Privacy Policy

1. Data Controller

The Data Controller is VIVO WINE CLUB, an association based in Italy, Tax Code 95023200223, contactable at info@vivowineclub.com.

2. Categories of data processed

Depending on the user's interactions with the website and the Association, the following categories of data may be collected:

• ·Identification and contact data (first name, last name, email, phone number) provided when subscribing to the events list, the newsletter, creating a personal account, or purchasing tickets;
• ·Personal account data (login credentials, preferences, participation history);
• ·Approximate location data (geographic area) used to send communications about events organized nearby;
• ·Photographs and video footage collected during events and Association activities, which may feature participants;
• ·Browsing data collected through cookies and similar technologies (Google Analytics, Meta Pixel) - see Cookie Policy;
• ·Transaction and payment-related data (ticket purchases, membership fees), if and when such functionality is enabled on the website.

3. Purposes and legal bases of processing

3.1 Events list subscription

Data provided when subscribing to the events list is processed to send communications about events organized by the Association, including targeted communications based on the data subject's geographic area. Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), expressed through a dedicated checkbox that is not pre-ticked at the time of subscription.

3.2 Newsletter

Data provided to subscribe to the newsletter is processed to send informational and promotional communications about the Association's activities. Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), collected through a checkbox that is separate from and optional with respect to the events list subscription.

3.3 Creation and management of the personal account

Data necessary to create and manage the personal account area is processed to enable access to services reserved for members. Legal basis: performance of a membership/contractual relationship with the data subject (Art. 6(1)(b) GDPR).

3.4 Ticket purchases and any payments

Data provided when purchasing tickets for events is processed to manage the order, issue any required fiscal documentation, and provide after-sales support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR) for accounting/tax purposes.

3.5 Photographs and video footage

During events organized by the Association, photographs or video recordings may be taken and subsequently published on the website, on the Association's social media channels, or used for promotional purposes. Legal basis: specific consent of the data subject (Art. 6(1)(a) GDPR), collected through a dedicated release/checkbox separate from the other purposes described above. In the absence of such consent, the Association undertakes not to publish images in which the data subject is clearly identifiable as the main subject.

3.6 Cookies, analytics and marketing (Google Analytics, Meta Pixel)

The website uses Google Analytics for anonymous/aggregate statistical analysis of traffic and Meta Pixel for marketing and remarketing purposes. These tools are activated only upon the user's consent via the cookie banner. Legal basis: consent (Art. 6(1)(a) GDPR). For details, please refer to the Cookie Policy.

4. Nature of data provision

Providing data for the purposes referred to in points 3.3 and 3.4 (account and ticket purchase) is necessary to deliver the requested service; failure to provide such data will result in the inability to use the service. Providing data for the purposes referred to in points 3.1, 3.2 and 3.5 is optional; failure to consent does not affect access to the Association's other services.

5. Data recipients

Personal data may be shared, strictly to the extent necessary, with the following parties:

• ·Technical service providers (hosting, email provider, account management platform), appointed as Data Processors pursuant to Art. 28 GDPR;
• ·Google LLC, for the Google Analytics service;
• ·Meta Platforms Inc., for the Meta Pixel service;
• ·Any Association partners and sponsors, only with the data subject's specific consent and for the purposes authorized by them;
• ·Public authorities, where required by law.

6. Transfer of data outside the EU

Data processed through Google Analytics and Meta Pixel may be transferred to servers located in the United States. Such transfer takes place on the basis of the safeguards provided by applicable law (e.g. Standard Contractual Clauses approved by the European Commission). [To be verified and confirmed with the providers regarding the updated version of the safeguard mechanisms adopted].

7. Data retention period

• ·Personal account data: for the entire duration of membership with the Association and for the following 10 years for compliance with legal obligations;
• ·Newsletter and events list data: until the data subject withdraws consent;
• ·Photographs and videos: until consent is withdrawn or for a maximum period of 5 years from publication;
• ·Transaction data: for the period required by applicable tax and accounting regulations;
• ·Browsing data (cookies): as indicated in the Cookie Policy.

8. Data subject rights

At any time, the data subject may exercise, within the limits and conditions set out in Articles 15-22 GDPR, the following rights:

• ·Access to their personal data;
• ·Rectification of inaccurate or incomplete data;
• ·Erasure of data ("right to be forgotten"), in the cases provided by law;
• ·Restriction of processing;
• ·Data portability;
• ·Objection to processing, in particular for marketing purposes;
• ·Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent to info@vivowineclub.com. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali - www.garanteprivacy.it) or the competent supervisory authority.

9. How consent is collected

When subscribing to the events list or purchasing a ticket, the user is asked to express consent through the following separate checkboxes, none of which is pre-ticked:

• ·Acknowledgement and acceptance of this Privacy Policy (mandatory to proceed);
• ·Optional consent to receive newsletters and promotional communications;
• ·Optional consent to the publication of photographs/videos in which the data subject may appear during events.

The user may withdraw the optional consents at any time, without affecting their ability to subscribe to the events list or purchase tickets.

10. Security measures

The Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR.

11. Changes to this policy

This policy may be updated periodically. Users are invited to review it regularly. Last updated: 29/07/2026.