Privacy Policy

Privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

1. Data controller

The data controller is:

Time Experience S.r.l.
Registered office: Via Zanchi 2, 70026 Modugno (BA), Italy
VAT No.: 08839480723
PEC (certified e-mail): timeexperiencesrl@pec.it

This privacy notice refers to the website www.nataleabari.it (the “Website”). Natale a Bari

You can contact the Controller using the above contact details for any request or to exercise your rights.

2. Categories of data processed

Browsing data (IP address, date and time of access, visited pages, technical logs, etc.);
Data voluntarily provided via forms, including the “Write to Santa Claus” form, such as full name, child’s name, e-mail address, message content and any attachments (e.g. a photo of the letter). Natale a Bari
Cookies and similar technologies, as described in the Cookie Policy.

3. Purposes and legal bases

Website operation and security
- Ensuring the Website’s proper functioning and security.
  Legal basis: controller’s legitimate interest (Art. 6(1)(f) GDPR) and legal obligations where applicable (Art. 6(1)(c) GDPR).
Managing requests sent via the Website
- Handling messages and requests submitted through the forms, including letters to Santa Claus.
  Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and/or legitimate interest (Art. 6(1)(f) GDPR).
Sending information about the event and related initiatives (if applicable)
- Subject to your consent, sending updates and communications relating to the event and related initiatives.
  Legal basis: consent (Art. 6(1)(a) GDPR).
Statistics and analytics
- Producing anonymous or aggregated statistics on the use of the Website.
  Legal basis: legitimate interest (Art. 6(1)(f) GDPR) or consent (Art. 6(1)(a) GDPR) if non-anonymous third-party analytics cookies are used.
Marketing and profiling cookies (if active)
- Customising advertising and measuring campaign effectiveness via third-party cookies and pixels.
  Legal basis: consent (Art. 6(1)(a) GDPR).

4. Children’s data

The Website includes initiatives specifically addressed to children (e.g. the “Write to Santa Claus” section). Data concerning children (such as the child’s name) must be provided only by the parent or legal guardian.
Such data are used exclusively to manage the request and for activities strictly related to the event and will not be used for direct marketing aimed at children.

5. Data recipients and transfers outside the EEA

Data may be accessed by:

authorised personnel of the Controller;
IT and hosting service providers;
providers of communication and organisational services related to the event;
anti-spam and security providers;
third-party analytics or marketing providers, if used.

Some providers may be located outside the EEA. In such cases, appropriate safeguards will be adopted in accordance with Articles 44 et seq. GDPR (e.g. adequacy decisions, Standard Contractual Clauses).

6. Data retention

Browsing data: normally kept for up to 6–12 months, unless longer retention is required by law or for security reasons.
Form data: kept for the time necessary to process the request and, in any case, no longer than 24 months, unless longer retention is required by law or for the protection of the Controller’s rights.
Marketing data (with consent): kept until consent is withdrawn and, in any case, no longer than 24 months from the last significant interaction.
Cookies: according to what is stated in the Cookie Policy.

7. Data subjects’ rights

You may exercise at any time the rights provided by Articles 15–22 GDPR (access, rectification, erasure, restriction, portability, objection, withdrawal of consent) by contacting the Controller at the addresses indicated above.

You also have the right to lodge a complaint with the competent Supervisory Authority (in Italy, the Garante per la Protezione dei Dati Personali – www.garanteprivacy.it).