Privacy Policy

This notice explains how we process the personal data of visitors to this website and of guests at our events, under Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. Last updated: [TO BE COMPLETED — date of last legal review].

Data controller

The data controller is [TO BE COMPLETED — registered company name, registered office, VAT number (P.IVA), tax code and REA number of the data controller]. To exercise your rights, or for any question about this notice, write to [TO BE COMPLETED — verified e-mail address for privacy requests].

We have not appointed a Data Protection Officer: [TO BE COMPLETED — confirm whether a DPO appointment is mandatory for this business and, if so, publish their contact details].

What we collect and why

Contact and private-event enquiry forms. Name, e-mail, phone number and the content of your message, processed to answer your enquiry and organise the event. Legal basis: steps taken at your request prior to and under a contract (Art. 6(1)(b) GDPR).

Bookings and purchases. Identification and contact details, booking details and payment confirmation. Legal basis: performance of the contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)).

Newsletter. Your e-mail address and subscription status, processed on the basis of your consent (Art. 6(1)(a)), which you may withdraw at any time via the unsubscribe link in every message or by writing to the address above.

Website usage measurement. Aggregated browsing data (pages viewed, referrer, device type), processed only after you give express consent through the cookie banner (Art. 6(1)(a)).

Event photography and video. Photographs and video in which you may be identifiable can be captured at our events. The applicable terms, legal bases and how to object are set out at the event entrance: [TO BE COMPLETED — photography and filming policy, on-site notice and objection process].

Payments

Online payments are handled by Stripe Payments Europe, Ltd., acting as our processor and, for certain anti-fraud and regulatory compliance purposes, as an independent controller. Full card details are collected directly by Stripe and never pass through or rest on our systems: we receive only the transaction outcome, a reference identifier and the details needed for invoicing. Legal basis: performance of the contract and legal obligations. Stripe's own privacy notice governs its processing.

Third-party tools

We use suppliers that process data on our behalf as processors under Art. 28 GDPR: our website hosting and delivery provider, our payment platform (Stripe), our newsletter tool [TO BE COMPLETED — newsletter provider name, not yet enabled] and our statistics tool [TO BE COMPLETED — analytics provider name, not yet enabled]. An up-to-date list of processors is available on request.

Transfers outside the EU

Some suppliers may process data outside the European Economic Area. Where they do, the transfer relies on a European Commission adequacy decision or on Standard Contractual Clauses, together with supplementary measures where required. [TO BE COMPLETED — confirm the transfer basis for each supplier actually enabled].

Retention

We keep contact and enquiry data for as long as needed to handle the enquiry and thereafter for the applicable limitation period for potential claims. Tax and accounting records are kept for ten years as required by law. Newsletter data is kept until you withdraw consent. Statistical data is kept for a limited period and in aggregated form. [TO BE COMPLETED — precise retention periods per category, to be confirmed at legal review].

Your rights

You have the right to request access to your data, its rectification or erasure, restriction of processing, and data portability, and to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. To exercise these rights, write to [TO BE COMPLETED — verified e-mail address for privacy requests].

If you believe our processing breaches data protection law, you may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the authority in your country of residence.

Changes

We may update this notice. Material changes will be signalled on the site with reasonable notice.