Informativa sulla Privacy

Privacy Policy

Last updated: October 21, 2026
This document is drafted pursuant to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and Federal Decree-Law No. 26 of 2025 on Child Digital Safety (primary applicable laws, as the Data Controller is established in Abu Dhabi, UAE). Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 apply extraterritorially insofar as the website targets Italian citizens residing in the UAE.

1. Data Controller

The Data Controller for personal data collected through the website maxsalvato.com and the domains listed below, which all lead to this website, is:

Massimiliano Salvato (Max Salvato)
Address: Abu Dhabi, United Arab Emirates (UAE)
Email: [email protected]
Websites: www.maxsalvato.com, www.slvt001.com, www.slvt001.dev, www.italianiadabudhabi.com, www.autonest.dev

Regulatory framework. The Data Controller is established in Abu Dhabi (UAE); therefore, the primary applicable law is the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). EU Regulation 2016/679 (GDPR) applies extraterritorially pursuant to Art. 3(2) insofar as the website targets Italian citizens (EU data subjects) and monitors their behavior, even if they are physically residing in the UAE. The Controller is committed to compliance with both regulatory frameworks, applying the more protective standard on a case-by-case basis.

2. Categories of Data Processed and Purposes

2.1 Browsing data

The computer systems and software procedures on which this website is based acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes IP addresses, browser and operating system type, URI of requested resources, request time, and other parameters relating to the visitor’s operating system.

These data are used only to run and protect the website and to obtain anonymous statistics. The Controller does not keep logs; the hosting provider and Cloudflare keep their own technical logs according to their privacy policies.

The Italiani ad Abu Dhabi app collects anonymous, aggregate usage statistics (for example, which sections are opened), without cookies and without identifying who uses it.

We count how many people are connected at that moment, only as a number: no cookies, nothing stored on your phone, non-reversible fingerprints that delete themselves after a few minutes. To count members active in the day, one fingerprint per member is kept until the end of the day; then only the number remains.

All pages of the website are also measured with Cloudflare Web Analytics, which counts visits in aggregate form without cookies and without identifying who visits (see section 3).

The website’s short links (for example maxsalvato.com/instagram) count clicks in aggregate form, per day and per source message, without recording IP addresses or any data that identifies who clicks.

2.2 Registration to the “Italiani ad Abu Dhabi” Community

Through the registration form in the Italiani ad Abu Dhabi app (www.maxsalvato.com/IAAD), users can request access to the “Italiani ad Abu Dhabi” WhatsApp community. The data collected are:

  • First and last name
  • Email address
  • WhatsApp phone number (with international prefix)
  • User type (Resident / Almost resident / Tourist)
  • A second WhatsApp number, if any, entered by the Controller when the number provided is not active on WhatsApp
  • The source of the registration (website or a community event link)
  • Date of the invitation to the community and date of profile activation
  • Consent to receive community communications (newsletter)
  • Date and time of registration and confirmation

Purpose: registration management, manual review of the request, sending the WhatsApp community access link, periodic community communications, annual verification of Abu Dhabi residency (with possible removal from the community in case of no response or negative response), access to the reserved area of the app via an access link sent by email.

For Tourists, registration gives access to the reserved area of the app and not to the WhatsApp community. The Almost resident profile lasts 180 days from registration: if no switch to Resident is requested within that period, the profile automatically becomes Tourist, without any data being deleted.

Upgrade to Resident: you may optionally attach a photo proving residence (feel free to cover what isn’t needed). Only I see it, it is never public, and I delete it as soon as I decide, or after 30 days at the latest.

Legal basis: explicit consent of the data subject (Art. 6(1)(a) GDPR), expressed by checking the consent box in the registration form.

Retention: data are retained for the duration of the community membership and deleted within 30 days of removal or upon request by the data subject. Registration requests that are not completed, meaning you do not join the WhatsApp community, are closed 30 days after the last invitation: you receive an email reminder after 14 days and an email when the request is closed. The data is deleted 30 days after closure, unless you ask to reopen the request.

