Privacy & Cookie Policy

When you fill in the contact form, message us on WhatsApp, Instagram or by email, or call us, we collect the data you provide voluntarily: name, email address and phone number, together with the information about the event you want to organise.

While browsing we do not collect any profiling data: the site uses no statistical or marketing tools. For security, our proxy’s access logs record your IP address, browser (user agent), the page requested and the time, and are deleted after 30 days; the legal basis is our legitimate interest in protecting the site (Art. 6(1)(f) GDPR).

If the request goes on to the platform, transaction data (amount, outcome, reference) is processed by a PCI-DSS certified payment provider: your card details never pass through our systems and are not stored by us.

We use the data in your request solely to answer it, prepare a proposal and get back to you about it, on WhatsApp and/or by email at the number and address you gave us. The legal basis is the performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR); the tax and accounting obligations that follow rest on Art. 6(1)(c) GDPR.

We carry out no marketing and no profiling, and no automated decision-making takes place. After the event we may ask you, once and on the basis of our legitimate interest, to review the venue: you can object at any time by replying to that message or writing to us.

Requests that do not lead to a contract are anonymised 12 months after the event date. If a contract is concluded, the data is kept for the 10 years following the event date, for civil-law and tax obligations, and then anonymised. Withdrawal requests are kept for 10 years as proof that the right was exercised.

Data may be processed on our behalf, as processors under Art. 28 GDPR, by the suppliers required to run the service: Hetzner Online GmbH (hosting and storage, on servers in the European Union), Cloudflare, Inc. (the delivery and protection network the site and the platform pass through), Stripe (transaction data) and Zoho Mail (email). Professionals and advisers bound by confidentiality may also access it, as may the competent public authorities within the limits set by law. Messages we exchange on WhatsApp and Instagram are a separate case: they pass through Meta group services (WhatsApp Ireland Limited, Meta Platforms Ireland Limited).

If the request goes on with an affiliated venue, the data needed to organise the event is passed to it, and from that point the venue processes it as an independent controller. Data is not sold or disclosed to third parties for their own marketing purposes.

Data is processed mainly within the European Union. Where a supplier involves a transfer to a third country, it takes place only with the safeguards in Art. 44-49 GDPR: adequacy decisions of the European Commission, standard contractual clauses (SCC) or recognised certification mechanisms. Cloudflare and Meta in particular may transfer data to the United States under the EU-US Data Privacy Framework.

As a data subject you may exercise at any time and free of charge the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction of and objection to processing, data portability and withdrawal of any consent given.

Requests should be addressed to the controller by email with the subject “Richiesta GDPR”, by certified email (PEC), or by registered letter with return receipt to the registered office: the details are given above. We reply within one month of receipt, extendable by two further months where necessary, given the complexity and number of requests; in that case we tell you so within the first month, with the reasons (Art. 12(3) GDPR).

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).