Privacy Notice — UTRtek
Last updated: 23 October 2026
This notice explains how the personal data of users of the UTRtek website (instructor area, diver/NFC area, dive log, certification check, instructor finder, course notes) are processed, pursuant to Articles 13, 14 and 26 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code").
1. Who processes the data
Joint controllers (Art. 26 GDPR):
- Leonardo Zillo Monte Xillo, operator of the platform (website on a subdomain of zillo.it), who delivers his own courses under the trade name UTRtek DIR — e-mail: info@zillo.it
- UTRtek UK LTD, piazza Quattro Novembre 4, 20124 Milano (MI), Italy, VAT no. IT07710920963, tax code 07710920963 — e-mail: utrtek.segreteria@yahoo.it
The joint controllers have entered into an agreement setting out their respective responsibilities. In short:
- Leonardo Zillo Monte Xillo runs the platform, its security, the logs and the verification of medical certificates, and handles data subjects' requests about the data processed by the platform;
- UTRtek UK LTD uses personal, training and administrative data to run its own business (certifications, instructors, renewals, invoicing) and sees the list of medical certificates with their validity, but not the documents.
Any request about personal data can be sent by the data subject to info@zillo.it: the request is handled on behalf of both joint controllers. The essence of the agreement is available on request.
No Data Protection Officer (DPO) has been appointed: it is not mandatory, since the health data processed are limited to certificates of fitness for sport.
2. Whose data are processed
- Registered instructors and trainers;
- Divers and students: data may be entered by the data subject or by their instructor when the course is opened (in that case they are collected from the instructor, Art. 14 GDPR);
- People who register or apply for membership through the website;
- Visitors of the public pages (certification check, instructor finder, QR codes);
- Students of UTRtek DIR courses who access the course notes.
Minors. Some courses are intended for minors. Before every course a release form and the consent to data processing are signed; for minors they are signed by the parent or legal guardian.
3. What data, why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Registration, account, management of courses, certifications, NFC cards and QR codes, renewals | name, date and place of birth, address, tax code, phone, e-mail, certified e-mail and VAT no. (for professionals), credentials, courses, results, certifications, card number | performance of the requested service (Art. 6(1)(b)) |
| Dive log | date, times, depth, site, dive centre, gases, equipment, dive buddies, signatures | performance of the service (Art. 6(1)(b)); dives of the last 6 months must be kept by the log owner by law (Italian Law 70/2026, Art. 12(5)) (Art. 6(1)(c)) |
| Fitness for diving | medical certificate of fitness for sport (document), declarations, issue and expiry date | explicit consent (Art. 9(2)(a)), collected at upload; a valid certificate is required to take part in the activities |
| Authenticity check of certificates | uploaded document | explicit consent (Art. 9(2)(a)) and legitimate interest in preventing fraud (Art. 6(1)(f)) |
| Retention of certificates found to be forged or altered | document, date, user code | establishment, exercise or defence of legal claims (Art. 9(2)(f); Art. 6(1)(f)) |
| Insurance | DAN number, issue, expiry, type | performance of the service (Art. 6(1)(b)) |
| Payments and invoicing | amounts, method, dates, billing data | performance of the service and tax obligations (Art. 6(1)(b) and 6(1)(c)) |
| Public certification check | name, country, code, certification, instructor | performance of the service: being able to verify a certification is part of the service (Art. 6(1)(b)) |
| Public instructor finder | name, city, province, country, e-mail of qualified instructors | performance of the service: it is how instructors are contacted by prospective students (Art. 6(1)(b)). Instructors who do not want to be listed can ask UTRtek UK LTD at utrtek.segreteria@yahoo.it |
| Course notes for students of UTRtek DIR courses | username, full name, password (hashed), course level, accesses and downloads with IP | performance of the service (Art. 6(1)(b)); for access logs, legitimate interest in security (Art. 6(1)(f)) |
| Service messages and newsletters to members | e-mail, name | performance of the service for service messages; for newsletters about similar services, Art. 130(4) of the Privacy Code. Unsubscribing is possible at any time through the link in every newsletter |
| Website security and abuse prevention | IP address, browser, pages visited, times, login attempts, IP risk score | legitimate interest in security (Art. 6(1)(f)) |
| Proof of consent | consent answers, date | obligation to demonstrate consent (Art. 7(1)) |
| Handling of deletion requests | name, e-mail, IP, date of the request | legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)) |
Providing the data needed for courses and certifications is mandatory: without them the service cannot be provided. Consent to the processing of health data can be withdrawn at any time; without a valid certificate, however, it is not possible to take part in the activities that require it.