2.3 Automated email communications

In relation to community management, the website automatically sends the following types of emails:

  • Notification of receipt of the registration request
  • Annual residency verification (“Do you still live in Abu Dhabi?”)
  • Up to two reminders in case of no response to the verification
  • Notification of removal from the community
  • Access link to the reserved area of the app
  • Explanation email to anyone who requests the access link before their profile is active
  • Reminder and closure of incomplete registration requests (when the WhatsApp community is not joined)
  • Confirmation of profile activation
  • Confirmation of an event booking, of joining the waiting list, and notice when a place becomes available
  • Notice of an event cancellation

Emails are sent via the SMTP server of Aruba S.p.A. (smtps.aruba.it), an Italian email provider with servers located in Italy.

2.4 Newsletter / Community communications

If the user has expressed consent to receive community-related communications (option “Yes” in the registration form), their email address may be used to send updates, news, and notices related to the “Italiani ad Abu Dhabi” community.

Legal basis: explicit consent (Art. 6(1)(a) GDPR).
Withdrawal: consent may be withdrawn at any time by writing to [email protected] or using the unsubscribe link in any communication.

2.5 Informational and presentation pages

The Home, Io quantico (media kit), Max Salvato Apps pages, including the pages of the individual apps, Links, Business and the maintenance pages are informational or presentational. They do not collect personal data beyond the browsing data described in section 2.1 and the cookies and preferences described in section 2.6, except as set out below.

Project requests (Max Salvato Apps). The “Let’s talk about your project” form does not send anything to the website: it prepares an email in the visitor’s own mail program, and the visitor decides whether to send it. The data entered (name, email, project type, message) therefore reach the Controller’s mailbox and are used only to reply. Legal basis: pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR). Retention: see section 6, “Contact form data”.

Apps. The web pages of the apps (for example /apps/autonest/) are covered by this policy. The processing carried out by the apps themselves, once installed, is described in their own dedicated policy: for AutoNest, www.maxsalvato.com/apps/autonest/privacy.

Business contacts. The pages also show email addresses for collaborations and for the apps. Anyone writing to one of these addresses provides their data voluntarily; it is used only to reply.

The website’s pages contain links and icons to third-party social platforms (Instagram, YouTube, LinkedIn, X/Twitter, Pinterest, Threads, Facebook, TikTok, WhatsApp). By clicking these links, users leave the website and access platforms subject to their respective privacy policies, over which the Controller has no control.

The website uses only these cookies and tools:

  • Technical cookies (always on, no consent needed):
    • the WordPress login cookie (wordpress_logged_in_…), for members’ access to the app: until logout, at most 14 days;
    • iaad_u: links the copy of your data on your phone to your login; it contains no personal data and lasts as long as the login;
    • ms_consent: remembers your cookie choice (a random code, the choice, the policy version and the date); 6 months;
    • Cloudflare: technical cookies for the website’s security and availability (for example __cf_bm), short-lived.
  • Statistics cookies (only if you accept): Google Analytics 4 (_ga, _ga_…), to understand in aggregate form how the website is used. Without your consent Google Analytics is not even loaded. The cookies last up to 2 years and are deleted if you withdraw consent; the data stay in Google Analytics for 14 months.
  • Data saved in the browser: the chosen language and the app view are remembered in the browser (localStorage). To open the app faster, your phone keeps a copy of your profile data (name, profile type, events) and of the app page. It stays only on your device and is deleted when you log out; after 14 days it is no longer used and is deleted the next time the app opens.

The website uses no marketing or profiling cookies. On your first visit a banner asks whether you accept statistics cookies: you can accept, reject (also by closing the banner with the X) or choose from “Customise”. If you reject, it won’t ask again for 6 months. You can change your mind anytime from “Cookie preferences” at the bottom of every page.

Consent log: to be able to prove the choice made, the website keeps a random code, the choice, the policy version and the date, without IP address, for 12 months.

2.7 Event bookings and waiting list

To book an event or join its waiting list, the following are processed: the member’s profile, the first name, last name and type of each companion (with the age for minors, see section 11), the date and time of the booking and the position on the waiting list. When a place becomes available, the system automatically assigns it to the first group on the list that fits entirely, in order of sign-up, and notifies them by email. Purpose: event organization. Legal basis: performance of the member’s request (Art. 6(1)(b) GDPR).

