Privacy Policy

Last updated: April 16, 2026

1. Data Controller

2. Types of data collected

a) Browsing data

The IT systems operating this website automatically collect certain data transmitted through Internet protocols (IP addresses, browser type, operating system, access times, pages visited). This data is used for anonymous statistical purposes and to ensure the website functions correctly.

b) Data voluntarily provided

• Contact form: name, surname, email, phone, message
• "Activate your venue" form: business name, address, contact person, description, images
• Newsletter subscription: email, name
• Event registration: name, surname, email, any dietary preferences or allergies voluntarily communicated
• Payments: handled entirely by PayPal; the Controller does not collect or store credit card or bank account data

c) Special categories of data (Art. 9 GDPR)

When registering for gastronomic events, users may voluntarily provide dietary preferences or allergy information that could reveal health data or religious beliefs. Such data is processed exclusively on the basis of explicit consent (Art. 9(2)(a) GDPR) and solely to ensure a safe experience during the event.

d) Cookies

Please refer to the Cookie Policy for details. Fonts used on this website are self-hosted on the Controller's server and do not involve any data transfer to third parties.

3. Purposes and legal bases

Purpose	Description	Legal basis
Service provision	Managing contact requests, registrations, event sign-ups, newsletters	Art. 6(1)(b) – Contractual performance
Legal obligations	Tax, accounting, regulatory compliance	Art. 6(1)(c) – Legal obligation
Direct marketing	Sending newsletters and promotional communications	Art. 6(1)(a) – Explicit consent
Web analytics	Traffic analysis via Google Analytics 4, subject to user consent	Art. 6(1)(a) – Consent
Payment processing	Transaction processing for events and services	Art. 6(1)(b) – Contractual performance
Dietary preferences	Allergies and preferences for gastronomic events	Art. 9(2)(a) – Explicit consent

4. Data Processors (Art. 28 GDPR)

Provider	Service	Location / Guarantees
Netsons S.r.l.	Website hosting, servers, database	Italy – EU servers
GetResponse S.A.	Email marketing, newsletters, forms	Poland (EU) – Non-EU sub-processors regulated by SCCs
PayPal (Europe)	Electronic payments (checkout only)	Luxembourg (EU) – GDPR and PSD2 compliant
Google Ireland Ltd.	Google Analytics 4 (consent-based only)	Ireland (EU) – IP anonymization, Consent Mode v2

5. International data transfers

Personal data is stored on servers within the European Union. Some Processors may use sub-processors outside the EU; in such cases, transfers are governed by Standard Contractual Clauses (SCCs) and/or adequacy decisions.

6. Data retention periods

Data type	Retention period
Browsing data	Deleted within 14 months
Contact form data	Max 12 months from last contact
Newsletter data	Until consent is withdrawn
Event/venue registration data	Duration of relationship + 10 years
Dietary preferences	Deleted within 30 days after event
Payment data	Transaction confirmation stored for 10 years
Italian Truffle App data	See dedicated notice

7. Your rights

Under Articles 15–22 GDPR, you have the right to:

• Access (Art. 15): obtain confirmation of processing and access your data
• Rectification (Art. 16): correct inaccurate or incomplete data
• Erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Restriction (Art. 18): restrict processing in certain cases
• Portability (Art. 20): receive your data in a structured, machine-readable format
• Objection (Art. 21): object to processing, including direct marketing
• Withdraw consent: at any time, without affecting prior processing

To exercise your rights, contact:

The Controller will respond within 30 days. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) – www.garanteprivacy.it

8. Provision of data

Providing data for marketing and dietary preferences is optional. It is mandatory for service delivery: failure to provide required data will make it impossible to process your request.

9. Changes

The Controller reserves the right to modify this notice at any time by publishing updates on the website.