Special offer: All massages €50 instead of €60 · Until 31 October 2026See offers

Privacy and cookie policy

Last updated: 14 October 2026 · This is a translation: in case of doubt, the Italian version prevails.

Data controller

Studio Masaracchio, VAT no. IT06881500828, Via Don Orione 35, 90142 Palermo, Italy, represented by Roberto Masaracchio. Phone +39 379 148 9709, email studiomasaracchio@gmail.com.

Studio Masaracchio is the business of Roberto Masaracchio, holistic practitioner. The massage therapist Antonino Masaracchio also works at the same address, with a separate business, contacts, website and data processing: this notice, the contacts and the bookings on this website only concern Studio Masaracchio.

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

Data processed and purposes

  • Providing treatments: personal and contact details and the information you give us to check that the massage is suitable for you. Legal basis: performance of a contract (Art. 6.1.b) and, for any health information, your explicit consent (Art. 9.2.a).
  • Legal obligations: tax, accounting and administrative requirements (Art. 6.1.c).
  • Contacts: if you call us or write on WhatsApp or by email, we use your data to reply (Art. 6.1.b).
  • Statistics and marketing on the website: only with your consent, as described under Cookies (Art. 6.1.a).

The Studio never discloses data that could reveal your health.

Bookings on this website

When you book a massage with the calendar on this website you give us your first and last name, mobile number and email, together with the massage, day and time you chose. We use them only to manage your appointment: we add it to the Studio's diary on the Fresha platform (Fresha.com SV Ltd), which emails you the confirmation and reminders, and we send you the confirmation and any updates on WhatsApp (WhatsApp Ireland Ltd). Legal basis: performance of a contract and of pre-contractual steps you requested (Art. 6.1.b).

The booking request is notified to the controller via Telegram (Telegram Messenger Inc.). Adding it to Fresha and sending the WhatsApp message are carried out on the controller's behalf, from the Studio's computer, by an automated assistant (Claude, Anthropic PBC). To protect the diary from fake bookings the server checks some technical signals (for example whether the form is filled in by an automated program) and counts the requests coming from the same network, stored in hashed form for the last 24 hours only.

On the website server the booking is kept for 30 days and then deleted; the appointment stays in the Studio's Fresha diary for the periods described under “Retention”.

Mobile number first: in the form you first enter your mobile number. The site checks it against the studio's client list (kept on the server in encrypted form, with first and last name and whether there is an email): if you are already a client it greets you by name and asks for nothing else, otherwise it asks for your name and email. To prevent abuse, freshly loaded time slots are required and checks per network are limited. If you are already a client, even if you don't finish booking I receive the visit summary described below.

“Remember me on this device” (ticked by default, you can untick it): your name, mobile and email are saved in your browser (localStorage, item sm_pren_dati) together with the last massage you booked and a random personal code, so the form is filled in next time and the site recognises you. When you come back, the site uses the code to show only you your next appointment (which you can move or cancel up to 24 hours before), how your last session went and the sessions left on packages and memberships; this information is read from Fresha at most every 12 hours and kept on the website's server (in a folder not reachable from the browser) linked to your mobile number, for no more than 24 months after your last visit. The code becomes active after your first completed session: before that you only see the booking you just made. When you come back to the site, at the end of your visit I get a message with your name, the pages you viewed and, if you started booking without finishing, the day and time you were choosing, so I can message you if you need a hand. You can delete everything from your device with “Not you?” or by booking without the tick; to delete the data on the server too, just message me.

Booking measurement: only if you have accepted marketing cookies, when the booking is confirmed the website tells Meta (pixel and Conversions API) the massage, price and booking code, together with your email, mobile, first and last name turned into non-reversible codes (SHA-256 hashes) that Meta uses to match the booking to its ads; Google Analytics and TikTok receive the massage, price and booking code, without contact details. If you have not accepted cookies, the form shows an optional, unticked box: ticking it you agree to share only that booking with Meta (Conversions API, without cookies) with the same encrypted data plus IP address and browser type; legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time by writing to the studio. Without either consent nothing is sent.

After your session: a few hours after an appointment booked on the website I message you on WhatsApp to ask, if you like, for a review (Google, Facebook or Fresha; so as not to ask twice I check whether you have already left one under your name) and to send you your personal “invite a friend” link, based on the consent you sign at the studio. Whoever books on the website with your link pays €40 for their first massage; their booking is linked to your code and, after their session, I let you know you have €10 off (also noted in your client record on Fresha), without telling you who came. To do this I keep your first name, mobile number, language and rewards while the programme is active and in any case for no more than 24 months after the last invitation. Whoever opens the link only sees your first name. If you don't want these messages, just tell me, including by replying on WhatsApp.

