. Before sending, the browser removes the GPS location from the photos.
To protect the form we use Cloudflare’s anti-bot check (Turnstile) and a limit on submissions per IP address. As with any website, the server that hosts it records the IP address and the pages visited.
Why, and on what legal basis
We don’t ask for your consent for the application. The legal basis is your request to have it assessed. No law requires you to give us this data, but without the data and photos we can’t assess the application.
| Why | Legal basis |
|---|---|
| Assessing the application, replying to you and sending you the confirmation email | Legal basisYour request before entering into a contract (Art. 6(1)(b) GDPR) |
| Protecting the website and the form | Legal basisOur legitimate interest in the security of the website (Art. 6(1)(f) GDPR) |
| Publishing photos and names of the agency’s children and teenagers | Legal basisConsent, collected by us at the agency (Art. 6(1)(a) GDPR) |
Children and teenagers
For applicants under 18, the application can only be sent by a parent or guardian, who states this in the form. We use the data and photos only to assess it and we don’t show them to clients without your written consent, project by project.
If you are under 18 and reading this page, the application data is yours even if your parents sent it. You can ask them, or write to us at privacy@pepperkids.it, to find out what we keep or to have it deleted.
How long we keep data
If the application doesn’t go ahead, we delete the data and photos within 90 days, including those sent by email to info@pepperkids.it. If it goes ahead, we keep them as long as we work together, then for the periods required by law.
The IP address for the submission limit is kept for one hour. Confirmation and notification emails stay for about 30 days at the service that sends them.
Applications by email
For applicants under 18, before going ahead we ask the parent or guardian for the same statements as in the form.
Who sees the data
At the agency, applications are seen by Monica and Paola and the people who help them. Clients see data and photos only after your written consent.
The suppliers that run the website process data on our behalf: Cloudflare (server; storage of applications in the European Union), Resend and Lettermint (sending emails), Aruba (website and email hosting) and the person who looks after the technical side of the website.
Cloudflare and Resend are US companies. When data passes through the US, the transfer is covered by the EU-U.S. Data Privacy Framework.
Published photos and names
On the website and on our Instagram profile there are photos and names of the agency’s children and teenagers, published with the parents’ consent or, for adults, their own. Consent can be withdrawn at any time by writing to privacy@pepperkids.it, and we remove the photos and name from the website and the profile as soon as possible.
We also show some reviews published on Google, with the author’s name as it appears there (our legitimate interest, Art. 6(1)(f) GDPR).
Your rights
You can ask us to see, correct or delete your data, to restrict its use or to receive a copy, and you can object to its use (Articles 15–21 GDPR). Write to privacy@pepperkids.it and we will reply within one month. We always assess applications ourselves, with no automated decisions.
If you think we handle your data incorrectly, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).