Privacy - Information Notice pursuant to Article 13 of Regulation (EU) 2016/679 - WEB

version  n.1 del 02-09-2026

With this document ("Privacy Notice"), the Data Controller, as identified below, wishes to inform you about the purposes and methods of processing your personal data as well as the rights granted to you under Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"). This Privacy Notice may be supplemented by the Data Controller where any additional services requested by you involve further processing activities.

The processing activities are aimed at collecting the following personal data:

• Cookies: Profiling Cookies;
• Behavioral Data: Browsing logs;
• Common Personal Data: Identification and personal details. 

Website users. 

1. CUSTOMERS - Marketing

Sending advertising, educational and informational materials concerning offers promoted by the Data Controller to users subscribed to the newsletter service through the website or by completing subscription cards at retail stores. 

Legal Basis:
Consent - Article 6(1)(a) GDPR. 

Purposes of Processing:

1. Sending commercial newsletters to customers and prospective customers via email;
2. Sending instant messages through tools such as SMS, WhatsApp and Telegram;
3. Sending marketing communications by paper and electronic means (email). 

Nature of Provision:
Optional. Failure to provide the data will make it impossible for the data subject to receive promotional communications from the Data Controller. 

Retention Period:
Data will be deleted immediately upon termination of the contractual relationship or withdrawal of consent. Data relating to prospects who do not enter into a contract will be deleted within 24 months from collection. 

Processing Methods:
Processing is carried out mainly by electronic means. 

2. WEBSITE - Browsing Data

Collection of anonymous statistical information regarding website use, verification of the proper functioning of the website and investigation of liability in the event of potential cybercrime affecting the Data Controller. 

Legal Basis:
Legitimate Interest - Article 6(1)(f) GDPR. 

Purposes of Processing:

1. Analysis of data to develop and maintain the website;
2. Investigation of responsibility in the event of cybercrime affecting the website and/or data subjects;
3. Anonymous statistical analysis regarding website usage. 

Nature of Provision:
Mandatory. Failure to provide the data will make it impossible for the Company to provide the web service. 

Retention Period:
30 days. 

Processing Methods:
Processing is carried out through electronic means. 

3. WEBSITE - Requests Submitted Through the Website

Requests submitted by data subjects through the Data Controller's website. 

Legal Basis:
Performance of a Contract - Article 6(1)(b) GDPR. 

Purpose of Processing:

1. Management of requests submitted via website tools. 

Nature of Provision:
Optional. Failure to provide the data will make it impossible for the Data Controller to respond to the data subject's request. 

Retention Period:
Until completion of the request. 

Processing Methods:
Processing is carried out electronically.

4. WEBSITE - Use of Services and Restricted Area

Use of services provided through the restricted area of the Data Controller's website. 

Legal Basis:
Performance of a Contract - Article 6(1)(b) GDPR. 

Purposes of Processing:

1. Registration within the restricted area;
2. Provision of services through access to the restricted area of the website. 

Nature of Provision:
Optional. Failure to provide the data will make it impossible for the Data Controller to provide services through the restricted website area. 

Retention Period:
Until deletion of the user account. 

Processing Methods:
Processing is carried out electronically. 

5. FACEBOOK SOCIAL PAGE

When a user interacts with the Page managed by the Data Controller, Facebook ("Social Media") collects information such as the types of content viewed or interacted with, actions performed, and information regarding the devices used (IP addresses, operating system, browser type, language settings and cookie data). 

Page Insights are aggregated statistics generated from events logged by Facebook servers when users interact with Pages and related content. 

As described in Facebook's Privacy Policy, Facebook also collects and uses information to provide statistical services known as Page Insights, allowing page administrators to understand how users interact with content. 

Further information:

• Facebook Privacy Policy: https://www.facebook.com/policy
• Facebook Privacy Information: https://www.facebook.com/privacy/explanation
• Page Insights Information: https://www.facebook.com/legal/terms/information_about_page_insights_data
• Cookie Policy: https://www.facebook.com/policies/cookies/ 

The Data Controller, as administrator of the Page, and Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) act as Joint Controllers pursuant to Article 26 GDPR for the processing of Page Insights data. 

The joint controller arrangement is available at:
https://www.facebook.com/legal/terms/page_controller_addendum 

Legal Basis:
Legitimate Interest - Article 6(1)(f) GDPR. Prior consent is therefore not required. 

Purpose of Processing:
Statistical analysis concerning the use of elements contained within the Facebook page managed by the Data Controller. 

Nature of Provision:
Mandatory. Failure to provide the requested data will make it impossible for the Data Controller to provide services through the Facebook Page. 

Retention Period:
Data is processed only for the period necessary to achieve the purposes described above and in accordance with Facebook's policies. 

Processing Methods:
Processing is carried out electronically by Facebook as Joint Controller.

6. IT Systems Management

Personal data is used, based on the legitimate interests of the Data Controller and the data subjects, for the management and security of IT infrastructures. 

Legal Basis:
Legitimate Interest - Article 6(1)(f) GDPR. 

Purpose of Processing:
Management of IT systems, including infrastructure management, business continuity and IT security. 

Nature of Provision:
Mandatory. Objecting to the processing may make it impossible for the Data Controller to perform the contract with the customer/data subject. 

Retention Period:
Personal information is retained throughout the contractual relationship and thereafter for the period necessary to establish, exercise or defend legal claims. 

Processing Methods:
Processing is carried out through electronic means.

7. Google Fonts

Your personal data may be used to improve the usability of website content through the Google Fonts service. Google Fonts enables faster page loading, optimization for web use and improved usability of website content. 

Legal Basis:
Legitimate Interest - Article 6(1)(f) GDPR. 

Purpose of Processing:
Use of CSS files provided by Google Fonts to determine the style and quality of website/app content. 

Nature of Provision:
Mandatory. Objecting to the processing may prevent the Data Controller from ensuring the best possible consultation of website/app content. 

Retention Period:
Information regarding collection and storage methods is available at:
https://policies.google.com/privacy 

Processing Methods:
Google Fonts is provided by Google acting as an independent Data Controller. No registration or authentication with Google systems is required. No cookies are stored in the user's browser. CSS files and fonts are delivered through fonts.googleapis.com and fonts.gstatic.com. For more information please consult Google's Privacy Policy: https://policies.google.com/privacy.

Personal data is processed exclusively within the European Union. 

• Data Processors: 

  • ICT system maintenance providers;
  • Newsletter service providers;
  • Website developers;
  • Profiling software providers;
  • Ticket management platform providers;
  • Loyalty program providers;
  • Cloud service providers.

 

• Authorized Persons Processing Data:

  Employees of the Data Controller.

Under Articles 15 to 22 GDPR, you may exercise the following rights:

• Right of access;
• Right to rectification;
• Right to erasure ("right to be forgotten");
• Right to restriction of processing;
• Right to data portability;
• Right to object, including objection to processing for marketing purposes

Where processing is based on consent, you may withdraw your consent at any time, as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal. 

You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where permitted by applicable law or based on your consent

In any such case, you have the right to:

• challenge the decision;
• express your point of view;
• request human intervention to review the decision. 

You may lodge a complaint at any time with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

http://www.garanteprivacy.it 

The above rights may be exercised by contacting the Data Controller using the contact details provided above.