4. Medical certificates: how they are handled
- The data subject uploads the certificate from their personal area.
- The document is checked by hand by Leonardo Zillo Monte Xillo or by a person he has authorised, who verifies its authenticity, also with optical examination tools.
- If it is valid, its expiry date is recorded. UTRtek UK LTD only sees the list with the expiry dates, not the document.
- If it is found to be forged or altered:
- it is kept for 10 years, for legal protection;
- for the same period the account remains flagged. At login a warning is shown, and requests that coincide with other users' requests are queued, with a delay of up to 50 seconds.
These are security measures following a human check, not automated decisions within the meaning of Art. 22. The outcome can be challenged by writing to info@zillo.it.
5. Where the data are and who receives them
The data are stored on the servers of Register.it S.p.A. (Italy), which hosts the website and the database as processor on behalf of Leonardo Zillo Monte Xillo, who subscribed to the service. Backup copies are also kept on a server owned by Leonardo Zillo Monte Xillo in Italy.
The following may receive data, only as far as necessary:
| Recipient | Why | Where |
|---|---|---|
| Register.it | hosting, database, e-mail | Italy |
| Google (Gmail) | sending the website's e-mails | EU/USA |
| Scamalytics LTD | risk score of suspicious IP addresses | United Kingdom (servers in the EEA) |
| ip-api (Artia Soft) | geographic origin of suspicious IP addresses | Romania (EU) |
| geoPlugin SAS | geographic origin of suspicious IP addresses | France and the Netherlands (EU) |
The only transfer to the United States concerns Google (Gmail), certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023). For Scamalytics, based in the United Kingdom, the Commission's adequacy decision for the United Kingdom applies.
The data are not sold and are not used for third-party advertising.
6. How long
| Data | Period |
|---|---|
| Account and personal details | for the whole membership; after a deletion request, 30 days, then anonymisation |
| Courses and certifications issued, with the holder's first and last name | at least 7 years (Italian Law 70/2026), also after the account is deleted: they are official documents also for the instructor who issued them. The student's other data collected when the course was opened (birth details, address, tax code, phone, e-mail) are deleted with the account |
| Dive log | dives of the last 6 months must be kept by law (Italian Law 70/2026, Art. 12(5)): if there are any, the account deletion is postponed until that period ends. For older dives, name and e-mail are kept separately for legal protection for up to 10 years |
| Valid or invalid medical certificates | until the account is deleted |
| Forged or altered certificates and the related flag | 10 years from the check |
| Automatic hourly copies of the data | 3 days |
| Failed login attempts, change log | 180 days |
| Access and browsing logs (including accesses to and downloads of the course notes) | 365 days |
| Tax documents | 10 years, each kept by whoever issues them: Leonardo Zillo Monte Xillo for UTRtek DIR courses, UTRtek UK LTD for everything else |
| Backup copies | up to 12 months, then overwritten |
7. Rights of the data subject
At any time the data subject can ask to:
- access their data and receive a copy;
- rectify them;
- erase them, within the limits of legal obligations and legal protection;
- restrict their processing;
- object to processing based on legitimate interest and to newsletters;
- receive them in a machine-readable format (portability);
- withdraw consent, without affecting processing already carried out.
From the instructor area it is possible to download one's own data and delete the account directly. The deletion takes place after 30 days and can be cancelled during that period. Any other request should be sent to info@zillo.it; a reply is given within one month.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
8. Cookies
The website only uses technical cookies, needed for it to work, which do not require consent:
| Cookie | Purpose | Duration |
|---|---|---|
PHPSESSID | keeps the session after login | until the browser is closed |
utrtekmain | sets how long a page stays open without logging in again | from 12 minutes to 24 hours, depending on the area |
utrtek_nfc_lang | remembers the chosen language | 1 year |
No profiling cookies or third-party analytics cookies are used.
9. Security
Data are protected by login credentials, password-protected restricted areas, access logging and automatic blocking of addresses attempting unauthorised access. Health documents are accessible only to those who verify them.
10. Changes
This notice may be updated. The date at the top shows the latest version. Important changes are communicated to members.