If you accept cookies during your visit: until you choose, what you do on the open page (for example opening the calendar, choosing a time, a confirmed booking) stays only in your browser's memory, with no cookies and nothing sent. If you accept within 30 minutes on the same page, it is reported to Meta with the time it happened, as if you had accepted earlier; if you decline or close the page, it is deleted.

Purchases through Fresha

Memberships, packages and gift cards are bought on the Fresha platform (Fresha.com SV Ltd). When you click “Buy” or “Give” you leave this website: the data you enter on Fresha is processed under Fresha's privacy policy. The Studio receives the data needed to manage the purchase and the appointments.

Recipients

Where relevant, data may be shared with banks, insurers, tax, legal and employment advisers, IT system providers, public authorities where required by law, and the service providers listed in this notice, appointed as processors where necessary.

On your first visit we ask for your consent. Without consent we only use technical tools; you can change your mind at any time from .

  • Technical (always on): store your cookie choice in the browser. No consent needed.
  • Internal website statistics (no cookies): to understand how the site is used, the server records each visit in pseudonymous form: pages viewed, time spent, scrolling, buttons clicked (for example “Book now”, WhatsApp, phone), where the visit came from, language and device type, and the approximate city derived from the IP address with the last digits set to zero (ipapi.co service, Kloudend Inc., USA); the IP address is not stored. The visit ID is a random code kept in your browser (sessionStorage) only while the tab is open. This data is not combined with other data, is not used to identify you and is only visible to the controller, who receives a summary through Telegram (Telegram Messenger Inc.). Individual visits are deleted after 2 days, daily summaries after 120 days. Legal basis: legitimate interest in improving the website (Art. 6.1.f); you can object by writing to the address below.
  • Marketing — Meta Pixel (Meta Platforms Ireland Ltd), only with your consent. Records the pages you visit, how far you scroll and how long you stay, the services, packages and memberships you view with their price, clicks on “Book now” and on contacts (phone, WhatsApp, email), the steps of a booking on this website (massage, day and time chosen) and the confirmed booking (see “Bookings on this website”). Used to measure the performance of ads on Facebook and Instagram and to show you relevant content. Cookies: _fbp and _fbc (Meta, up to 90 days) and sm_vid (anonymous browser ID generated by the site, up to 13 months), sent to Meta only in hashed form. The same events are also sent to Meta from the website's server (Conversions API), together with your IP address and browser type, for more reliable measurement; this too happens only with your consent. If you booked on the website with “Remember me”, with your consent events also include your email, mobile, first and last name and country turned in your browser into non-reversible codes (SHA-256 hashes), which Meta uses only to match them to your profile.
  • Statistics — Google Analytics 4 (Google Ireland Ltd), only with your consent. Measures, in aggregate form, pages visited, traffic sources, scrolling, time on page, services viewed and clicks on “Book now” and contacts. Cookies: _ga and _ga_* (up to 13 months).
  • Marketing — Google Ads (Google Ireland Ltd), only with your consent. Measures conversions from ad campaigns on Google (clicks on “Book now” and contacts) and allows relevant ads to be shown. Cookies: _gcl_au, _gcl_aw and cookies on Google domains (up to 90 days).
  • Marketing — TikTok Pixel (TikTok Technology Limited, Ireland), only with your consent. Records pages visited, services viewed with their price and clicks on “Book now” and contacts, to measure the performance of ads on TikTok and show you relevant content. Cookies: _ttp and ttcsid (TikTok, up to 13 months); the sm_vid ID is sent to TikTok only in hashed form.
  • Link with Fresha: if you have given consent, links to Fresha (purchases of packages, memberships and gift cards) include technical parameters (anonymous ID, event code and any source codes from Facebook, TikTok or Google) that allow Meta, TikTok and Google to recognise the same visit on Fresha's purchase page.
  • Google Maps: the map on the Contact page only loads if you click “Show the map”.

Meta may transfer data outside the European Economic Area under the EU-U.S. Data Privacy Framework or standard contractual clauses; for the collection and transmission of data through the pixel, Studio Masaracchio and Meta are joint controllers (see Meta's privacy policy). TikTok may transfer data outside the EEA under standard contractual clauses (see TikTok's privacy policy). Google may transfer data to the United States under the EU-U.S. Data Privacy Framework; the site uses Google Consent Mode, so no Google tag is loaded without your consent (see Google's privacy policy and how Google uses data from partner sites).

Retention

Data is kept in electronic and paper archives for as long as needed for the purposes above and for the period required by law (e.g. 10 years for tax data). Your cookie choice is kept for 12 months, after which we ask again.

Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing, portability, object to processing and withdraw your consent, by writing to studiomasaracchio@gmail.com (Chapter III GDPR). You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

Book now