1. Data controller
The data controller is IL C’ERA S.R.L., VAT and tax number 04421060619, based at Via Nazionale Appia, 81, 81028 Santa Maria a Vico (CE), Italy, operator of YOLO. The venue is located at Viale Enrico Mattei 3, Caserta (CE) 81100, Italy.
Information about personal data processing and requests to exercise data protection rights can be addressed to info@yolocaserta.it. The venue’s telephone contacts are 338 503 5082 (Angelo Rivetti) and 347 727 0997 (Modesto Bottone).
2. Data collected and how it is obtained
Enquiries involve processing the information provided by the individual: first name, last name, email address, telephone number and any message. Health information, identity documents and other information unnecessary for the enquiry should not be submitted.
Enquiries submitted through the form are stored in a restricted archive. A notification is sent to staff and a confirmation is sent to the email address provided, in the selected language. The language, date and time, enquiry identifier and email delivery status are also recorded to manage the enquiry and prevent duplicates.
During browsing, the visitor’s IP address, date and time, requested pages and device and browser information are processed to deliver and protect the website. The anti-spam service also collects technical connection and device signals and verification results to distinguish human visits from automated traffic. IP addresses are also used to limit excessive requests; they are not stored in click counters or the enquiry archive.
3. Purposes and legal bases
Handling event enquiries, availability requests and requests for quotations is based on taking steps at the individual’s request before entering into a contract or on performing a contract (Article 6(1)(b), GDPR). General correspondence unrelated to a contract is based on the controller’s legitimate interest in responding to enquiries (Article 6(1)(f), GDPR).
Compliance with legal obligations is based on Article 6(1)(c). Website security, preventing spam and abuse, aggregate measurement of website use and performance, and establishing, exercising or defending legal claims are based on the controller’s legitimate interests (Article 6(1)(f)), respecting individuals’ rights and freedoms.
Submitting an enquiry does not result in a newsletter subscription or constitute consent to promotional communications. Data is not used for advertising profiling or solely automated decisions producing legal or similarly significant effects. Automated security checks may prevent form submission; the venue remains available by email and telephone.
4. Provision of personal data
Providing data for an enquiry is voluntary. The form requires a first name, last name, email address and telephone number; the message is optional. The form cannot be submitted without the required fields or successful anti-spam verification. The venue’s direct contact details provide an alternative. Consent to marketing is not required to receive a response.
5. Retention
Enquiries and related correspondence are subject to a retention period limited to the time needed to respond and handle follow-up communications about the same enquiry. Once this purpose ends, the data must be deleted, except where the legal duties or protection of rights described below apply.
Deletion from the website archive is manual, with no automatic expiry. Copies in mailboxes and any backup archives require separate handling.
If an enquiry leads to a contract, administrative and accounting records subject to mandatory retention are kept for the statutory period, generally ten years; this period does not automatically apply to ordinary enquiries. Any further retention is limited to legal duties or protecting rights within applicable limitation periods and, where a dispute arises, until it is resolved. Browsing data is limited to operational and security needs and investigating abuse. Retention is governed by necessity, relevance and proportionality to the purpose; when these cease, data must be deleted or anonymised.
6. Recipients and protection
Data is accessible to staff authorised to handle enquiries and, within their assigned tasks, to providers of website operation and content delivery, enquiry storage, email, anti-spam protection, aggregate statistics and support services. Data may also be disclosed to advisers and parties entitled to receive it by law, including competent authorities. Enquiry data is not intended for public disclosure.
Providers processing data on behalf of the controller must be appointed as processors under Article 28 GDPR. Access to the enquiry archive is restricted. Information about actual recipients and their respective roles can be requested from the controller.
The anti-spam verification provider also processes technical signals as an independent controller to improve abuse detection. Information about that processing is available in the provider’s privacy notice.
7. International transfers and external links
Website delivery, security and communication services may involve processing outside the European Economic Area, including the United States. Such transfers are permitted only under Articles 44 et seq. GDPR, on the basis of an adequacy decision or appropriate safeguards, such as standard contractual clauses and additional measures where necessary. Information about recipients and a copy or details of the applicable safeguards can be requested from the controller.
Links to social networks, maps and other websites open external services at the user’s choice. Processing by those services is described in their own privacy notices. Social gallery previews are served by this website without embedding the social network’s player or requiring access to a social account.
This notice covers the YOLO website and enquiries addressed to the venue. Publishing images of people at events requires an appropriate legal basis and relevant information: visiting the website or submitting the form does not authorise the use of the individual’s image.
8. Browsing preferences and cookies
The website uses technical cookies and browser storage to remember the venue preference. The cookie lasts up to 400 days and may be renewed on return visits; the browser preference remains until site data is cleared.
The preference can be removed by clearing both cookies and other site data in the browser settings. This technical function does not require consent under Article 122 of the Italian Privacy Code.
Visits, page views and website performance are measured using cookie-free statistics without persistent identifiers used to recognise visitors. Clicks on social network, map, phone and email links are stored only as daily totals by link type and language, without IP addresses, device information or visitor identifiers. Network requests needed for these measurements remain subject to the security checks described above. This data is not used for personalised advertising or to reconstruct individual activity across different websites.
Anti-spam verification accesses technical signals necessary to protect the service and is not used for advertising. Blocking security tools in the browser may prevent form submission. The website does not provide advertising or profiling cookies. Introducing non-essential tools will require prior information and, where required, the user’s consent before activation.
9. Data protection rights
Under the conditions set out in Articles 15–22 GDPR, individuals may request access, rectification, erasure, restriction of processing and portability of data provided where automated processing is based on consent or a contract. They may also object to processing based on legitimate interests on grounds relating to their particular situation. Where processing relies on consent, that consent may be withdrawn without affecting the lawfulness of earlier processing.
Requests can be sent to info@yolocaserta.it. Exercising these rights is free, except for manifestly unfounded or excessive requests as provided by Article 12 GDPR. A response is provided without undue delay, normally within one month. For complex or numerous requests, this period may be extended by two further months, with reasons for the extension provided within the first month. Where there are reasonable doubts about the applicant’s identity, only information necessary to verify it may be requested.
Individuals may lodge a complaint with the Italian data protection authority at www.garanteprivacy.it, or with the supervisory authority in their place of habitual residence, place of work or the location of the alleged infringement. The right to seek a judicial remedy remains unaffected.
10. Updates
This notice concerns the processing described and is provided under Article 13 of Regulation (EU) 2016/679 and Italian Legislative Decree 196/2003, as amended. Any new purposes require further information before the relevant processing begins. The revision date is shown at the start of this page.