2.8 Suggestions and reviews

Resident and Almost resident members can send a suggestion for an event or a review, with an optional photo, from the app. They are stored with the member’s name, are visible only to the Controller and are deleted together with the profile. Purpose: organizing better events and improving the community. Legal basis: performance of the member’s request (Art. 6(1)(b) GDPR).

Event proposals: I keep them until I decide; those not accepted are deleted after 12 months. If I use your photo for the event, it becomes the event’s public photo. Your name appears on the event only if you choose so, and only app members can see it.

3. Third-Party Services

The website uses the following third-party services that may process users’ personal data, including data transferred to non-EU third countries (USA). Such transfers are carried out in compliance with GDPR safeguards (standard contractual clauses, adequacy decisions, or equivalent mechanisms).

Service Provider Purpose Data processed Privacy Policy
Google Analytics 4 Google LLC (USA) Statistical traffic analysis, only after consent IP (anonymized), pages visited, device, browser policies.google.com/privacy
Google Search Console Google LLC (USA) SEO performance monitoring Aggregated search queries, click data (anonymous) policies.google.com/privacy
Cloudflare Cloudflare, Inc. (USA) CDN, security, performance optimization, Turnstile CAPTCHA IP, HTTP headers, traffic data cloudflare.com/privacypolicy
Cloudflare Turnstile Cloudflare, Inc. (USA) Anti-bot verification / CAPTCHA in forms IP, browser behavioral data cloudflare.com/privacypolicy
Cloudflare Web Analytics Cloudflare, Inc. (USA) Aggregate visit statistics, without cookies Page visited, referrer, device type cloudflare.com/privacypolicy
WhatsApp WhatsApp LLC / Meta Platforms (USA) Community, channel and messages with members Phone number, profile name, messages whatsapp.com/legal/privacy-policy
Aruba SMTP Aruba S.p.A. (Italy, EU) Sending transactional and community emails Recipient email address, message content aruba.it – Privacy Policy

For US-based Google services, data are transferred in compliance with Standard Contractual Clauses (SCC) approved by the European Commission and the EU–US Data Privacy Framework (where applicable).

International data transfers (UAE PDPL). The Controller is established in the UAE. Personal data are transferred to the following third countries:

  • Italy / EU (Aruba S.p.A., hosting and SMTP servers): the EU provides a data protection framework recognized as adequate at international level; the transfer is therefore permitted under the UAE PDPL.
  • USA (Google, Cloudflare, WhatsApp/Meta): transfer takes place via standard contractual clauses (SCC) entered into by the respective providers, in compliance with the UAE PDPL and the GDPR.

Under the GDPR (extraterritorial application), transfers from the EU to the UAE, for example when a user accesses the website from Italy, are covered by the same safeguard mechanisms.

4. Legal Basis for Processing – Summary

Purpose Legal basis (Art. 6 GDPR)
Registration and management of the WhatsApp community Explicit consent (Art. 6(1)(a))
Service emails (access link, confirmations, annual verification, removal, request reminder and closure) Performance of a contract / legitimate interest (Art. 6(1)(b)/(f))
Event bookings and waiting list Performance of the member’s request (Art. 6(1)(b))
Newsletter and community communications Explicit consent (Art. 6(1)(a))
Responding to contact form requests Pre-contractual measures / legitimate interest (Art. 6(1)(b)/(f))
Statistical traffic analysis (Google Analytics 4) Consent (Art. 6(1)(a)) – subject to acceptance of analytical cookies
Website security (Cloudflare, Turnstile) Legitimate interest (Art. 6(1)(f))
Aggregate visit statistics without cookies (Cloudflare Web Analytics) Legitimate interest (Art. 6(1)(f))
Members’ suggestions and reviews Performance of the member’s request (Art. 6(1)(b))
Members’ event proposals Performance of the member’s request (Art. 6(1)(b))
Upgrade-to-Resident proof Performance of the member’s request (Art. 6(1)(b))
Event companions/minors data Parental/guardian consent of the registering member (Arts. 6(1)(a) and 8 GDPR)

