Privacy Policy

Last updated: 18 June 2026

This Privacy Policy explains how personal data are collected and processed through the website www.pasqualestafano.it.

1. Data Controller

The Data Controller is:

Associazione Culturale B Flat
VAT No. IT03905530717
Via Manzoni 8
71048 Stornarella (FG), Italy

Email: [email protected]

Requests concerning personal data and privacy rights may be sent to the email address above.

2. Personal Data Collected

Depending on how the website is used, the following categories of personal data may be collected:

  • name and surname;
  • email address;
  • billing and shipping address;
  • postal code, city and country;
  • order number and order details;
  • products purchased;
  • payment-related information;
  • information submitted through contact forms;
  • information submitted through the Online Withdrawal form;
  • newsletter subscription preferences;
  • IP address;
  • browser, device and operating system information;
  • website usage and interaction data;
  • cookie identifiers and similar tracking technologies;
  • technical logs and security information.

Payment card or PayPal account credentials are processed directly by PayPal and are not normally stored by the Data Controller.

3. Purposes and Legal Bases of Processing

Personal data may be processed for the following purposes.

Website operation and security

Technical data and logs are processed to operate, maintain and secure the website, prevent fraud, diagnose technical problems and protect the website from unauthorised access.

The legal basis is the Data Controller’s legitimate interest in ensuring the security and proper operation of the website.

Contact requests

Data submitted through contact forms or email are processed to answer enquiries and provide the requested information.

The legal basis is taking steps at the request of the user and, where applicable, the Data Controller’s legitimate interest in responding to communications.

Online purchases and order management

Personal data are processed to:

  • manage products and orders through WooCommerce;
  • process payments through PayPal;
  • prepare and send order confirmations;
  • arrange delivery through Poste Italiane;
  • manage customer support, returns, refunds and complaints;
  • comply with accounting, tax and legal obligations.

The legal bases are the performance of a contract, compliance with legal obligations and the establishment, exercise or defence of legal claims.

Online withdrawal requests

Data submitted through the Online Withdrawal form are processed to:

  • identify the customer and the relevant order;
  • receive and document the withdrawal declaration;
  • send confirmation of receipt;
  • manage product returns and refunds;
  • comply with consumer-protection obligations;
  • establish, exercise or defend legal claims.

The legal bases are the performance of a contract, compliance with legal obligations and the establishment, exercise or defence of legal claims.

Newsletter and promotional communications

Where the user subscribes to the newsletter, the email address and related subscription information are processed through Mailchimp to send news, concert announcements, music releases and other promotional communications.

The legal basis is the user’s consent. Consent may be withdrawn at any time by using the unsubscribe link included in each message or by contacting the Data Controller.

Analytics

Google Analytics may be used to understand how visitors use the website, measure traffic and improve content and performance.

Where required, analytics technologies are activated only after the user has provided consent through the cookie banner.

Advertising and conversion measurement

Meta Pixel and related Meta advertising technologies may be used to measure advertising performance, conversions and interactions with the website.

These technologies are activated only after the user has provided consent, where required.

Embedded third-party content

The website may include embedded content or widgets supplied by third parties, including:

  • YouTube;
  • Spotify;
  • Bandsintown;
  • Instagram;
  • Facebook or Meta services;
  • other music, social-media or event platforms.

These services may collect technical information, IP addresses, usage data and cookie identifiers when their content is displayed or activated.

Where required, non-essential third-party content is activated only after consent.

4. Cookies and Similar Technologies

The website uses technical cookies that are necessary for its operation and may also use analytics, advertising and third-party cookies.

Technical cookies do not require prior consent but are described in the relevant information notice.

Analytics, advertising, profiling and certain third-party technologies are used only after consent where required by applicable law.

Users can manage or withdraw their cookie choices through the cookie settings interface available on the website.

5. Services and Recipients of Personal Data

Personal data may be processed or received, where necessary, by:

  • Aruba, for website hosting and email services;
  • WooCommerce and WordPress service components, for ecommerce and website management;
  • PayPal, for payment processing;
  • Poste Italiane, for product delivery;
  • Mailchimp, for newsletter management;
  • Google, including Google Analytics, Google Tag Manager, YouTube and reCAPTCHA services;
  • Meta Platforms, including Meta Pixel, Facebook and Instagram services;
  • Spotify, for embedded music content;
  • Bandsintown, for event and concert information;
  • Forminator, for the management and storage of website form submissions;
  • technical consultants, hosting providers and authorised service providers;
  • accountants, legal advisers or public authorities where required by law.

Only data necessary for the relevant service are disclosed.

6. International Data Transfers

Some service providers, including Google, Meta, Mailchimp, PayPal, YouTube, Spotify and Bandsintown, may process personal data outside the European Economic Area.

Where applicable, transfers are carried out using recognised legal safeguards, such as adequacy decisions, Standard Contractual Clauses or other mechanisms permitted by data-protection law.

Users may contact the Data Controller for further information concerning the safeguards used for international transfers.

7. Data Retention

Personal data are retained only for as long as necessary for the purposes for which they were collected.

In particular:

  • order, payment, invoice and accounting records may be retained for up to 10 years, or longer where required by law;
  • withdrawal, return, refund, complaint and contractual-support records may be retained for up to 10 years after the relevant matter is closed;
  • contact-form enquiries may normally be retained for up to 24 months after the last communication;
  • newsletter data are retained until consent is withdrawn or the user unsubscribes;
  • cookie preferences are retained according to the settings of the cookie-consent system;
  • analytics and advertising data are retained according to the configurations and policies of the relevant service providers;
  • technical and security logs are retained for the period reasonably necessary to ensure website security and investigate incidents.

Data may be retained for a longer period where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

8. Mandatory and Optional Data

Data required to process an order, payment, shipment, withdrawal request or other contractual request are necessary to provide the relevant service.

Failure to provide required data may make it impossible to complete a purchase, deliver an order, process a withdrawal request or respond to an enquiry.

Providing data for newsletter subscription and non-essential cookies is optional.

9. Security Measures

The Data Controller adopts appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

However, no online system can guarantee absolute security.

10. Data Subject Rights

Under applicable data-protection law, users may have the right to:

  • obtain confirmation as to whether their personal data are being processed;
  • access their personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data where the legal requirements are met;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
  • receive personal data in a structured, commonly used and machine-readable format, where applicable;
  • request transmission of data to another controller, where technically feasible and legally applicable;
  • lodge a complaint with the competent data-protection authority.

Requests may be sent to:

[email protected]

The Data Controller may request information necessary to verify the identity of the person making the request.

11. Complaint to the Supervisory Authority

Users have the right to lodge a complaint with the competent supervisory authority.

In Italy, the competent authority is the:

Garante per la protezione dei dati personali

12. Third-Party Websites

The website may contain links to external websites and services.

The Data Controller is not responsible for the privacy practices, security or content of third-party websites. Users should review the privacy policies of those services before providing personal data.

13. Children

The website and online shop are not specifically directed at children.

The Data Controller does not knowingly collect personal data from children for marketing purposes without the required authorisation.

14. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect legal, technical or operational changes.

The current version will always be published on this page together with the date of the latest update.