Privacy Policy

Last updated: 10 January 2026

This Privacy Policy explains how personal data is processed when users visit secretzone.it (the “Website”).

1. Data Controller

The data controller is:

• Associazione degli Enigmi
• Address: Strada Maggiore 40, 40125 Bologna (BO), Italy
• Tax Code (CF): 91382780376
• Email: info@secretzone.it

2. Types of Data We Process

2.1 Browsing/Usage Data

When you browse the Website, our systems may automatically collect certain data whose transmission is inherent to Internet communication protocols (e.g., IP address, device/browser identifiers, technical logs, date/time of requests, requested pages, response status).

2.2 Data You Provide Voluntarily

Depending on the services available on the Website, we may process:

• Contact requests: name, email, phone number, message content.
• Bookings: data necessary to manage your booking (e.g., name, email, phone number, date/time, number of participants, selected room/scenario, optional notes).

2.3 Payments (PayPal)

If you make a payment via PayPal, the payment is processed by PayPal under its own terms and privacy policy. The Data Controller typically receives confirmation of the transaction outcome and information necessary for administrative purposes (e.g., transaction identifiers), but does not directly process full card payment details.

2.4 Cookies and Tracking Technologies

The Website uses cookies and similar technologies. For details, please refer to the Cookie Policy.

3. Purposes and Legal Bases

We process personal data for the following purposes:

1. Managing requests and bookings

• Legal basis: performance of a contract and/or pre-contractual measures.

2. Legal and administrative/accounting obligations (where applicable)

• Legal basis: compliance with a legal obligation.

3. Security, abuse/fraud prevention, and technical operation of the Website

• Legal basis: legitimate interest in ensuring the security and integrity of our systems.

4. Analytics/measurement (Google Analytics 4)

• Legal basis: your consent (via the cookie banner), as these are not strictly necessary technologies.

5. Marketing/Advertising/Remarketing (Google Ads)

• Legal basis: your consent (via the cookie banner), as these may involve marketing/profiling technologies.

The Website does not activate “Analytics” and “Marketing” technologies before you make your choice.

4. How We Process Data

Data is processed using electronic and IT tools, in ways consistent with the purposes described above and with appropriate security measures.

5. Data Retention

We keep data only for as long as necessary to fulfill the purposes for which it was collected, in particular:

• Contact requests: up to 12 months, unless further retention is necessary to manage the request or for legal protection.
• Bookings: for the time needed to manage the booking and any related administrative/accounting needs.
• Technical and security logs: generally up to 6 months, unless extended due to incidents or lawful requests by authorities.

6. Data Recipients

Your data may be shared with:

• authorized personnel of the Data Controller;
• technical service providers (hosting, maintenance, IT services) who may act as data processors, where applicable;
• Google, only after consent, for measurement (GA4) and advertising (Google Ads) services;
• PayPal for payment processing;
• public authorities or other entities where required by law.

7. International Data Transfers (Outside the EEA)

Some providers (e.g., Google and PayPal) may involve transfers of data outside the EEA. In such cases, transfers are carried out using safeguards provided by applicable law (e.g., adequacy decisions, Standard Contractual Clauses (SCCs), or other recognized mechanisms).

8. Your Rights

You may exercise the rights provided under Articles 15–22 of the GDPR, including:

• access, rectification, deletion;
• restriction of processing;
• data portability (where applicable);
• objection (where applicable);
• withdrawal of consent at any time (without affecting the lawfulness of processing based on consent before withdrawal).

To exercise your rights, contact: info@secretzone.it.
You also have the right to lodge a complaint with the competent supervisory authority.

9. Changes to This Policy

We may update this Privacy Policy. Changes will be published on this page with an updated date.