5. Processing Methods and Security Measures

Personal data are processed using computer and electronic means, in compliance with the technical and organizational security measures required by the GDPR. In particular:

  • The website is protected by an SSL/TLS certificate (encrypted HTTPS connection).
  • The infrastructure is managed via Cloudflare, which provides DDoS protection, application firewall, and network optimization.
  • Registration forms are protected by Cloudflare Turnstile to prevent automated submissions (spam/bots).
  • Emails are sent via encrypted SMTP connection (TLS, port 587) to Aruba servers.
  • Member data are stored in the WordPress database of the website, accessible only to the Controller via protected credentials.
  • Access links are generated with random codes of adequate length, valid once and for 30 minutes; action links in emails sent to the Controller are signed with HMAC-SHA256. Annual verification links use a random personal code, valid until the verification ends.
  • Website access passwords are never shared; member authentication is exclusively via an access link sent by email.

6. Data Retention

Data category Retention period
Community member data (name, email, WhatsApp, type) For the duration of membership; after removal, deleted within 30 days (members marked “to be removed” are removed within 30 days)
Incomplete registration requests (not joining the WhatsApp community) Closed 30 days after the last invitation, with an email reminder after 14 days; deleted 30 days after closure, unless you ask to reopen the request
Email sending logs Not retained (logging function disabled)
Google Analytics 4 data 14 months (GA4 default setting)
Cookie consent log 12 months
Cookie choice (ms_consent cookie) 6 months
Cloudflare cookies (security) Session / max 30 days (see Cloudflare documentation)
Contact form data Retained in the Controller’s inbox for the time strictly necessary to respond
Browsing data (server logs) Not kept by the Controller; the technical logs of the hosting provider and of Cloudflare follow their privacy policies
Copy of the app data on the phone On the device only; deleted at logout, no longer used after 14 days and deleted the next time the app opens
Event companion data (including minors: name, surname, age) Max 12 months from the event; early deletion upon parental/guardian request
Suggestions and reviews (with any photos) Until the profile is deleted
Upgrade-to-Resident proof (optional photo) Until the decision, 30 days at most
Event proposals (with any photo) Until the decision; those not accepted are deleted after 12 months; for accepted ones the private note is deleted 12 months after the event; all are deleted together with the profile, except the photo if it became the event’s public photo
Bookings and waiting list Max 12 months from the event
App usage statistics and click counts Aggregate, anonymous data, retained indefinitely as they cannot be linked to individuals
Count of people connected Non-reversible fingerprints, 10 minutes at most; to count members active in the day, one fingerprint per member deleted at the end of the day (only the number is kept); daily peak and count: numbers only, up to 400 days

7. Rights of the Data Subject

As a data subject (EU or UAE resident), you have the right to:

  • Access (Art. 15 GDPR / Art. 7 UAE PDPL): obtain confirmation of processing and a copy of your data.
  • Rectification (Art. 16 GDPR / Art. 8 UAE PDPL): request correction of inaccurate or incomplete data.
  • Erasure (“right to be forgotten”) (Art. 17 GDPR / Art. 9 UAE PDPL): request deletion of your data, subject to legal obligations.
  • Restriction of processing (Art. 18 GDPR / Art. 10 UAE PDPL): request suspension of processing in certain circumstances.
  • Data portability (Art. 20 GDPR / Art. 11 UAE PDPL): receive your data in a structured, machine-readable format.
  • Objection (Art. 21 GDPR / Art. 12 UAE PDPL): object to processing based on the Controller’s legitimate interest, including direct marketing.
  • Withdrawal of consent (Art. 7 GDPR / UAE PDPL): withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
  • Complaint (Art. 77 GDPR / UAE PDPL): lodge a complaint with the competent supervisory authority.

To exercise your rights, write to: [email protected]
The Controller will respond within 20 working days of receiving the request (deadline under the UAE PDPL, more restrictive than the 30 days under the GDPR).

8. Supervisory Authorities

You have the right to lodge a complaint with the supervisory authority competent in your country of residence.

