The purpose of this document is to inform the individual (hereinafter referred to as the "Data Subject") regarding the processing of their personal data (hereinafter referred to as "Personal Data") collected by the data controller, Louder S.r.l., with registered office at Via San Rigo 23, 42123 Reggio Emilia, CF/VAT IT-02597380357, REA RE-296410, email address info@partybag.it, (hereinafter referred to as the "Controller"), through the website www.partybag.it (hereinafter referred to as the "Application").

Changes and updates will be binding as soon as they are published on the Application. In case of non-acceptance of the changes made to the Privacy Policy, the Data Subject is required to cease the use of this Application and may request the Controller to delete their Personal Data.

1. Categories of Personal Data processed
   The Controller processes the following types of Personal Data voluntarily provided by the Data Subject:- Contact data: name, surname, address, email, phone, images, authentication credentials, any additional information sent by the Data Subject, etc.

   - Fiscal and payment data: tax code, VAT number, credit card information, details of the bank account, etc.

   The Controller processes the following types of Personal Data collected automatically:

   - Technical data: Personal Data produced by devices, applications, tools, and protocols used, such as information about the device used, IP addresses, type of browser, type of Internet provider (ISP). These Personal Data may leave traces that, especially when combined with unique identifiers and other information received from servers, can be used to create profiles of individuals

   - Navigation and usage data of the Application: such as pages visited, number of clicks, actions performed, duration of sessions, etc.

   Failure to provide Personal Data for which there is a legal or contractual obligation, or if they are a necessary requirement for the conclusion of the contract with the Controller, will result in the impossibility for the Controller to establish or continue the relationship with the Data Subject.

   The Data Subject who provides the Controller with Personal Data of third parties is directly and exclusively responsible for their origin, collection, processing, communication, or dissemination.

2. Cookies and similar technologies
   The Application uses cookies, web beacons, unique identifiers, and other similar technologies to collect Personal Data of the Data Subject on the pages, links visited, and other actions performed when the Data Subject uses the Application. They are stored to be transmitted upon the Data Subject's next visit. The complete Cookie Policy can be viewed at the following address: www.partybag.it/cookie-policy
3. Legal basis and purposes of processing
   The processing of Personal Data is necessary:
   1. for the performance of the contract with the Data Subject, specifically:
      1. fulfillment of any obligation arising from the pre-contractual or contractual relationship with the Data Subject
      2. registration and authentication of the Data Subject: to allow the Data Subject to register on the Application, access, and be identified also through external platforms
      3. support and contact with the Data Subject: to respond to the requests of the Data Subject
      4. payment management: to manage payments by credit card, bank transfer, or other means
   2. for legal obligation, specifically:
      1. compliance with any obligation provided by current regulations, laws, and regulations, especially in tax matters
   3. based on the legitimate interest of the Controller, for:
      1. email marketing of products and/or services of the controller to directly sell the products or services of the Controller using the email provided by the Data Subject in the context of the sale of a product or service similar to that subject to the sale
      2. management, optimization, and monitoring of the technical infrastructure: to identify and resolve any technical issues, improve the performance of the Application, manage and organize information in an information system (e.g., servers, databases, etc.)
      3. security and anti-fraud: to ensure the security of the assets, infrastructure, and networks of the Controller
      4. statistics with anonymous data: to perform statistical analysis on aggregated and anonymous data to analyze the behaviors of the Data Subject, improve the products and/or services provided by the Controller, and better meet the expectations of the Data SubjectPersonal Data of the Data Subject may also be used by the Controller to defend themselves in court before the competent judicial authorities.
4. Methods of processing and recipients of Personal Data
   The processing of Personal Data is carried out using paper and electronic tools with organizational methods and logics strictly related to the purposes indicated and by adopting adequate security measures.Personal Data are processed exclusively by:- persons authorized by the Data Controller who have undertaken to keep them confidential or have an adequate legal obligation of confidentiality;

   - subjects who operate independently as distinct data controllers or by subjects designated as data processors by the Controller in order to carry out all the processing activities necessary to pursue the purposes of this information (e.g., business partners, consultants, IT companies, service providers, hosting providers);

   - subjects or entities to whom it is mandatory to communicate Personal Data by law or by order of the authorities.The subjects listed above are required to use appropriate safeguards to protect Personal Data and may only access those necessary to perform the tasks assigned to them.

   Personal Data will not be disclosed indiscriminately in any way.

5. Location
   Personal Data will not be subject to any transfer outside the territory of the European Economic Area (EEA).
6. Period of retention of Personal Data
   Personal Data will be stored for the period of time necessary to fulfill the purposes for which they were collected, in particular:-for purposes related to the execution of the contract between the Controller and the Data Subject, they will be kept for the entire duration of the contractual relationship and, after cessation, for the ordinary prescription period of 10 years. In the case of judicial litigation, for the entire duration thereof, until the expiration of the terms for bringing actions

   - for purposes related to the legitimate interest of the Controller, they will be kept until the completion of that interest

   - for compliance with a legal obligation, by order of an authority, and for legal protection, they will be kept in compliance with the timing provided by such obligations, regulations, and in any case until the expiration of the limitation period provided by the current rules

   -for purposes based on the consent of the Data Subject, they will be kept until the revocation of the consent

   At the end of the retention period, all Personal Data will be deleted or stored in a form that does not allow the identification of the Data Subject.

7. Rights of the Data Subject
   Data Subjects can exercise certain rights concerning the Personal Data processed by the Controller. In particular, the Data Subject has the right to:

   - be informed about the processing of their Personal Data- withdraw consent at any time

   - limit the processing of their Personal Data

   - object to the processing of their Personal Data

   - access their Personal Data- verify and request the correction of their Personal Data

   - obtain the limitation of the processing of their Personal Data

   - obtain the deletion of their Personal Data

   - transfer their Personal Data to another controller

   - lodge a complaint with the supervisory authority for the protection of their Personal Data and/or take legal action.

   To exercise their rights, Data Subjects can send a request to the following email address info@partybag.it. Requests will be taken care of by the Controller immediately and processed as soon as possible, in any case within 30 days.

Last update: 26/07/2023