Privacy Policy

Last updated: May 2025

This Policy describes how the Associazione Culturale Da Ponte APS, owner of the site daponteoperafestival.it, collects, uses and protects users’ personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data Controller

Associazione Culturale Da Ponte APS
Via Borgo Luca, 29 – Fregona (TV)
Email: info@daponteoperafestival.it

2. Data Protection Officer (DPO)

The Data Protection Officer can be contacted at the following address:
Email: info@daponteoperafestival.it

3. Data collected and purposes of processing

The site collects the following categories of personal data:

3.1 Browsing data

The IT systems automatically acquire certain data necessary for the operation of the site (IP address, browser type, pages visited, access times). These data are processed exclusively for technical and security purposes and are not retained beyond the time strictly necessary.

3.2 Data voluntarily provided by the user

Contact and ticket booking forms
Through the forms on the site, the user may submit their name, email address and other requested data in order to respond to enquiries or manage ticket bookings for performances. Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR); consent of the data subject (Art. 6(1)(a) GDPR).

Newsletter
If the user subscribes to the newsletter, we collect name and email address to send communications about the festival, programme updates and cultural initiatives. Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), freely withdrawable at any time.

Payment data
For the online purchase of tickets, payment data (card details, bank details) are processed exclusively through PCI-DSS certified payment service providers. The Data Controller does not retain credit card data. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

User account
If the user creates an account on the site, the data provided during registration (name, email, password) are retained to allow access to services reserved for registered users. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4. Methods of processing and data retention

Data are processed using IT and electronic tools, with adequate security measures in place to prevent unauthorised access, loss or disclosure. Data are retained for the time strictly necessary for the purposes for which they were collected:

Contact and booking data: until the request has been fulfilled and for the period necessary to comply with legal obligations.
Newsletter data: until consent is withdrawn.
Payment data: for the period required by tax and accounting regulations (generally 10 years).
Account data: until the account is deleted by the user.

5. Disclosure of data to third parties

Personal data may be disclosed to:

Technical and IT service providers (hosting, site management, email sending platforms) acting as data processors, bound by specific agreements pursuant to Art. 28 GDPR.
Certified payment service providers, for the management of transactions.
Competent authorities, where required by law.

Data are not sold, transferred or disclosed to third parties for marketing purposes without the prior consent of the data subject.

6. Transfer of data abroad

Users’ personal data are processed and stored within the territory of the European Union. No transfer to third countries is envisaged.

7. Cookies

The site uses technical cookies and, subject to consent, profiling and analytical cookies. For detailed information on the cookies used, their purposes and how to manage preferences, please refer to our Cookie Policy.

8. Rights of data subjects

Pursuant to Arts. 15–22 of the GDPR, the user has the right to:

Access: obtain confirmation of processing and a copy of their data.
Rectification: request the correction of inaccurate or incomplete data.
Erasure (“right to be forgotten”): request the deletion of data, subject to legal obligations.
Restriction: request the restriction of processing in certain cases.
Portability: receive their data in a structured format and transfer it to another controller.
Objection: object to processing on legitimate grounds or for direct marketing purposes.
Withdrawal of consent: withdraw consent at any time, without prejudice to the lawfulness of processing carried out prior to withdrawal.

To exercise their rights, the user may write to: info@daponteoperafestival.it

The user also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Changes to this Policy

The Data Controller reserves the right to modify this Policy at any time, including in relation to any regulatory changes. Amendments will be published on this page with the updated date indicated. Users are therefore encouraged to consult this section periodically.