Primary authority: UAE (for all community members)

UAE Data Office (UAEDO): federal authority competent under the UAE PDPL, as the Controller is established in Abu Dhabi:
Website: uaedataoffice.gov.ae
Email: [email protected]

The Controller is required to notify the UAE Data Office, without undue delay, of any personal data breach likely to result in a risk to the privacy or security of data subjects, and to directly inform affected data subjects in cases of high risk.

Secondary authority: EU (for data subjects with EU residence or nationality)

Garante per la Protezione dei Dati Personali (Italy): competent extraterritorially under Art. 77 GDPR for data subjects of Italian nationality or residing in the EU:
Website: www.garanteprivacy.it
Email: [email protected]
PEC: [email protected]

9. Communication and Disclosure of Data

Personal data are not sold, transferred, or disclosed to third parties for commercial purposes. They may be communicated only to service providers acting as Data Processors under Art. 28 GDPR (e.g., Aruba for email sending, Cloudflare for network security), exclusively to the extent necessary for service provision.

Community member data are not visible to other community members. The Controller uses contact details (WhatsApp, email) exclusively for managing community access and service communications.

10. Annual Verification and Removal Process

To keep the community member list up to date, the Controller runs an annual automated verification process. Each active Resident receives an email asking “Do you still live in Abu Dhabi?”. The member has two options:

  • Confirm: data are updated and membership remains active.
  • I no longer live in Abu Dhabi: the profile is marked “to be removed” for removal from the WhatsApp community.

In case of no response, up to two reminders are sent. If no response is received after the second reminder, the profile is marked “to be removed” and the member receives an email notification. In both cases removal from the community takes place within 30 days (if the Controller has not done it earlier, the system records it automatically) and the data are deleted from the database within the following 30 days.

This process is carried out on the basis of the Controller’s legitimate interest in maintaining an up-to-date and relevant community (Art. 6(1)(f) GDPR) and by virtue of the consent given at the time of registration.

Almost resident profiles are not subject to the annual verification: the 180-day duration described in section 2.2 applies to them. Tourists do not take part in the annual verification either.

11. Data Relating to Minors

Registration to the community and access to the reserved area of the app are reserved for persons over 18 years of age.

However, at events organized by the community, an adult member may register their attendance including companions. Where the event expressly allows minors (“children admitted” option activated by the organizer), the member may list children or minors in their care as companions, providing for each:

  • First and last name
  • Type: “minor”
  • Age (integer)

Legal basis: the minor’s data are provided directly by the parent or legal guardian registering for the event. By entering such data, the parent/guardian declares that they hold parental responsibility and provides consent to processing pursuant to Arts. 6(1)(a) and 8 GDPR, Art. 2-quinquies of Legislative Decree 196/2003, and the UAE PDPL which sets the minimum age for independent consent to data processing at 18 years.

Purpose and processing limitation: companion minors’ data are used exclusively for event logistics (number of participants, possible age-group breakdown) and are not shared with third parties or used for any purpose other than that indicated.

Retention: companion data (including minors) are retained in the event registration for the time strictly necessary for its management and in any case no longer than 12 months from the event. The parent/guardian may request early deletion by writing to [email protected].

UAE Federal Decree-Law No. 26 of 2025 on Child Digital Safety. In compliance with the UAE law on digital safety of minors, in force from January 1, 2026 with a 12-month compliance period, the Controller undertakes to collect data of children under 13 only with explicit, documented, and verifiable parental consent. For minors aged 13 to 18, parental/guardian consent is still required under the UAE PDPL. Registration for events with minor companions falls within this perimeter: the parent completing the form acts as the consenting party.

The Controller does not collect data relating to minors in any context other than those described above. Should it become aware of unintentional processing of data relating to minors outside the cases indicated above, it will proceed with immediate deletion.

12. Changes to this Policy

The Controller reserves the right to modify this Privacy Policy at any time, in particular following regulatory changes or changes to the services used. The updated version will always be available on this page. Material changes will be communicated to community members by email.

Effective date of the latest version: October 21, 2026.